last executing test programs:

2.614931043s ago: executing program 1 (id=6):
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[], 0x0, 0x3b, 0x0, 0x8}, 0x28)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000004b40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000002800)=ANY=[@ANYBLOB], 0x18}, 0x8)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500000001000000400000004000000041000000", @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/14], 0x48)
r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000500)='syzkaller\x00'}, 0x94)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x40)
bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x20, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
socket$kcm(0x2, 0x1, 0x84)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000000f0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r1, 0x2000012, 0x100e, 0x2, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

2.407572037s ago: executing program 0 (id=8):
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x202, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae58e99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472ad529cefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc979ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa09acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b183940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19, 0x0, 0xffffffffffffffff, 0x54}, 0x42)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000280)="61df718305a35997984d4763fcac", 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48)

2.4025355s ago: executing program 1 (id=9):
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0xfff}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x53, 0x1, 0x0, 0x0, 0x0, 0x7ff3, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x0, @perf_bp={0x0, 0x3}, 0x14105, 0xf, 0xfffffbff, 0x3, 0x2, 0x7, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000640)={{r0}, &(0x7f00000001c0), &(0x7f0000000600)}, 0x20)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50)

2.110026206s ago: executing program 2 (id=11):
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x41}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7d}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70)

2.068091745s ago: executing program 2 (id=12):
socket$kcm(0x10, 0x400000002, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000007c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x5, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2, 0x3}}]}, {0x0, [0x0, 0x2e, 0x5f]}}, 0x0, 0x4d}, 0x28)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xd, 0x3, &(0x7f0000000400)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0xc0}}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94)
recvmsg$unix(0xffffffffffffffff, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000002780)=[{0x0}], 0x1}, 0x10020)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)}], 0x1}, 0x0)
gettid()
socketpair$unix(0x1, 0x5, 0x0, 0x0)
socket$kcm(0x10, 0x2, 0x0)
bpf$MAP_DELETE_ELEM(0x2, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xae6}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10)
r0 = socket$kcm(0x10, 0x2, 0x0)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000280), 0x8)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb92e0a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x200002, 0x0)
r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x804, 0x14c9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803, 0x0, @perf_config_ext={0x1}, 0x20a0, 0x58, 0x80000000, 0x4, 0x2, 0xfffffffe, 0x1, 0x0, 0x0, 0x0, 0x6e8}, 0x0, 0x0, 0xffffffffffffffff, 0x8)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$kcm(0x10, 0x2, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48)

1.799792198s ago: executing program 0 (id=13):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_config_ext={0x3, 0x8001}, 0x0, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={r0, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r1=>0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000001b40), 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x47, 0x0}}, 0x10)
r2 = socket$kcm(0x2, 0x200000000000001, 0x106)
ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
ioctl$SIOCSIFHWADDR(r3, 0x40305828, &(0x7f0000000340)={'lo\x00', @random="3f2f94c100"})
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xff51, '\x00', r1, r3, 0x0, 0x2}, 0x50)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
mkdir(&(0x7f0000000000)='./cgroup/../file0/file0\x00', 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x28)
r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112})
ioctl$TUNSETLINK(r4, 0x400454cd, 0xfff0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e02002c000b35d25a806f8c6394f903", 0x11}], 0x1}, 0x0)
sendmsg$inet(r2, 0x0, 0x30004001)
setsockopt$sock_attach_bpf(r2, 0x6, 0xd, 0x0, 0x0)
setsockopt$sock_attach_bpf(r2, 0x1, 0x24, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x30}, [@alu={0x4, 0x0, 0x3, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f00000002c0)='GPL\x00', 0xf}, 0x94)

1.631849569s ago: executing program 1 (id=14):
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0xfffffffc, 0x1, 0x0, 0x0, 0xffff}, 0x0, 0x3, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000180)=0xffffffffffffffff, 0x4)
bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000200)={r3, r1, 0x0, r2}, 0x10)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8)
r4 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x4, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x2e, 0xfffffbff, 0x4, 0x2, 0x0, 0x6}, 0x0, 0xffffffffffffffff, r0, 0x9)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x1}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x23, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@map_idx_val={0x18, 0xa, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x7}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @ringbuf_query, @alu={0x4, 0x0, 0xd, 0x8, 0xa, 0xffffffffffffffc0, 0x1}, @ringbuf_query], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000640)='syzkaller\x00', 0x10001, 0xa8, &(0x7f00000006c0)=""/168, 0x40f00, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040), 0xcf)
r6 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$sock_attach_bpf(r6, 0x29, 0x23, &(0x7f0000000040), 0xcf)
r7 = socket$kcm(0xf, 0x3, 0x2)
sendmsg$inet(r7, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="0213020902000000e4a17c4e2ca18baa", 0x10}], 0x1}, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, 0x0}, 0x4000000)
r8 = socket$kcm(0x2, 0x5, 0x84)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
close(r9)
setsockopt$sock_attach_bpf(r8, 0x84, 0x83, 0x0, 0x0)

1.011106309s ago: executing program 0 (id=15):
bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="850000003b0000007b00000000000000270000000a0000009500000000000000ed5f0be3755142ae31484cd0115bab2d0589e8ab9f429b60317312f13bd708a35c0670c61fc97c4551f58ae3bbfb9f1d97582f15f3922a3c39716ebdd3c864aec6bc39f3bf389d21e614314b44d3a320471dc33ceec91a1512761160808845c885e7e75118ae8702a167ce7d0ca850e435f105f4c7702c8505fc4669acef909579390b1a6795fae716b04fba77244be06160107ab2a3a30645bbec6570170c1d362e6d6209fa0809ffbcc48bfa0175374dc3"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffed8}, 0x23)

1.010762736s ago: executing program 0 (id=16):
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x50)
close(0x3)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r0, 0x0, 0xffffffffffffffff}, 0x18)

902.541404ms ago: executing program 1 (id=17):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r0, 0x1, 0x2e, &(0x7f0000000000)=r0, 0x4)
recvmsg$unix(r0, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x2002)

902.000448ms ago: executing program 0 (id=18):
r0 = socket$kcm(0xa, 0x3, 0x106)
setsockopt$sock_attach_bpf(r0, 0x29, 0x4c, 0x0, 0x4)

820.951076ms ago: executing program 0 (id=19):
r0 = socket$kcm(0x2, 0x200000000000001, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x4, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2a}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48)
r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000180)=ANY=[], &(0x7f0000000000)='GPL\x00'}, 0x94)
bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000580)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="0500"], 0x10)
r4 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
socket$kcm(0xa, 0x922000000003, 0x11)
recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r7)
setsockopt$sock_attach_bpf(r6, 0x1, 0x32, 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x20000000)
ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x4020940d, 0x0)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={<r8=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r8, 0x1, 0x48, &(0x7f0000000000), 0x4)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xb, 0x6, &(0x7f0000000000)=@framed={{0x6, 0x0, 0x0, 0x0, 0x0, 0x69, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x20008000)
recvmsg(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f00000000c0)=""/18, 0x5}], 0x1}, 0x112)

477.464868ms ago: executing program 2 (id=20):
perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x6, 0x4, 0x2}, 0x50)
perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0)
write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='b ', @ANYRESDEC=r0], 0xe)
bpf$PROG_LOAD(0x5, 0x0, 0x0)

358.97471ms ago: executing program 2 (id=21):
r0 = socket$kcm(0xa, 0x2, 0x0)
setsockopt$sock_attach_bpf(r0, 0x29, 0x1a, &(0x7f0000000140), 0x4)
sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x80, 0x0}, 0x20000002)

358.655193ms ago: executing program 2 (id=22):
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100f, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x7fffffff, 0x9}, 0x0, 0x0, 0x2, 0x6}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0xa)
r0 = socket$kcm(0x2, 0x5, 0x84)
sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}, 0x24000900)
perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x9c00, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x1)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socketpair(0x1e, 0x1, 0x0, 0x0)
close(0xffffffffffffffff)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000)
ioctl$TUNSETOFFLOAD(r1, 0x541b, 0xf0ff1f00000000)

91.301624ms ago: executing program 2 (id=23):
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x52, 0x1, 0x0, 0x0, 0x0, 0x7ff0, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7d, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9)
bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x12, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000"], &(0x7f0000000080)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000700)={<r1=>0xffffffffffffffff})
recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2)
recvmsg$unix(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000380)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='/proc/1k\xfc\x9e\x98\xac;#\xdb\x0f!/\x00\x82q\xee\xe5\xa0\xbd\xc2\x98#'}, 0x30)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r3 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400}, 0x94)
recvmsg$unix(0xffffffffffffffff, &(0x7f0000003040)={0x0, 0x0, 0x0}, 0x0)
syz_clone(0x84005080, 0x0, 0x0, 0x0, 0x0, 0x0)

180.966µs ago: executing program 1 (id=24):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000071103d0000000000950000"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94)

0s ago: executing program 1 (id=25):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x30a)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:49418' (ED25519) to the list of known hosts.
syzkaller login: [   48.963478][ T5780] cgroup: Unknown subsys name 'net'
[   49.053431][ T5780] cgroup: Unknown subsys name 'cpuset'
[   49.058282][ T5780] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   50.479509][ T5780] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   54.828973][ T5833] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   54.833692][ T5833] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   54.837206][ T5833] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   54.843682][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   54.848050][ T5833] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   54.851335][ T5833] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   54.853725][ T5833] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   54.858686][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   54.861976][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   54.864580][ T5839] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   54.867373][ T5839] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   54.887869][ T5834] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   54.889604][ T5842] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   54.895118][ T5842] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   54.898247][ T5842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   55.104326][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   55.232381][ T5838] chnl_net:caif_netlink_parms(): no params data found
[   55.273381][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.276932][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.279642][ T5831] bridge_slave_0: entered allmulticast mode
[   55.284021][ T5831] bridge_slave_0: entered promiscuous mode
[   55.288027][ T5830] chnl_net:caif_netlink_parms(): no params data found
[   55.301746][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.304415][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.306779][ T5831] bridge_slave_1: entered allmulticast mode
[   55.309576][ T5831] bridge_slave_1: entered promiscuous mode
[   55.370184][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.375529][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.405499][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.407934][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.410546][ T5838] bridge_slave_0: entered allmulticast mode
[   55.413310][ T5838] bridge_slave_0: entered promiscuous mode
[   55.427551][ T5831] team0: Port device team_slave_0 added
[   55.443869][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.447120][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.450261][ T5838] bridge_slave_1: entered allmulticast mode
[   55.454884][ T5838] bridge_slave_1: entered promiscuous mode
[   55.474710][ T5831] team0: Port device team_slave_1 added
[   55.521388][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[   55.523752][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[   55.526158][ T5830] bridge_slave_0: entered allmulticast mode
[   55.528882][ T5830] bridge_slave_0: entered promiscuous mode
[   55.532371][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[   55.534707][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[   55.537162][ T5830] bridge_slave_1: entered allmulticast mode
[   55.539879][ T5830] bridge_slave_1: entered promiscuous mode
[   55.546132][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.549917][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.553907][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.565162][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.589172][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.593131][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.596118][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.607741][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.636954][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   55.655306][ T5838] team0: Port device team_slave_0 added
[   55.659988][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   55.673792][ T5838] team0: Port device team_slave_1 added
[   55.698314][ T5831] hsr_slave_0: entered promiscuous mode
[   55.701396][ T5831] hsr_slave_1: entered promiscuous mode
[   55.727096][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.729648][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.738726][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.746025][ T5830] team0: Port device team_slave_0 added
[   55.758470][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.761663][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.770786][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.778095][ T5830] team0: Port device team_slave_1 added
[   55.848955][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[   55.852147][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.863477][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   55.883492][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[   55.886427][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   55.897240][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   55.915377][ T5838] hsr_slave_0: entered promiscuous mode
[   55.917813][ T5838] hsr_slave_1: entered promiscuous mode
[   55.920013][ T5838] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   55.924096][ T5838] Cannot create hsr debugfs directory
[   56.008172][ T5830] hsr_slave_0: entered promiscuous mode
[   56.012388][ T5830] hsr_slave_1: entered promiscuous mode
[   56.015289][ T5830] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   56.018454][ T5830] Cannot create hsr debugfs directory
[   56.135531][ T5831] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   56.169121][ T5831] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   56.176582][ T5831] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   56.194440][ T5831] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   56.302618][ T5838] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   56.324676][ T5838] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   56.343639][ T5838] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   56.353861][ T5838] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   56.392910][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   56.398281][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   56.411934][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   56.423978][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.426795][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   56.467236][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   56.479826][   T32] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.482498][   T32] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.507832][   T32] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.510508][   T32] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.553231][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.584702][ T5838] 8021q: adding VLAN 0 to HW filter on device team0
[   56.600251][ T3536] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.603342][ T3536] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.628140][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[   56.633938][ T3536] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.636659][ T3536] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.675504][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[   56.688172][ T3536] bridge0: port 1(bridge_slave_0) entered blocking state
[   56.691207][ T3536] bridge0: port 1(bridge_slave_0) entered forwarding state
[   56.701495][ T3536] bridge0: port 2(bridge_slave_1) entered blocking state
[   56.703911][ T3536] bridge0: port 2(bridge_slave_1) entered forwarding state
[   56.719612][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.789212][ T5831] veth0_vlan: entered promiscuous mode
[   56.798517][ T5831] veth1_vlan: entered promiscuous mode
[   56.830097][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.839732][ T5831] veth0_macvtap: entered promiscuous mode
[   56.853678][ T5831] veth1_macvtap: entered promiscuous mode
[   56.891723][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   56.895488][ T5838] veth0_vlan: entered promiscuous mode
[   56.903716][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   56.911236][ T5831] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   56.914185][ T5831] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   56.917026][ T5831] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   56.919850][ T5831] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   56.928272][ T5838] veth1_vlan: entered promiscuous mode
[   56.931258][ T5842] Bluetooth: hci0: command tx timeout
[   56.933317][ T5842] Bluetooth: hci2: command tx timeout
[   56.935245][ T5842] Bluetooth: hci1: command tx timeout
[   56.962693][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[   56.982622][ T5838] veth0_macvtap: entered promiscuous mode
[   56.994225][ T5838] veth1_macvtap: entered promiscuous mode
[   57.019429][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.034739][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.045277][ T5838] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.048168][ T5838] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.051200][ T5838] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.053919][ T5838] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.059241][  T133] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.071055][  T133] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.074892][ T5830] veth0_vlan: entered promiscuous mode
[   57.086991][ T5830] veth1_vlan: entered promiscuous mode
[   57.124384][   T32] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.132348][   T32] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.167603][ T3536] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.170205][ T3536] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.187557][ T5830] veth0_macvtap: entered promiscuous mode
[   57.208207][ T5830] veth1_macvtap: entered promiscuous mode
[   57.229493][ T3044] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.232358][ T3044] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.239157][ T5831] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   57.249376][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[   57.257868][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[   57.265330][ T5830] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   57.268135][ T5830] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   57.271534][ T5830] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   57.276332][ T5830] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   57.426467][  T247] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.429208][  T247] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.461389][  T247] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   57.464221][  T247] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   57.940336][    C1] hrtimer: interrupt took 32332 ns
[   58.104159][ T5920] Illegal XDP return value 342351872 on prog  (id 9) dev N/A, expect packet loss!
[   58.114480][ T5924] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   58.117408][ T5924] batman_adv: batadv0: Removing interface: batadv_slave_0
[   58.137678][ T5924] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   58.145042][ T5924] batman_adv: batadv0: Removing interface: batadv_slave_1
[   59.023303][ T5842] Bluetooth: hci2: command tx timeout
[   59.025175][ T5842] Bluetooth: hci0: command tx timeout
[   59.027258][ T5833] Bluetooth: hci1: command tx timeout
[   60.088193][ T5952] Zero length message leads to an empty skb
[   76.062225][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   76.066557][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   76.070058][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   76.075840][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   76.079779][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   76.154477][   T55] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   76.157806][   T55] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   76.162006][   T55] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   76.165065][   T55] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   76.168289][   T55] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   76.186753][   T55] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   76.191341][   T55] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   76.194244][   T55] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   76.197656][   T55] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   76.201549][   T55] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   78.131536][ T5222] Bluetooth: hci3: command tx timeout
[   78.210611][   T55] Bluetooth: hci4: command tx timeout
[   78.213516][ T5222] Bluetooth: hci5: command tx timeout
[   80.210671][ T5222] Bluetooth: hci3: command tx timeout
[   80.290710][ T5222] Bluetooth: hci5: command tx timeout
[   80.293073][ T5222] Bluetooth: hci4: command tx timeout
[   82.290568][   T55] Bluetooth: hci3: command tx timeout
[   82.370627][   T55] Bluetooth: hci4: command tx timeout
[   82.373290][   T55] Bluetooth: hci5: command tx timeout
[   84.372121][ T5222] Bluetooth: hci3: command tx timeout
[   84.450668][ T5222] Bluetooth: hci5: command tx timeout
[   84.454274][   T55] Bluetooth: hci4: command tx timeout
[  136.265137][ T5833] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  136.269854][ T5833] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  136.273481][ T5833] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  136.277189][ T5833] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  136.280971][ T5833] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  136.331493][   T55] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  136.335289][   T55] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  136.338724][   T55] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  136.342963][   T55] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  136.346873][   T55] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  136.384051][ T5222] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1
[  136.387871][ T5222] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9
[  136.391385][ T5222] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9
[  136.394248][ T5222] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4
[  136.397749][ T5222] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2
[  138.370720][ T5222] Bluetooth: hci6: command tx timeout
[  138.373296][ T5222] Bluetooth: hci7: command tx timeout
[  138.450656][ T5833] Bluetooth: hci8: command tx timeout
[  140.450632][ T5222] Bluetooth: hci6: command tx timeout
[  140.453955][ T5833] Bluetooth: hci7: command tx timeout
[  140.530570][ T5833] Bluetooth: hci8: command tx timeout
[  142.534445][ T5833] Bluetooth: hci7: command tx timeout
[  142.536788][ T5833] Bluetooth: hci6: command tx timeout
[  142.611102][ T5222] Bluetooth: hci8: command tx timeout
[  144.610625][ T5833] Bluetooth: hci7: command tx timeout
[  144.613107][ T5222] Bluetooth: hci6: command tx timeout
[  144.690533][ T5222] Bluetooth: hci8: command tx timeout
[  165.190394][    C1] rcu: INFO: rcu_preempt self-detected stall on CPU
[  165.192854][    C1] rcu: 	1-....: (1 GPs behind) idle=9e4c/1/0x4000000000000000 softirq=14879/14880 fqs=5249
[  165.199384][    C1] rcu: 	         hardirqs   softirqs   csw/system
[  165.202318][    C1] rcu: 	 number:   952972          0            0
[  165.204921][    C1] rcu: 	cputime:    24381      28108           95   ==> 52500(ms)
[  165.208172][    C1] rcu: 	(t=10502 jiffies g=7005 q=3590 ncpus=2)
[  165.210753][    C1] CPU: 1 UID: 0 PID: 5952 Comm: syz.2.23 Not tainted 6.16.0-rc6-syzkaller-00411-g95993dc3039e-dirty #0 PREEMPT(full) 
[  165.210768][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  165.210775][    C1] RIP: 0010:handle_softirqs+0x1b0/0x870
[  165.210797][    C1] Code: 89 64 24 30 0f b7 db 48 c7 c7 00 ad 89 8b e8 a7 ee e8 09 65 66 c7 05 85 5b 1a 11 00 00 e8 58 00 42 00 fb 49 c7 c7 c0 c0 e0 8d <b8> ff ff ff ff 0f bc c3 41 89 c5 41 ff c5 0f 84 c2 03 00 00 89 5c
[  165.210806][    C1] RSP: 0018:ffffc900001e0e40 EFLAGS: 00000286
[  165.210843][    C1] RAX: b829742482375600 RBX: 0000000000000200 RCX: b829742482375600
[  165.210859][    C1] RDX: 0000000000000002 RSI: ffffffff8d99883e RDI: ffffffff8be29f40
[  165.210866][    C1] RBP: ffffc900001e0f50 R08: ffffffff8fa1e8f7 R09: 1ffffffff1f43d1e
[  165.210872][    C1] R10: dffffc0000000000 R11: fffffbfff1f43d1f R12: 000000000000000a
[  165.210879][    C1] R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff8de0c0c0
[  165.210887][    C1] FS:  00007f892af836c0(0000) GS:ffff8881a3c1f000(0000) knlGS:0000000000000000
[  165.210896][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  165.210902][    C1] CR2: 00007f59d25802d8 CR3: 0000000110b2c000 CR4: 00000000000006f0
[  165.210936][    C1] Call Trace:
[  165.210945][    C1]  <IRQ>
[  165.210954][    C1]  ? lapic_next_event+0x11/0x20
[  165.210968][    C1]  ? clockevents_program_event+0x24d/0x360
[  165.210986][    C1]  ? __irq_exit_rcu+0xca/0x1f0
[  165.211004][    C1]  ? __pfx_handle_softirqs+0x10/0x10
[  165.211024][    C1]  __irq_exit_rcu+0xca/0x1f0
[  165.211036][    C1]  ? __pfx___irq_exit_rcu+0x10/0x10
[  165.211055][    C1]  irq_exit_rcu+0x9/0x30
[  165.211066][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[  165.211082][    C1]  </IRQ>
[  165.211087][    C1]  <TASK>
[  165.211092][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  165.211103][    C1] RIP: 0010:rcu_read_unlock_special+0x0/0x4c0
[  165.211120][    C1] Code: 89 fd 4c 89 f7 e8 d0 68 7b 00 4c 89 ef e9 7a ff ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48
[  165.211128][    C1] RSP: 0018:ffffc90003acf388 EFLAGS: 00000202
[  165.211137][    C1] RAX: 0000000000000000 RBX: ffff888020f9a104 RCX: b829742482375600
[  165.211144][    C1] RDX: 0000000000000003 RSI: ffffffff8db8655b RDI: ffff888020f99cc0
[  165.211152][    C1] RBP: ffffc90003acf630 R08: ffff888021254ba3 R09: 1ffff1100424a974
[  165.211159][    C1] R10: dffffc0000000000 R11: ffffed100424a975 R12: 1ffff110041f3420
[  165.211166][    C1] R13: dffffc0000000000 R14: ffff888020f9a108 R15: dffffc0000000000
[  165.211189][    C1]  __rcu_read_unlock+0x84/0xe0
[  165.211203][    C1]  ? copy_pmd_range+0x66f1/0x7000
[  165.211219][    C1]  copy_pmd_range+0x67b9/0x7000
[  165.211257][    C1]  ? __pfx_copy_pmd_range+0x10/0x10
[  165.211273][    C1]  ? __pfx_trace_call_bpf+0x10/0x10
[  165.211298][    C1]  copy_page_range+0xc46/0x1270
[  165.211313][    C1]  ? __lock_acquire+0xab9/0xd20
[  165.211343][    C1]  ? __pfx_copy_page_range+0x10/0x10
[  165.211365][    C1]  ? up_write+0x1c4/0x420
[  165.211378][    C1]  ? __pfx_vma_interval_tree_augment_rotate+0x10/0x10
[  165.211395][    C1]  dup_mmap+0xf57/0x1ac0
[  165.211424][    C1]  ? __pfx_dup_mmap+0x10/0x10
[  165.211444][    C1]  ? __pfx_rcu_read_lock_any_held+0x10/0x10
[  165.211457][    C1]  ? mm_init+0xce1/0xf10
[  165.211478][    C1]  copy_mm+0x13c/0x4b0
[  165.211493][    C1]  ? copy_process+0x978/0x3b80
[  165.211505][    C1]  copy_process+0x16d3/0x3b80
[  165.211525][    C1]  ? copy_process+0x978/0x3b80
[  165.211550][    C1]  ? __pfx_copy_process+0x10/0x10
[  165.211565][    C1]  ? trace_call_bpf+0xb7/0x850
[  165.211575][    C1]  ? trace_call_bpf+0x5ba/0x850
[  165.211593][    C1]  kernel_clone+0x21e/0x870
[  165.211606][    C1]  ? __pfx_trace_call_bpf+0x10/0x10
[  165.211621][    C1]  ? __pfx_kernel_clone+0x10/0x10
[  165.211650][    C1]  __x64_sys_clone+0x18b/0x1e0
[  165.211667][    C1]  ? __pfx___x64_sys_clone+0x10/0x10
[  165.211706][    C1]  do_syscall_64+0xfa/0x3b0
[  165.211722][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  165.211733][    C1]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  165.211746][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  165.211757][    C1] RIP: 0033:0x7f892a18e9a9
[  165.211768][    C1] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  165.211776][    C1] RSP: 002b:00007f892af82fe8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
[  165.211787][    C1] RAX: ffffffffffffffda RBX: 00007f892a3b6080 RCX: 00007f892a18e9a9
[  165.211794][    C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000084005080
[  165.211799][    C1] RBP: 00007f892a210d69 R08: 0000000000000000 R09: 0000000000000000
[  165.211805][    C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
[  165.211854][    C1] R13: 0000000000000000 R14: 00007f892a3b6080 R15: 00007ffcb9890088
[  165.211876][    C1]  </TASK>
[  165.407078][    C1] sched: DL replenish lagged too much

VM DIAGNOSIS:
15:44:54  Registers:
info registers vcpu 0

CPU#0
RAX=b24ac95f5bfafc00 RBX=ffffffff81976a48 RCX=b24ac95f5bfafc00 RDX=0000000000000001
RSI=ffffffff8d99883e RDI=ffffffff8be29f40 RBP=ffffffff8de07ea8 RSP=ffffffff8de07d80
R8 =ffff88804b032f9b R9 =1ffff110096065f3 R10=dffffc0000000000 R11=ffffed10096065f4
R12=ffffffff8fa1e8f0 R13=0000000000000000 R14=0000000000000000 R15=1ffffffff1bd2a50
RIP=ffffffff8b6e84f3 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b861f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00005627420b1e08 CR3=00000001109b8000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000001 XMM01=0000000000000000 00007fd324186d00
XMM02=0000000500000007 0000555500000001 XMM03=000055557e7a6240 000055557e7a6190
XMM04=0000000000000000 000000000000000e XMM05=0000000000000000 000000000001df8a
XMM06=000055557e7aa9b0 0000555500000007 XMM07=0000555500000000 000055557e7aa820
XMM08=000055557e7aa7b0 0000555500000006 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=0000000000000034 RBX=0000000000000034 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc900001e0170
R8 =ffff888107fd0237 R9 =1ffff11020ffa046 R10=dffffc0000000000 R11=ffffffff85472aa0
R12=dffffc0000000000 R13=ffffffff99af58c3 R14=ffffffff99dfa1e0 R15=0000000000000000
RIP=ffffffff85472b1c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f892af836c0 ffffffff 00c00000
GS =0000 ffff8881a3c1f000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f59d25802d8 CR3=0000000110b2c000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 000000524f525245 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=0000000000000000 0000000000000000 XMM03=ffffffffffffffff ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 000000524f525245 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 00524f5252450040 XMM09=0000000000000000 00007f59d2411ec1
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
