last executing test programs: 9.091380863s ago: executing program 3 (id=12060): bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) socket$inet6(0xa, 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) socket$kcm(0x10, 0x2, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random='\x00\r\x00\x00\x00 '}) 7.249613564s ago: executing program 3 (id=12061): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f406", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xc5, 0x7e}}}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004805}, 0x10) 6.917333797s ago: executing program 3 (id=12068): syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) bind$xdp(r0, &(0x7f0000000100)={0x2c, 0x0, r2}, 0x10) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000000)=0x4, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) recvmsg(r1, &(0x7f0000002c00)={&(0x7f0000000180)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, 0x80, 0x0, 0x0, &(0x7f0000001c00)=""/4096, 0x1000}, 0x1) r4 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f0000000580)={0x0, 0xec, "0f5efaacd0d12878f2659e749babba7d41e443975068a8178cd07aa09a9753f5e4a3c56672587b74e32d5b5fbf6ba2722bec7bcf22286464f872f2ee202284493c4021100739ac60f91da2345778cd1bdbe2d988b6e6ae1a67b0ff2197fda56d55b50a198331561220b7805108684e433e54bb839adce44669b37fc583eca8acf610c7cdd57666ac3c01f2a6a62dfb50e8a6785b6a57e3614fd9904e21c0c26a0027bebe458001fb746fa5b07eeff2cf7a914dab742e5b31f8e6a2c4ce7595fd420f2e53b802a1fd96ba89fc8d56e42d1266c3c0609f878c889dd7fcde33b07909908730606100f79630269a"}, &(0x7f0000000180)=0xf4) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0x0, 0x0, 0x1, 0x89f, 0x8, 0x1]}}, 0x5c) setsockopt$MRT6_FLUSH(r4, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r6, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="74000000000101040000000000000000020000002400018014000180080001000000000008000200e00000020c0002800500010000000000240002800c00028005000100000000001400018008000100ac1e000108000200e0000002080007400000000010000580"], 0x74}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001800010000000000000000001d01000008000a00", @ANYRES32, @ANYBLOB='\b\x00\t\x00', @ANYRESDEC=r3], 0x24}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f00000003c0)=@framed={{}, [@cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffffd}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x401}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r7, 0x0, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=ANY=[@ANYBLOB="800000000802110000010802110009000000000000010000000000000000000164000100000602020202020c06002400000000000000"], 0x36) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x29, 0x5, 0x0) 6.848856123s ago: executing program 2 (id=12072): socket$kcm(0x29, 0x5, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0xc0, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x138) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000200)=@nat={'nat\x00', 0x19, 0x0, 0x90, [0x200000000140, 0x0, 0x0, 0x200000000170, 0x2000000001a0], 0x0, 0x0, &(0x7f0000000140)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}]}, 0x108) openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000000)='memory.pressure\x00', 0x2, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00000001c0)="a6e2976b5c", 0x5, 0x840, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xc, 0x0, 0x200, 0x80, 0x1, 0xf0a}, {0x3, 0x2, 0x4, 0x1, 0x1, 0x7fffffff}, 0x8000, 0xdd3, 0x203}}, @TCA_TBF_BURST={0x8, 0x6, 0x7}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) recvmmsg(r2, &(0x7f0000001e40)=[{{0x0, 0x0, &(0x7f0000000a40)=[{0x0}, {0x0}, {&(0x7f00000007c0)=""/151, 0x97}, {&(0x7f0000000880)=""/166, 0xa6}, {&(0x7f0000000940)=""/183, 0xb7}, {&(0x7f0000000a00)=""/52, 0x34}], 0x6}, 0x7ff}, {{&(0x7f0000000bc0)=@l2tp6, 0x80, &(0x7f0000001040)=[{&(0x7f0000000c40)=""/41, 0x29}, {&(0x7f0000000740)=""/120, 0x78}, {&(0x7f0000000d00)=""/183, 0xb7}, {&(0x7f0000000dc0)=""/113, 0x71}, {&(0x7f0000000e40)=""/96, 0x60}, {&(0x7f0000000ec0)=""/88, 0x58}, {&(0x7f0000000f40)=""/254, 0xfe}], 0x7, &(0x7f00000010c0)=""/253, 0xfd}, 0x3}, {{&(0x7f00000011c0)=@nl=@proc, 0x80, &(0x7f0000001800)=[{&(0x7f0000001240)=""/123, 0x7b}, {&(0x7f00000012c0)=""/9, 0x9}, {&(0x7f0000001fc0)=""/222, 0xde}, {&(0x7f0000001500)=""/232, 0xe8}, {&(0x7f0000001600)=""/203, 0xcb}, {&(0x7f0000001700)=""/239, 0xef}], 0x6, &(0x7f0000001880)=""/102, 0x66}, 0x2}, {{&(0x7f0000001900)=@ax25={{0x3, @default}, [@bcast, @remote, @netrom, @bcast, @remote, @null, @rose, @netrom]}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001300)=""/180, 0xb4}], 0x1, &(0x7f0000001a80)=""/240, 0xf0}, 0x8}, {{0x0, 0x0, &(0x7f0000001d00)=[{&(0x7f0000001b80)=""/168, 0xa8}, {&(0x7f0000001c40)=""/47, 0x2f}, {&(0x7f0000001c80)=""/110, 0x6e}], 0x3, &(0x7f0000001d40)=""/204, 0xcc}, 0x800}], 0x5, 0x2040, 0x0) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x400000000000235, 0x0) 6.652576611s ago: executing program 2 (id=12075): syz_emit_ethernet(0x42, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) close(0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x5}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x800}, @TCA_TBF_PARMS={0x28, 0x1, {{0x81, 0x0, 0xe, 0x7f, 0x800, 0x5}, {0x7, 0x2, 0x7, 0x1003, 0x5, 0x20000007}, 0x6db6312a, 0x7, 0x1257}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40008c1}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000940)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0xa, 0x3}, {0x8, 0x2}, {0x8, 0x1}]}, @var={0x5, 0x0, 0x0, 0xe, 0x5, 0x1}]}, {0x0, [0x61, 0x0, 0x2e, 0x2e]}}, &(0x7f0000000840)=""/226, 0x52, 0xe2, 0x1, 0x8}, 0x28) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r6, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000740)={0x50, 0x1, 0x2, 0x3, 0x0, 0x0, {0xa, 0x0, 0x2}, [@CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x8080}, 0x4004000) r7 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000340)=0x63ba, 0x4) listen(r5, 0x5) accept(r5, 0x0, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r4, 0x2000012, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 6.303625537s ago: executing program 4 (id=12079): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xc5, 0x7e}}}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004805}, 0x10) 6.173644481s ago: executing program 4 (id=12080): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@ptr={0x2, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e]}}, 0x0, 0x27, 0x0, 0x1, 0x9}, 0x28) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f00000000c0)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4800}, 0x0) getsockopt(0xffffffffffffffff, 0x200000000114, 0x271c, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) getsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f00000004c0)=""/17, &(0x7f00000003c0)=0x11) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x25, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) close(0x3) 6.012665965s ago: executing program 3 (id=12081): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@ptr={0x2, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e]}}, 0x0, 0x27, 0x0, 0x1, 0x9}, 0x28) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f00000000c0)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4800}, 0x0) getsockopt(0xffffffffffffffff, 0x200000000114, 0x271c, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) getsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f00000004c0)=""/17, &(0x7f00000003c0)=0x11) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4890) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x25, 0x1, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xb}, {0xa, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) close(0x3) 3.43253911s ago: executing program 4 (id=12083): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r3, 0xffc0, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000300)=@NCI_OP_CORE_INIT_RSP={0x0, 0x0, 0x2, 0x1, 0x11}, 0x14) write$nci(r0, &(0x7f00000007c0)=@NCI_OP_CORE_INIT_RSP_V2={0x0, 0x0, 0x2, 0x1, 0x5, {0x1, 0x234b3ca, 0x2, 0x9, 0x2, 0x6, 0x8, 0x8001, 0x55, "1dce4391cd4c3518ce6e02c5a258efbb84058096ff058702bb0a1d919cfe7db80a5ac8ce5fb25d294964198f9c2954de1358bf0c5a1d59acc93eaf0278054960c9915030e7d377f7dfc14b65b0ca7ff53469dffa05"}}, 0x66) 3.425627811s ago: executing program 3 (id=12084): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000300)={0x28, 0x0, 0x2711}, 0x10) listen(r2, 0x0) pselect6(0x40, &(0x7f0000000200)={0x7, 0x2bf3, 0x1, 0x400, 0x100, 0x5, 0xa1}, &(0x7f0000000240)={0xa, 0x1, 0x3, 0xcd35, 0x6, 0x6, 0x5, 0x10000}, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000140)="a300915cf85b4ad9630e1f8b27ec36dd7506582de3e415e81fdadffc7828c2e9440eb08d6fda8728b54ef81d1335243d3cde96c7fec670f98dc633b11b12d75439d29f3ae67b65112d5572f5e868", 0x4e}, {&(0x7f0000000200)="e6c418663c3b97c0c9994c930456233f93c2872563bab2db2f43323e6ea046dd168ef4017943aeae0b4a383369652ecb2daa82e827b876d94c68c2651b831bdef0ecfa62dc895bd1508f78c22e31435d972f3cc278a10ecce753e634b4cbf1b3d171fb2c5855c8eb2c2dc4a70b6e1298a94a7ba6e2fb73658fe16c12751db566daccd78a2a51dc0ea8f1a50023331b5aae886bf4d63c38a354737f63660dda91c1d3df8b1e3af14b5d1c1a2b20fd0538c9b7428657624954fd31", 0xba}, {&(0x7f00000002c0)="2d0d7619f7d14168a9e17d2773ab4c99584f260e955f6d337c7efd9a85774211d4771776d7f6b1c831537bfc70a763371e5b57cb792199f6ca6b2c70784f2aab123cbd2c02d704218d5fb20e8e3e9b4d42f1edcd286b5854d05d136d8f8e986a3ae56cf22b1eaefe37e24dd831639e8e0750a3924387bc18430d229877f88de333db0dd84b8254fc48c2920e4bd90827eae9f920", 0x94}, {&(0x7f0000000380)="91a6f280c7a1539c2c6b943b9801fa886bb5cfe020e9cb5657397efcd8fef054a055bc6fcdfc144f6046af8b72c78c0434443ad3609ecdf7e2d25ec16736d48d42cf45d39714231a8f45bb4ea9ab24dc40c7b7203b7fc09459fda04348749d0d9ae759b8321aeb0600583d133fef04ccb656669b4bb246119eb4f2c016a89d0b47de50b938582cd89476ccdf7299e0a9dcbf2eef3ee863614b46dcf840e778024a726a5981fbbdeaed39620456cffeab6a47159c49f3872232f9b53d4e88fb334efbf06ed19ab52bd22ab8f745fa0b4f6d3def38f26a08b65a547ff31c809bf93627ed3045f64599c2cb44", 0xeb}, {&(0x7f0000000480)="424e2c11d1d45549930a65376cadac1231fdb90d751704033441d575a5cfbd392085272966bc19143557f34fab28fe1f265e431d90fe24522839f69e16958accff6a974f03c7ba062f7eb58f11dc35f5afb4bcab1e863b2203e8", 0x5a}, {&(0x7f0000000500)="4fae6299b1179ea095630fd6524bd2a3537de56e9c7e4f939e7421b475604ab171b543a1f66262d385e6f6c1f77513f1e65dba95e6c82abbf57db7c5bc2f531bcd8ded32c85c23ecf8abdd58500cafd07b67de8db7e614638362be4cc96e26d79dcb2073963d3bbec8759b27dee7f3712cbc9855560eb49b13ce9c561c4f4070ce341fc964dd307818e17de74e842251c68ca4683fcbeb3a8abe6aad1a8bd16bf6cb1332632a89a3eaa1ed597cb71e220f", 0xb1}, {&(0x7f00000005c0)="3818983d424ca5743e1ca2f599b08417528a19bf84a5439f8183c76272f828917555853cd44ba8ac9f92d9bc9e541cce2596256b683088f0b6404742a8d8118817ada5719b3fb29412b2919cea27b749acfd7e3d2cd2152b2bd364f7d208f74d2b57091f6837b6ac02bee00e3c54786ed9514d30b38840780caedf478970a698414b1ed2a181fb46223d249e63adeabfca2b02fd1c934aaea78f8e158304617b7598a1f7830dcff8e796c7fd79278bbace7e9d359e022353a5c70e6a2012692d0d7d96f4f0e361a227362506b01cc1650cac7450e6c614aef4d042008676d22b11422deab0700e557bc55101c35f6d4e44fffadb787221cbf96068caabdd43157cd694e224e55ed747b6192279dfa6075e7f2e348735d3c7a738d2df4421acb8664e7b87901e5b6f71ac3cbea76d0378feb245be2f3f545f07f312cdd91eef15054d8456b05f7621b38285757c021b60b5297f79c6e5d2bdf94a1f3e49fc59b503b973954230065601a07933b40b297d7554bec5387c6c0d9f5269080c5b7ad7b1f7e24c5505b0796faac474d1556f1030904fe58ca7b179fbb14e01d4595d9e7b764a89393e973329a540ddc3e59d12921439375a92e32143ba3a1a7b5f9628391d123ca9c0b798b3f078801f63b35f8f70511cdae6a558173a270b636bb2a82d36676acd9e8bd1dd48ec0f8d74a99b88342f25968ec85f622b96cd69a1ed243559627e3e36beea3a1f380596cc50da53b7945d58c00c3dbf3b2745df1135fd15131b4103238bef17e7a8a01464eb109596c693680e05aaf494fd024b4cd64244eaeccf7c99ed6eebd95f0898ec50523f8ff06ef79eb8f2d8d1a5941ed7f653794e67c1c56b5a11da9b40b8efce14ac401c79f73b86d088dac802ec2bdd9c9ed3fa919211e1290ca0790e075d282a9f6dd7624b7dddf667bab6ec6d4de3de87bed502eb243f3bc32c8c4e39288ca3099cf9b4765b4e6ac2078d9d12e6bb33c96a9c33a16e103ee6df24c8766ff3ce6f7a874ec5c5ea38c346923701f0c5fcf4abad42f29dd52cc7963bd98bb94e2a7cd3303483fe184c33606c5d6f13efef1e342a2bb2326587aff52a290ff4f55cbca3d38f0081628964b148895818fff95e57e9ab8440b9633473e441d862a07641a98a64020818d180c059e82f17e790fc53c38177047763816f4696c062b89a1a413ec564429e65e6ce53a30be6dc01cd28d4711554567600a9f2f41e74c5df55d3a782eef79933014aac7b84da9c867afabca3091697f642341787a9592f559b5018b9c0d265403000b246e7264c3e2fecf12e13aaf3fea9e93f2c686f694394b13d4fc9d0f7fc350e4bcb97358242a6c30f8ff7a762a56b6381c0521e0f38a81e28616c1edb1ede39492dd4d2e9ca80665cd4a3cb7663a76d0b07095760d52c85fa93ce9a4e4f2879e53caee417eca6f31dba6dc2954c75d9a14a2054b10282326d6186451686cb6a2f45a46f8a1e95dab50f38c038fb3c5429c9a9bccb5f88cea905866be5127a6e9af0a5441448a47811f432a093e9afc8ac6975a3c083183183e81706ccd6c6ac0513ff624fddcf74a4bc049b00889f06075939d737b65484bd31cad66193353bd138d32faac2f469eee9861183884ae9f34d90e8c6ad1c11c1500c181c41ebd63119d2f62f729a853de8355abfd32b095fbaded4779e7dbedd6026b162e6d77a8fd44a4066bcbce218ff14352a09d6d14e04bb654a2e82c33c07cb7d77ea8034656dec2fbaae0ba3b0bb734d47e8bf5748518afdfc893858c9a85180c1dd1e5d5a7855ec36e8930288e6b80ed5127bb5c71e653a8820899fa79416bb2d58540276b430db877b6c1e650ed09784fd66ef32a5b4983dfa981d287bd523f9fb41cf8c2bba6eb8c00b36119ba35b98ada9b64825a9f36f901cd5ac95f24becc74a1b261c7d6593dfb7425d351b7d8d7bcbf0d61508f5be0c80a203a53e6624653ae8905f7138d0950e3e304172843995071a7ca99a74a5eb6c7ecef1f19ee20348a4d122647778c200df923854837b9db1316cf27b8b904ab4d84ba12ad3bfa6a27fac6aa1bbd644c75230f3b47c27638fc96fad490f1fbc90646507f6ae682c53824cd2df57ecc4293e67461d6274b91e97bb0fc71c8556ff245c708dd88e78e8719d3077d63b2c762986dc52457f6ac75e89c3e8be30ca99d15151b6af0a0b20c7815f54e87c2ee4982f9f3c786098bbd5c3c9d2401430999580d22dabb66237b01c07779d62be61f5f1cb464b87a0694dd795821a44e54605c9e035f2abc1278ef3f60ac0e015843a8f1958889762a1eb6546712e67161124a4e37a320459e6fb357a85921354e636b23c65766161b964b1391b3c985964b744b6ad5797b403a10a22eeaebd4a647d730091858892ccf50d47c525fa91f483c8aa3f205a424ab6446c54cb6860bf58954f3c2b5c5eadaad8e541d8712bc98483fbc915105d9e610143dcf3d214267e4eeb197936b21546d0dcbba50408d5ea8e745e39a45f9050b08e05f78e1fdc3c0c92cb4dacb981482c7c04ef75b9eb5489ac8db52b56e55633d4034f7becadb2d06686e1b8e0dc6fcc3dc49e17fff2209ffb1db362e1cd2143b0f88dee1fd34950f41f749475ba7f01a70474279a162a9d434c0829a5fec3c52c82b902d8e7ceec81ee0b042676efad593192e16ab52ccea5d585e1ec65189f9622f9aad4347733757bfe2f6a4818a1e912c28dac710eb2875f5f72a33046906ca8d4fda38f7653e7124504406b4bc6b4165d3fd91f1013664b7e4dd2adf2118aac5904b2d451b9e327cd9c253220cc4c6113d7e902c2fdd3b6619097463d09491e126d7f69f9c6f57f03ab17771b0a9bb782df3e92f470408afc7c7f56e6683554346805e76823e2f7dad75590fc432c19964142f827de37668af34f382eb3cd37da343d0b1c473e29b518bb2054047de4230c0b5112b9c614ee0e0c632842ab95b063403e5a67bd5d916d817888300acc7ee3ee4330badeccaded7ce758b0797e3fa19dc49c07f088cb73f0048886adebb2839caa391fa331f81625eef84e0141adc1c502e4cb0b1d361e9cc229e172d636294369b54960213161671a651f18877581efa263daf9d2e6ffdbf007db1286edb943a9595688d9bd072bcf5e42d175f772c313ae296beee3e0eebe133983b9146f16d6793434162b268221679a51df7567bd20b5ff634a17c24afbf8772586b76bd137adb0744d17b7aeb9823df84a74cc43bc06f401c6128e4975642e2e5a4fc65c89b0136203521c210cd56898f782f6009a8e771b62c2e9a0fa1114f4a5a905fdc28e1810533a12b61c2197e070b637328a9ffed33f4ba023523305fd5099b9392acccec5f701f1fdd1281736015b9ebf2b50c2852c79676fc513d5b568f4f88df14e4895a5b4225847385d8afc669e314f7a9fa584ead9f395ba3513a059adb3e6a2dfe8be8017ebbe05d9daffc556fd8dbaa969d5b5a71ce61c0c248dae10971a40a62601fb8cfe9fb5345ecb89c5a01195db4594dee37e1b7cb87363566127efe254fef1cfcf45065da95b7c63e8a48d09eeaf3345966f9ac251ad146d21d9ccd23c5ec2bcbaf3908b6420f9835afb478a95c2ba525822fa80375456894eec53cf6c407f13e43b3b87efda885f019aad42943a309f774f42d821caabce6cf9c398622d7df3592fde045a330713286ff788849713ff528ad127bd4f634ff5ca27fadf89cfbccaf70abb685932b89fa1a14dafc6a0ce5781fa155430cc429d97e70a87281020c9a09d78e10c8f9d3104a9388c724abe7042ad4bb541ae0871f0430941b49393f63d1cd765cac40399eb0e4d603d792c018f74ef0fa658e2b39a2d48997616c2328e7497958b642f4cd53321302ef274ec918726631f104f266fda31380c3eab04d276697efa21241c640bbaed71340f6c916ee8d07f92a5a7525ad76a0fe194acb1d4badbd823955cc43da6cb0f44c297abfb6c9eeb0db3c704559e126f7fc17e27813d51ac4cc84c629a7d3b5b236002a24f740aa9eff775d713e177aa66572198b6dc29013f138c8caec2fbac453f3d55285529e1ea72e4601ca7fdd1afcbad0b0c0f2007c33092b1d11cfba69b5d05405c38eac3a8f8142851b4b0b318bdf0635662ad4cb3c34338255f25eaebf9c1c3b1b26d87b5959af392c149e0ac5d748c63452c25f8e63bfc8f42dc80ff34b6497121d4b5647d3cc3b8dc13573f6a2ad3b88b251001f7a2dfeaefcec5f07e31f7a24a4cfe7f5dbc3d237cb7d6e214cd34c9e4b06085af8075ea79d6bdf7179e998cac7c1e53ced80207eba3acf24cfb2a9648c2cf45e9a2350c03403fc488b193cde1df6886332c7704e3cdcd0bd1c136612fca6a75d353d89a30e3a74d623f99a43ab0b402aeef3c44ef7c2d2af2a50900f8d0860cd79b03e10191aaf0fdc6bc5a078a3e6e61ed595feb20be680033cde08d752364456e2ceab269b72307eda88b44647690121ce6813d5c7bb9809941c74b137222aa92c16be5efe052900c323b782c581b1fbc07d0878ca2dd44299fc70ce5749ade05927c17595ddffee746b421959075edb062f66fcbab3dca2cc105da7b066e041ede1068a2b42696ec24e80cbcf2539e8e89e97218dee6b91ecf6f8456dc9bb0616676b0ee019452567b7f7e255f69f79fc47e2b2e6a50ee55ba71f1774021ecbae65067291dd9f3db6f1aa5ee1bb2f883cf7ea57a5701f616262b636d4398d20860993512bf42f762485cc44fdaba9b422d0ad23d21525234b5022234d1d91f12fbf73260b13c978314f1d177632bb429f5db4b10723f9dae9b7735e0add3cb252aff2afa658000ab2e3a7f7883d62b49c3cbfd21e878a12f6fe5dcf0b03fdd74b763bd987fdbbc23e8b6d1f403699882a6a3e39055387429c20f657a6c6ca7ac6bc9cc34d2e21a9a52f5f1edcfe77f3e213979e909288d09f455d52859c0089f817ef2156709430a89faef9d24ff832d7093c11bbb7116f9438795596fb696d7b4e80f5c03d8a77dd081dc0b0c7236a4f428c0909a5f09dfbac1aca41e45a5f32e075aac2e9f0737c6db45a7dcbe5eb072c364bf688803c693fa40b5f01255d86ebf4d6b6ad532edb9707761eca054102cdc500cf5d40f2b2b2c0d25d4893a102da7e0903439f0ecc1627f4088a0b1221ae79adf52fd38c21a5db3a0bc4cceea36f91b8bd5faf0317c7d569e67e100432a0dcdf7053741370c5e04eaed562a04e3f4afa46f4bb73ad3a99691f35e2e19b9a6dfeac37181c524e0875701da059c63a8358d8053fe3084ca99a4e9cd59010b56ea8a9cd216e87bdf6b14511455ac29d4a2310d1016369538b94cb96bddee21bfdb6dcfe7a385d2d40d62c0ce9245995682a16d4b7d4835bcb4ee748f739ea73c75b23948014644dc6650a5eb77c8210b821d7099474f94dc563c190bf507e99ed206eaf9ccc83da0574c16e0dd3cc1db6618e5ff7428aea0b733098ea1dfc1e0d82c5124f4025c3dc754fc9d02bb87dccb52a1482b8babaa516d8ecc28ff8e58d64be1228faa5db3d9bf62745a97728210b7b946d8a7dcbf4cce53b5cf9e68dc73728ccb11175cdfea993639ea61dc601f8d3afd998994d1aedfa48999580eb631d1f6c1806d3df6dd676a12712911ec0790275bf596b7f558ea83b604fb77afb9a7cc1e019aa8baaa4777b4f383013651500b9d7d4522fa57eeeb7d5e197726f58ba9af3f851c71296a8b97df9552de585a488c0a8b3ba3c910cb595038e87ce6d8dae27440579a36205a1c3bde6773", 0x1000}], 0x7, &(0x7f0000001640)=[@iv={0x68, 0x117, 0x2, 0x53, "3b36c93538242a99019bf58b46fea33ba46a05affd22ab7786dbb4390f2d0455c32c3e7b4c990d4ecf82f7218afcf9b8af43f926e99f6655c8d13ddc04f8a1c4833948d3c63242f6e3476c66b1aa28e64d584e"}, @iv={0x48, 0x117, 0x2, 0x33, "bf5706e90504ebe95a5586a35bb57ec024cd5bd641793fbc0c6ca21d753ce1a88e3e5eb547de48bfb8cb87d440d73a8b4a163d"}, @iv={0x18}, @assoc={0x18, 0x117, 0x4, 0x10}, @iv={0xf8, 0x117, 0x2, 0xde, "99c600ef47660be7ae41cfbc3665071b348b11abcb5a8d5f1e10f36a95153651a03af4933a8ea2bd4f7e17fe58112878f71e91ce2e57874dd489a326e445451681420d26cb64d661ea132eb2031cc8b9b0993c31c81cccc9512f6cc2fbcbebd1f6b4e11e09672bd812f90bf13e1feeb31d473552fe0d1aab3b5e33a74b1b4a8dd0536da4cc029b5c3438745eb6be1bdb11cc3761498321b2b2d62ad18fff49dedea6a45224646d08452e7464316db65c3e0d923e837625063fe6a0e98aedbf3dfa63026565ddfff8f9bcc2a395687ba83ba9f6d9efeffeb7b297f6ddf071"}, @op={0x18}, @iv={0x18}], 0x208, 0x44080}, 0x20000000) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r4, 0x40047438, &(0x7f0000000040)) r5 = socket$kcm(0x29, 0x5, 0x0) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f0000000040)=0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r8) sendmsg$NFC_CMD_DEV_UP(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x1c, r9, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r7}]}, 0x1c}}, 0x0) sendmsg$kcm(r5, &(0x7f0000001dc0)={&(0x7f00000018c0)=@nfc_llcp={0x27, r7, 0xffffffffffffffff, 0x6, 0x3, 0x9c, "fcbbf3c1a4bbec1ecce6c7bb21c0676bf02e2c506d52c05fa0d589db5e353cba8666166becef35ed4c1f3c8860d5ade0743983e3f1e16a4511afd1ca1055f9", 0x3f}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001940)="19294e725b975f0615e8b1b0346fe97c2cabc9a34bb198337bed96b774e4d4abc4da05b57bd4bfc0f2fa11f47577", 0x2e}, {&(0x7f0000001980)="df0005a19d63dcb74fe3a18246e1aa5b341f2b9b385cdae96e28dd98898bdcdde58822bc9e6f0774ac59eeec54909fb0a4adf4b842862c60480ee9c5ab5f4563f64f2c2060faa31489d1bc5083f584339ba5f73425e13ac6466dc87a28c354e57df5a0b64b5f6c64a2df3966e13cfd0b7527cbeb17aa8139fefed5f55812f3846c9f7d2204b83a00c7504e480008fa251b6f", 0x92}, {&(0x7f0000001a40)="20f23528051f571a3727c31dfcbc42e50f6256e1321dd02b6ed70347e4c066b56c2221d1f15732e3fffb11c1ae27cf3333ecacc683609df71ef204a723f1686dff25f648aa341b2b64e6d536e70745870f9694512ad77e706567b46b6a9d649ef7b8870e3ffae39607cd569f1a1eded4f196747eadb5964edafaa64949a8a638532221059bb3c508e3dd474f6819ebfa84e44b2917894f4574aca9ade30b120c5a1fc78302e329f1c03a5d09aa887b69d9917c4e0a46b90025bef8a567bef736b42658a8b52dc73b6795c714c2234fa54090014626ac0b", 0xd7}, {&(0x7f0000001b40)="90288b827b0631f2af7239a58dcbdefa59044fb5671f554a431c256e51c67cf6c97fa597691357b67031b893bb1d0353a5d2ca91b7887238099644140a8ba2423e13639c8317ccc5519b3051b81d770bf7ebee2f817ea5558295c83f670dcb3b3ba6e820c62da0d9660a6d1ded37ede1b3e200e7d56528f3e69a049753e8112ca2f7f74e7236b53be601a3eb371e46ee4312a0a658eb040e24", 0x99}, {&(0x7f0000001c00)="e830b54356b775c8fe520e7579665f17faa8feabc4b79f4379e82179f6d18097d55637fc0796c2c4b14b009accfdd94bf939c2a05773512ebcab40d60c5e3a76c8fd9c841562be265d3a2acb8b8d4280be987fb89ef8ab085c5a136c763c493774a9e5c2c9e73f5e5cac7f2afe2923be3596b0947e", 0x75}], 0x5, &(0x7f0000001d00)=[{0xb0, 0x1, 0x1, "07f808f8ee4cb5925206eb19b10ce0ec18acc5f864b76c4042ee0817b1a136ef4bc9feb698c3397e765ebe3dcddf87bf33b31ae8e383316730d49733f51b83801fb7da472b00df53806bbe977a014fa7db240a247f67a1a0b759b51ef53213fd2264adbef5585e1bebb95bb18b0fd4499eb4393482980c1c181f7416a6f5493627d3065cc40e26df16cb2f58e72cc60405df44fc323fba3bfdc6fd0f199a"}], 0xb0}, 0x8000) ioctl$PPPIOCCONNECT(r4, 0x4004743a, &(0x7f00000000c0)) write$ppp(r3, &(0x7f0000000080)="d100", 0x2) 3.324692005s ago: executing program 2 (id=12086): bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) socket$inet6(0xa, 0x2, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) socket$kcm(0x10, 0x2, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random='\x00\r\x00\x00\x00 '}) 3.199950663s ago: executing program 2 (id=12087): r0 = socket$rxrpc(0x21, 0x2, 0x2) sendto$rxrpc(r0, 0x0, 0x0, 0x4000, 0x0, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f00000002c0)={&(0x7f0000000380)={0x8, 0x4e22, @broadcast}, 0x10, &(0x7f00000001c0)=[{0x0, 0x27}, {&(0x7f0000000800)="08003b117c123a3d", 0x8}], 0x2}, 0x20008890) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="002000000102"}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {}, {0x0, 0x0, 0xe06}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x20}}, 0xe4) socket$nl_xfrm(0x10, 0x3, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x4, r5, 0x1, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000104000000000f00000000000000", @ANYRES32=0x0, @ANYBLOB="000300007573443b280012800b00010065727370616e000018000280040012000800050004000000080004"], 0x58}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x18, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x110}}, 0x0) 3.138027442s ago: executing program 4 (id=12089): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000000)=0x7, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x7c}}, 0x2000c450) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x5000, 0x0, @loopback, 0x5}, 0x1c) writev(r3, &(0x7f0000000840)=[{&(0x7f00000001c0)="2c1e", 0x2}, {&(0x7f0000000580)="06c391891fe7a0aa63998d25b797", 0xe}, {&(0x7f0000000780)="3ad667fc905d682b82dc7bba428fde5aa0384509182fccd7941df43e2cefc3d87ef7ea2406ea992fb1d50cd45454a72a16bf248c51685c6ae23a24", 0x3b}, {&(0x7f0000000640)="f3e2b7ba30713d3a9c2e77ca8580531b76c8a4862bde63a917ca96a6a5318b63c2ccb8face679394af45119f1c121e3a3b37d23dcf90b68220d1d5e212598f023f08edb93f23877d622d2603e68aa36b0d6b438f3cbabdf59552c07c62e699e9af", 0x61}, {0x0}], 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xc879, @dev={0xfe, 0x80, '\x00', 0x27}, 0x4}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) 3.113484118s ago: executing program 4 (id=12090): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000001580)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f40600", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r1, 0x1, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xc5, 0x7e}}}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4004805}, 0x10) 3.014237856s ago: executing program 1 (id=12092): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001440)="91f8a9849519def2f8eb48d9173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000000000f38a6a4cb6b275ee91bd0196db0af38f2665cbbb4e66534143d02eac997657cf0a3df3cc8df5281ca813b255039632532f021a46b78fb7892513e49b3af0f59c39d0edaaf273933db78b8653e664f28ca6a3f8803662958348e8bef4a1370e5fc0c803eeb368fa89f78a1b167d80b9e42486e2965156a4a2383c8682df617947d6b3b50f", 0xc5}], 0x1}}], 0x1, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 3.007029964s ago: executing program 0 (id=12093): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@allocspi={0x120, 0x16, 0x1, 0x0, 0x0, {{{@in=@rand_addr=0x64010100, @in=@rand_addr=0x64010100, 0x0, 0x0, 0x3, 0x0, 0x0, 0x80, 0xa0}, {@in6=@dev={0xfe, 0x80, '\x00', 0x2c}, 0x4d6, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffed, 0x3}, {0x0, 0x0, 0x2, 0xfffbfffffffffffe}, {0x0, 0x0, 0xfffff801}, 0x70bd2d, 0x0, 0x0, 0x4, 0x2, 0xe55286f1921f74be}, 0x0, 0x1a0b1}, [@address_filter={0x28, 0x1a, {@in=@private=0xa010102, @in6=@remote, 0xa, 0x96, 0x9}}]}, 0x120}, 0x1, 0x0, 0x0, 0x24024041}, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x2, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x998ed4ed88999c63}, 0x4c840) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="0000020008"], 0xe) recvmmsg(r1, &(0x7f0000001480)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000001c0)=[{0xfffffffffffffffd}], 0x1}}], 0x2, 0x20, 0x0) unshare(0x26000400) r3 = socket(0x1e, 0x1, 0x0) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, 0x0, 0x0) ppoll(&(0x7f0000000040)=[{r1, 0x1}], 0x1, 0x0, 0x0, 0x0) syz_emit_ethernet(0x3de, &(0x7f0000000f40)={@random="3bf9bef22c39", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x3a8, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, [{0x19, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af2502"}, {0x0, 0x1, "000000050000000026000400"}, {0x2, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x19, 0x10, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f025bdfc6fd0b253664c7764b9990daac7c5937b42bc4f4ec842023422e45625b4bfea25dae3c918a084"}, {0x21, 0x7, "b8a3e100908f61640000000200fe80ffff00000000000000ff0bc0fe00000000008879e66485201a0015ca83747357a027450004000000"}, {0x4, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf0630af1f98aea6fb3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7596d779b8353aac33a57d79b05613a12328f6101000000634a287570af5e4e12e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e7a94fe18e88605abbbe1a02a326a63ce65f81ed0000000000"}]}}}}}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000200)=""/16, 0x10}, {&(0x7f0000000440)=""/254, 0xfe}, {&(0x7f0000000540)=""/120, 0x78}, {&(0x7f00000005c0)=""/16, 0x10}, {&(0x7f0000000600)=""/219, 0xdb}], 0x5, &(0x7f0000000780)=""/103, 0x67}, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000180)=ANY=[@ANYBLOB="180000082f00090027bd700000000000040000a47abe9390"], 0x18}, 0x1, 0x0, 0x0, 0x20042884}, 0x10) 2.94308726s ago: executing program 2 (id=12094): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x1219000, 0x1000}, 0x20) r1 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r1, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x24, r3, 0x101, 0x1, 0x0, {{0x19}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_BSS_BASIC_RATES={0x5, 0x24, [{0x16}]}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f00000017c0)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001780)={&(0x7f00000016c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r3, @ANYBLOB="04002abd7000fbdbdf25210000000c009900942d0000750000000800dc00eb06000078002d800a00000097fab60101012d010100000a00000001010101010100000a00000001010101010100000a00000001010101010100000a000000012201010101000011000000a69f9ae1361698635836be590a0000000a00000001010101010100000a00000001010101010100000a000000020202020202000004"], 0xa4}, 0x1, 0x0, 0x0, 0x45}, 0x20048095) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000700)=@base={0x10, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000b00)={r6, &(0x7f0000000300), &(0x7f0000000a00)=""/209}, 0x20) write$cgroup_subtree(r5, &(0x7f0000000100)=ANY=[], 0x32600) pipe(&(0x7f00000000c0)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x9, 0x3, 0x2, 0x2, 0x8804, r7, 0x6, '\x00', 0x0, r7, 0x1, 0x0, 0x5, 0x0, @value=r5}, 0x50) epoll_pwait(r7, &(0x7f0000001800)=[{}], 0x1, 0xa52, 0x0, 0x0) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r8, 0x12, 0x3, &(0x7f0000000000)=0x1, 0x4) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x70, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_RATE={0xc}, @NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x368}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x3, 0x84}}}, 0xb8}, 0x1, 0x0, 0x0, 0x8000}, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r8, 0x12, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0xc622, @loopback}, 0x10) r10 = socket$inet6(0xa, 0xa, 0x4) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001240)=@delpolicy={0x60, 0x14, 0x400, 0x70bd2d, 0x3, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, @in6=@mcast1, 0x4e23, 0xaa21, 0x4e22, 0x7, 0xa, 0x20, 0x80, 0x4}}, [@iptfs_reorder_window={0x6, 0x25, 0xfff6}, @etimer_thresh={0x8, 0xc, 0x80000000}]}, 0x60}, 0x1, 0x0, 0x0, 0x200400c5}, 0x4000800) r12 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="50000000150043d6"], 0x50}}, 0x0) recvmsg(r5, &(0x7f0000001640)={&(0x7f0000000000)=@alg, 0x80, &(0x7f0000001580)=[{&(0x7f0000000200)=""/4088, 0xff8}, {&(0x7f0000001200)=""/136, 0x88}, {&(0x7f00000012c0)=""/54, 0x36}, {&(0x7f0000001880)=""/113, 0x71}, {&(0x7f0000001380)=""/181, 0xb5}, {&(0x7f0000001440)=""/142, 0x8e}, {&(0x7f0000001300)=""/81, 0x51}], 0x7, &(0x7f0000001840)=""/27, 0x1b}, 0x40) setsockopt$inet6_mreq(r10, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) 2.877604116s ago: executing program 0 (id=12095): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={r0, 0xe0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x9, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x10, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000240), &(0x7f0000000280), 0x8, 0xd4, 0x8, 0x8, &(0x7f00000002c0)}}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7, 0x7}}]}}]}, 0x48}}, 0x20000000) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006140)=@newtfilter={0x50, 0x2c, 0xd27, 0x1060bd2d, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x6, 0x1}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0x5, 0x0, 0xf772}}}]}]}]}}]}, 0x50}}, 0x1d56ce4333ce878e) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r3, &(0x7f0000000680)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xb4, 0x0, 0x4, 0x70bd26, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x28, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @loopback}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r1}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2c}}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8880}, 0x800) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=r2, 0x4) r6 = socket$inet_sctp(0x2, 0x0, 0x84) connect$inet(r6, &(0x7f00000000c0)={0x2, 0x4e23, @multicast1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0xd, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x0, 0xfffffffd, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r8 = openat$cgroup_devices(r7, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r8, &(0x7f0000000180)=ANY=[@ANYBLOB='b '], 0xa) close(r0) r9 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x20000001) r10 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="b4050000fdff7f006110a40000000000c60000000000000095000000000000009f33ef60916e6e713f1e6b0b725ad99b817fd98cd824498949714e32f21dcc4ae5437aca55f21f3ca9e822d182054d54d53cd2b6da714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000000000000000006c63b40e0c00000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f79829c90bd2114252581567acae715cbe1b57d5cda432c5b9443999f7d24195405f2e76ba88454cc9227069ccb7b37b41215c000000003be991e5e897284cdd6043058cec00000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r11, @ANYRES32=r10, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r11}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r12, &(0x7f0000002300)={0x0, 0x0, &(0x7f00000022c0)={&(0x7f0000002240)={0x1c, 0x140f, 0x1, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'ib_srpt\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8044}, 0x8) close(r9) 2.651938357s ago: executing program 0 (id=12096): socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000800000002000000000000070000000003000000000000080100000000000000000000020200000000002e2e"], 0x0, 0x44}, 0x28) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2000800) 2.58403521s ago: executing program 0 (id=12097): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket(0x1e, 0x800, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42914}, 0x20044014) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000000)=@generic={&(0x7f00000017c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x8}, 0x18) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0f00000004000000040000001200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000003541cdf077a321f3c167bf6d841a3d22175e952da9117d334b68a34f8ae2df7849119c09b97407f05fdf0b7ab6ed1d113e0a3bb0215b51ac4db3f065fd0bfe0cdb6ac11f56821c3c90348601f5c1cc7882cbd3faa70695a1ea52498a5f38a4c1e28c429babdffb9fc7f9bc914444694f75b64012f256bdf2dc94021ae24e13c16f5bfe68ff2c09eb12143a273b6a1ce1f3dc5e42925965839b3ab5838d5462085ac46b5d4579659aa6d047b5c6b52e1660bb8bb30a935d1ff2227930d5466b9b8658433644f4839ed1adf28a197d169f6d8955f1f1fd8a656f2c82806b6ffab8f00ee3318dc01354539e3506000000e9cdde03f3a7b7cc26168a06945c41956f1fbaf3e90049fe1380d50265d6bb876a3ca942a3a9900508f26ea7b003b1a9654237f8f71868db4971e17e574721d7b18ba049ac9e196a7e740a6134d1dbcb4c09f22ca380b01c8077e456a9110b406b6f18f07de3b7e85e016703a67eb4bd01727eb96f03e573"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB="6c639c2b8f5461b8defdbee3c47e65778ae8af1613f7", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x20, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000090000000000000000000000791000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r6 = socket(0x2, 0x80805, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) setsockopt$inet6_int(r7, 0x29, 0x1a, &(0x7f0000000000)=0x285, 0x4) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x38, &(0x7f0000000300)=[@in6={0xa, 0x4e23, 0x3c, @dev={0xfe, 0x80, '\x00', 0x2b}, 0x3}, @in6={0xa, 0x4e20, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}]}, &(0x7f0000000180)=0x10) connect$bt_rfcomm(r6, &(0x7f00000000c0)={0x1f, @none, 0x7}, 0xa) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000040)={@map=r5, 0x26, 0x0, 0xf51, &(0x7f0000001440)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000080)={'vxcan0\x00', 0x0}) bind$can_raw(r8, &(0x7f00000000c0)={0x1d, r9}, 0x8) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000900)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x25dfdbfd, {{@in=@rand_addr=0x64010102, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x2, 0x80, 0x80, 0x0, r9}, {0x0, 0xfffffffffffffff8, 0x0, 0x0, 0x1, 0x16, 0x7, 0x7f}, {0x0, 0x4, 0xfffffffffffffffe}, 0x4, 0x6e6bb2, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x37a5fce0bcf595dd}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000900090073"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000780)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="01000000000000000000200100000c000280080002006c6f000018000380040001000800020005000000080004001f000000"], 0x38}}, 0x0) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) write$rfkill(r0, &(0x7f0000000340)={0x6, 0x0, 0x3, 0x0, 0x1}, 0x8) 2.172073845s ago: executing program 1 (id=12098): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, 0x0, 0x5d) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001", @ANYRES16], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x39}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000440)={0x0, @in6={{0xa, 0x0, 0x1f4, @empty, 0xfffffffe}}, 0x80000, 0x0, 0x0, 0x0, 0xb3550aa4ba878396, 0x1000000, 0x8}, 0x9c) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="900000000008000008000a00", @ANYRES32=0x0, @ANYBLOB="08001b000000"], 0x30}}, 0x4000880) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000002100090002000000ffdbdf2501000000080008"], 0x1c}}, 0x4000) 1.26557141s ago: executing program 1 (id=12099): bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_merged\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) write(0xca, &(0x7f0000000000)="0404", 0x2) socket(0x10, 0x3, 0x0) 1.264969193s ago: executing program 1 (id=12100): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000000)=0x7, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x7c}}, 0x2000c450) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) r3 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x5000, 0x0, @loopback, 0x5}, 0x1c) writev(r3, &(0x7f0000000840)=[{&(0x7f00000001c0)="2c1e", 0x2}, {&(0x7f0000000580)="06c391891fe7a0aa63998d25b797", 0xe}, {&(0x7f0000000780)="3ad667fc905d682b82dc7bba428fde5aa0384509182fccd7941df43e2cefc3d87ef7ea2406ea992fb1d50cd45454a72a16bf248c51685c6ae23a24", 0x3b}, {&(0x7f0000000640)="f3e2b7ba30713d3a9c2e77ca8580531b76c8a4862bde63a917ca96a6a5318b63c2ccb8face679394af45119f1c121e3a3b37d23dcf90b68220d1d5e212598f023f08edb93f23877d622d2603e68aa36b0d6b438f3cbabdf59552c07c62e699e9af", 0x61}, {0x0}], 0x5) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xc879, @dev={0xfe, 0x80, '\x00', 0x27}, 0x4}, 0x1c) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000200), 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="3800000002011d04000000000000000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x38}}, 0x0) 1.24084106s ago: executing program 1 (id=12101): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_COALESCE(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0x1c, r1, 0x400, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x1, 0x66}, @void, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4004004) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x7, 0x7}}]}}]}, 0xffe3}}, 0x20000000) r4 = socket(0x1, 0x803, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x18}}, 0x0) recvmmsg(r5, &(0x7f0000002e80)=[{{0x0, 0x0, 0x0}, 0x3fffff}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0xb91b}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x0, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) socket(0x400000000010, 0x3, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000040)={'vlan0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x1}}) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x0, 0x2000a, 0x9}) write$bt_hci(r6, &(0x7f0000000080)=ANY=[], 0x6) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006140)=@newtfilter={0x44, 0x2c, 0xd27, 0x1060bd2d, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0x6, 0x1}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_EMATCHES={0x10, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}}, 0x1d56ce4333ce878e) 220.272065ms ago: executing program 4 (id=12102): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10) sendmmsg$inet(r1, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=ANY=[@ANYBLOB="980000005500210725bd7000fcdbdf2507000000", @ANYRES32=0x0, @ANYBLOB="863c2ae41330271a58e4b0625cae3c9d34b055623b6adaa90800000000000000c322cdb2822ea81542d74a3e971d92bcc78e757e12d89a6518e647167d0595f22e5b1d8c5195909b8b836dd1d59c0f33390f8d0d9e8adcd8a155", @ANYRES32=0x0, @ANYBLOB="00030400ac1414aa0000000000000000000000008e"], 0x98}, 0x1, 0x0, 0x0, 0x4}, 0x24048060) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x18, 0x10, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8a, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x86}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {}, [@jmp={0x5, 0x1, 0x9, 0x9, 0x9, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000140)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800400ff}, 0x94) 173.181038ms ago: executing program 1 (id=12103): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000580), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) poll(&(0x7f0000000200)=[{r3, 0x1210}], 0x1, 0x1ff8) sendto$inet(r3, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r3, 0xda90) accept4(r2, 0x0, 0x0, 0x80000) r4 = socket$inet(0x2, 0x6, 0x7fffffff) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001200)={&(0x7f0000001040)=ANY=[@ANYBLOB="9feb03003400000002000000000000000500000d000000000d00000002000000000000000100000006fe48350b0000000c00020000000000040000000300"/78], &(0x7f00000011c0)=""/62, 0x4e, 0x3e, 0x1, 0x8}, 0x28) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x0, 0x168, 0x9, 0x0, 0xb, 0x248, 0x250, 0x250, 0x248, 0x250, 0x3, 0x0, {[{{@ipv6={@remote, @rand_addr=' \x01\x00', [], [], 'veth0_to_bridge\x00', 'sit0\x00', {}, {}, 0x6c}, 0x6000000, 0x100, 0x148, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0x2}}, @common=@inet=@ipcomp={{0x30}, {[], 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'dvmrp0\x00'}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@inet=@set2={{0x28}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{}, {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x378) getsockopt$inet_tcp_buf(r4, 0x6, 0x21, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100feffffff0000000001000000100007800c00018008000100", @ANYRES32=r2, @ANYBLOB="0c000200ffff0000000000000c0004000200000000000000992a794b765841bbeb633c6524c3c6c42e2494c8003e49c23f3374d317eb1dfcdb63f1ca9924fc6ac4cd306a0c93f7e88e90001dbc8ea4ae974fbb55505866ede76f3209b87c"], 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet6(0xa, 0x0, 0x3ff) setsockopt$inet_int(r6, 0x0, 0x33, &(0x7f0000000000)=0x80020000, 0x4) unshare(0x6a060200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) listen(r6, 0x2) socket$kcm(0x10, 0x2, 0x4) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x1d, 0x2, 0x6) socket(0x400000000010, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="01000000080010000400000007"], 0x50) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0xa, 0x3, 0x3a) socket$nl_generic(0x10, 0x3, 0x10) 171.134019ms ago: executing program 0 (id=12104): r0 = socket$rxrpc(0x21, 0x2, 0x2) sendto$rxrpc(r0, 0x0, 0x0, 0x4000, 0x0, 0x0) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r2, &(0x7f00000002c0)={&(0x7f0000000380)={0x8, 0x4e22, @broadcast}, 0x10, &(0x7f00000001c0)=[{0x0, 0x27}, {&(0x7f0000000800)="08003b117c123a3d", 0x8}], 0x2}, 0x20008890) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r3, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="002000000102"}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {}, {0x0, 0x0, 0xe06}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x20}}, 0xe4) socket$nl_xfrm(0x10, 0x3, 0x6) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x4, r5, 0x1, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000010000104000000000f00000000000000", @ANYRES32=0x0, @ANYBLOB="000300007573443b280012800b00010065727370616e000018000280040012000800050004000000080004"], 0x58}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x5c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x28, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_HOOK_DEV={0x14, 0x3, 'netdevsim0\x00'}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x18, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x110}}, 0x0) 100.846805ms ago: executing program 3 (id=12105): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x48212b8952c3aff5, 0x70bd25, 0x40000000, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x700) 52.168731ms ago: executing program 2 (id=12106): r0 = socket(0x10, 0x3, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x7ff, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x97ff, &(0x7f0000001a80)={&(0x7f0000000040)={0x30, r2, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r0}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x30}}, 0x20000000) 0s ago: executing program 0 (id=12107): socketpair$unix(0x1, 0x5, 0x0, 0x0) pipe(&(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000800000002000000000000070000000003000000000000080100000000000000000000020200000000002e2e"], 0x0, 0x44}, 0x28) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2000800) kernel console output (not intermixed with test programs): 624466][T14103] CPU: 1 UID: 0 PID: 14103 Comm: syz.0.11533 Not tainted syzkaller #0 PREEMPT(full) [ 1345.624488][T14103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1345.624499][T14103] Call Trace: [ 1345.624507][T14103] [ 1345.624514][T14103] dump_stack_lvl+0xe8/0x150 [ 1345.624546][T14103] should_fail_ex+0x410/0x560 [ 1345.624573][T14103] should_failslab+0xa8/0x100 [ 1345.624599][T14103] __kmalloc_cache_noprof+0xa3/0x600 [ 1345.624620][T14103] ? nsim_fib_event_nb+0x185/0x11d0 [ 1345.624647][T14103] ? nsim_fib_event_nb+0x185/0x11d0 [ 1345.624690][T14103] nsim_fib_event_nb+0x185/0x11d0 [ 1345.624720][T14103] ? lock_acquire+0x115/0x350 [ 1345.624746][T14103] notifier_call_chain+0x1a5/0x3d0 [ 1345.624778][T14103] ? atomic_notifier_call_chain+0x26/0x180 [ 1345.624809][T14103] atomic_notifier_call_chain+0xda/0x180 [ 1345.624839][T14103] call_fib_notifiers+0x31/0x60 [ 1345.624865][T14103] fib6_del+0xf72/0x15a0 [ 1345.624887][T14103] ? fib6_del+0x1171/0x15a0 [ 1345.624924][T14103] ? __pfx_fib6_del+0x10/0x10 [ 1345.624943][T14103] ? do_raw_spin_lock+0x12b/0x2f0 [ 1345.624984][T14103] __ip6_del_rt_siblings+0x513/0x7d0 [ 1345.625023][T14103] ip6_route_del+0x1051/0x1100 [ 1345.625054][T14103] ? ip6_route_del+0xe2/0x1100 [ 1345.625077][T14103] ? __pfx_ip6_route_del+0x10/0x10 [ 1345.625098][T14103] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1345.625121][T14103] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1345.625140][T14103] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1345.625168][T14103] ipv6_route_ioctl+0x375/0x4e0 [ 1345.625195][T14103] ? __pfx_ipv6_route_ioctl+0x10/0x10 [ 1345.625247][T14103] inet6_ioctl+0x246/0x2e0 [ 1345.625273][T14103] ? __pfx_inet6_ioctl+0x10/0x10 [ 1345.625297][T14103] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1345.625327][T14103] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1345.625354][T14103] sock_do_ioctl+0x101/0x320 [ 1345.625384][T14103] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1345.625409][T14103] ? hook_file_ioctl+0x1f2/0x600 [ 1345.625446][T14103] sock_ioctl+0x57a/0x7e0 [ 1345.625474][T14103] ? __pfx_sock_ioctl+0x10/0x10 [ 1345.625501][T14103] ? __fget_files+0x2a/0x420 [ 1345.625525][T14103] ? __fget_files+0x3a2/0x420 [ 1345.625549][T14103] ? __fget_files+0x2a/0x420 [ 1345.625576][T14103] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1345.625602][T14103] ? __pfx_sock_ioctl+0x10/0x10 [ 1345.625628][T14103] __se_sys_ioctl+0xfc/0x170 [ 1345.625655][T14103] do_syscall_64+0x166/0x520 [ 1345.625674][T14103] ? trace_irq_disable+0x3b/0x140 [ 1345.625693][T14103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.625712][T14103] ? clear_bhb_loop+0x70/0xc0 [ 1345.625736][T14103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1345.625754][T14103] RIP: 0033:0x7f3d0b79e159 [ 1345.625772][T14103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1345.625788][T14103] RSP: 002b:00007f3d0c5c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1345.625808][T14103] RAX: ffffffffffffffda RBX: 00007f3d0ba25fa0 RCX: 00007f3d0b79e159 [ 1345.625823][T14103] RDX: 0000200000000000 RSI: 000000000000890c RDI: 0000000000000003 [ 1345.625835][T14103] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1345.625847][T14103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1345.625859][T14103] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1345.625888][T14103] [ 1345.691704][T14100] team0: Port device team_slave_0 removed [ 1345.730100][T14100] team0: Port device team_slave_1 removed [ 1345.743136][T14100] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1345.743159][T14100] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1345.761329][T14100] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1345.761351][T14100] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1345.772957][T14100] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1345.922850][T24391] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1345.923061][T24391] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1345.946205][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1345.983472][T14106] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11534'. [ 1346.054779][T14108] netlink: 'syz.3.11535': attribute type 1 has an invalid length. [ 1346.482701][T14133] netlink: 'syz.2.11544': attribute type 7 has an invalid length. [ 1346.482724][T14133] netlink: 'syz.2.11544': attribute type 3 has an invalid length. [ 1346.747443][T14131] virtio_blk virtio5: 1/0/0 default/read/poll queues [ 1346.789668][T14141] netlink: 'syz.0.11547': attribute type 14 has an invalid length. [ 1346.792908][T14131] virtio_blk virtio5: [vdb] 262144 512-byte logical blocks (134 MB/128 MiB) [ 1346.865587][T27155] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1347.224731][T14172] FAULT_INJECTION: forcing a failure. [ 1347.224731][T14172] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1347.224761][T14172] CPU: 0 UID: 0 PID: 14172 Comm: syz.3.11556 Not tainted syzkaller #0 PREEMPT(full) [ 1347.224782][T14172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1347.224794][T14172] Call Trace: [ 1347.224801][T14172] [ 1347.224810][T14172] dump_stack_lvl+0xe8/0x150 [ 1347.224843][T14172] should_fail_ex+0x410/0x560 [ 1347.224868][T14172] _copy_from_user+0x2d/0xb0 [ 1347.224892][T14172] copy_from_bpfptr+0x5c/0x90 [ 1347.224915][T14172] bpf_prog_load+0xcdb/0x1c20 [ 1347.224949][T14172] ? __pfx_bpf_prog_load+0x10/0x10 [ 1347.224991][T14172] __sys_bpf+0xd0d/0xd90 [ 1347.225007][T14172] ? __pfx___sys_bpf+0x10/0x10 [ 1347.225024][T14172] ? __fget_files+0x2a/0x420 [ 1347.225046][T14172] ? ksys_write+0x242/0x270 [ 1347.225063][T14172] ? __pfx_ksys_write+0x10/0x10 [ 1347.225089][T14172] __x64_sys_bpf+0xba/0xd0 [ 1347.225101][T14172] do_syscall_64+0x166/0x520 [ 1347.225116][T14172] ? trace_irq_disable+0x3b/0x140 [ 1347.225126][T14172] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.225137][T14172] ? clear_bhb_loop+0x70/0xc0 [ 1347.225150][T14172] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1347.225160][T14172] RIP: 0033:0x7f3c8a79e159 [ 1347.225171][T14172] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1347.225180][T14172] RSP: 002b:00007f3c8b5cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1347.225192][T14172] RAX: ffffffffffffffda RBX: 00007f3c8aa25fa0 RCX: 00007f3c8a79e159 [ 1347.225200][T14172] RDX: 0000000000000094 RSI: 0000200000000500 RDI: 0000000000000005 [ 1347.225206][T14172] RBP: 00007f3c8b5cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1347.225213][T14172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1347.225219][T14172] R13: 00007f3c8aa26038 R14: 00007f3c8aa25fa0 R15: 00007ffcfeedb258 [ 1347.225235][T14172] [ 1347.592483][T14184] syzkaller1: entered promiscuous mode [ 1347.592498][T14184] syzkaller1: entered allmulticast mode [ 1348.384352][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1349.664384][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1349.735111][ T980] net_ratelimit: 41 callbacks suppressed [ 1349.735134][ T980] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1349.846088][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1349.955026][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.065698][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.175471][ T980] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.285913][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.395471][ T980] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.486366][T14178] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1350.519528][T24381] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.589995][T14214] __nla_validate_parse: 22 callbacks suppressed [ 1350.590017][T14214] netlink: 296 bytes leftover after parsing attributes in process `syz.3.11568'. [ 1350.639364][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1350.651093][T14216] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1350.739295][T14219] netlink: 160 bytes leftover after parsing attributes in process `syz.1.11569'. [ 1350.755796][T14221] netlink: 'syz.4.11573': attribute type 2 has an invalid length. [ 1350.892674][T14237] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1350.898526][T14235] netlink: 'syz.4.11577': attribute type 1 has an invalid length. [ 1350.940997][T14235] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1350.959704][T14237] tun0: tun_chr_ioctl cmd 1074025675 [ 1350.959725][T14237] tun0: persist enabled [ 1350.959904][T14237] tun0: tun_chr_ioctl cmd 1074025675 [ 1350.959942][T14237] tun0: persist disabled [ 1351.121117][T14235] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11577'. [ 1351.265943][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 1351.410932][T14258] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11582'. [ 1351.645455][T14267] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11585'. [ 1351.680596][T14266] xt_hashlimit: size too large, truncated to 1048576 [ 1351.758895][T14272] FAULT_INJECTION: forcing a failure. [ 1351.758895][T14272] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1351.758927][T14272] CPU: 1 UID: 0 PID: 14272 Comm: syz.2.11587 Not tainted syzkaller #0 PREEMPT(full) [ 1351.758948][T14272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1351.758961][T14272] Call Trace: [ 1351.758969][T14272] [ 1351.758977][T14272] dump_stack_lvl+0xe8/0x150 [ 1351.759009][T14272] should_fail_ex+0x410/0x560 [ 1351.759038][T14272] _copy_to_user+0x31/0xb0 [ 1351.759065][T14272] simple_read_from_buffer+0xe1/0x170 [ 1351.759097][T14272] proc_fail_nth_read+0x1bb/0x230 [ 1351.759125][T14272] ? common_file_perm+0x20e/0x2b0 [ 1351.759151][T14272] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1351.759184][T14272] ? rw_verify_area+0x24a/0x4c0 [ 1351.759213][T14272] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1351.759242][T14272] vfs_read+0x213/0xa80 [ 1351.759275][T14272] ? __pfx___mutex_lock+0x10/0x10 [ 1351.759299][T14272] ? __pfx_vfs_read+0x10/0x10 [ 1351.759337][T14272] ? __fget_files+0x2a/0x420 [ 1351.759367][T14272] ? __fget_files+0x3a2/0x420 [ 1351.759392][T14272] ? __fget_files+0x2a/0x420 [ 1351.759427][T14272] ksys_read+0x150/0x270 [ 1351.759457][T14272] ? __pfx_ksys_read+0x10/0x10 [ 1351.759497][T14272] do_syscall_64+0x166/0x520 [ 1351.759517][T14272] ? trace_irq_disable+0x3b/0x140 [ 1351.759537][T14272] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.759557][T14272] ? clear_bhb_loop+0x70/0xc0 [ 1351.759581][T14272] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1351.759601][T14272] RIP: 0033:0x7f160515e98e [ 1351.759619][T14272] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1351.759636][T14272] RSP: 002b:00007f1605f9bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1351.759658][T14272] RAX: ffffffffffffffda RBX: 00007f1605f9c6c0 RCX: 00007f160515e98e [ 1351.759673][T14272] RDX: 000000000000000f RSI: 00007f1605f9c0a0 RDI: 0000000000000005 [ 1351.759684][T14272] RBP: 00007f1605f9c090 R08: 0000000000000000 R09: 0000000000000000 [ 1351.759696][T14272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1351.759707][T14272] R13: 00007f1605426038 R14: 00007f1605425fa0 R15: 00007ffeba2a4bd8 [ 1351.759739][T14272] [ 1352.073838][T14285] netlink: 9 bytes leftover after parsing attributes in process `syz.0.11592'. [ 1352.082683][T14285] 0·: renamed from hsr0 (while UP) [ 1352.102583][T14285] FAULT_INJECTION: forcing a failure. [ 1352.102583][T14285] name failslab, interval 1, probability 0, space 0, times 0 [ 1352.102604][T14285] CPU: 1 UID: 0 PID: 14285 Comm: syz.0.11592 Not tainted syzkaller #0 PREEMPT(full) [ 1352.102616][T14285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1352.102623][T14285] Call Trace: [ 1352.102627][T14285] [ 1352.102632][T14285] dump_stack_lvl+0xe8/0x150 [ 1352.102653][T14285] should_fail_ex+0x410/0x560 [ 1352.102669][T14285] should_failslab+0xa8/0x100 [ 1352.102683][T14285] __kmalloc_noprof+0xfe/0x720 [ 1352.102694][T14285] ? __register_sysctl_table+0x6f/0x1370 [ 1352.102706][T14285] ? __register_sysctl_table+0x6f/0x1370 [ 1352.102720][T14285] __register_sysctl_table+0x6f/0x1370 [ 1352.102731][T14285] ? register_net_sysctl_sz+0x2ba/0x3f0 [ 1352.102842][T14285] __devinet_sysctl_register+0x36d/0x470 [ 1352.102862][T14285] ? __pfx___devinet_sysctl_register+0x10/0x10 [ 1352.102877][T14285] ? lockdep_hardirqs_on+0x7b/0x110 [ 1352.102893][T14285] devinet_sysctl_register+0x187/0x200 [ 1352.102908][T14285] inetdev_event+0xdc4/0x1610 [ 1352.102921][T14285] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 1352.102980][T14285] ? __pfx_inetdev_event+0x10/0x10 [ 1352.103008][T14285] notifier_call_chain+0x1a5/0x3d0 [ 1352.103043][T14285] netif_change_name+0x5f3/0x970 [ 1352.103066][T14285] ? do_setlink+0xb66/0x4670 [ 1352.103096][T14285] ? __pfx_netif_change_name+0x10/0x10 [ 1352.103122][T14285] ? nla_strscpy+0x10f/0x170 [ 1352.103149][T14285] do_setlink+0xb66/0x4670 [ 1352.103165][T14285] ? __wake_up_klogd+0xf0/0x130 [ 1352.103183][T14285] ? __pfx_vprintk_emit+0x10/0x10 [ 1352.103198][T14285] ? __pfx_do_setlink+0x10/0x10 [ 1352.103211][T14285] ? __lock_acquire+0x747/0x2de0 [ 1352.103230][T14285] ? rcu_is_watching+0x16/0xb0 [ 1352.103242][T14285] ? do_trace_netlink_extack+0x80/0x1d0 [ 1352.103258][T14285] ? __mutex_trylock_common+0x15f/0x270 [ 1352.103273][T14285] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1352.103294][T14285] ? rcu_is_watching+0x16/0xb0 [ 1352.103306][T14285] ? trace_contention_end+0x3d/0x140 [ 1352.103319][T14285] ? __mutex_lock+0x30b/0x1550 [ 1352.103336][T14285] ? rtnl_newlink+0xc10/0x1c30 [ 1352.103349][T14285] ? __pfx___mutex_lock+0x10/0x10 [ 1352.103365][T14285] ? ns_capable+0x89/0xe0 [ 1352.103379][T14285] ? rtnl_nets_add+0x16c/0x300 [ 1352.103390][T14285] ? refcount_inc+0x46/0x70 [ 1352.103401][T14285] rtnl_newlink+0x15a3/0x1c30 [ 1352.103419][T14285] ? __pfx_rtnl_newlink+0x10/0x10 [ 1352.103430][T14285] ? do_writev+0x154/0x2e0 [ 1352.103441][T14285] ? do_syscall_64+0x166/0x520 [ 1352.103451][T14285] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.103480][T14285] ? kasan_quarantine_put+0xbb/0x1f0 [ 1352.103490][T14285] ? lockdep_hardirqs_on+0x7b/0x110 [ 1352.103503][T14285] ? nlmon_xmit+0xb0/0x100 [ 1352.103545][T14285] ? kmem_cache_free+0x182/0x650 [ 1352.103562][T14285] ? __lock_acquire+0x747/0x2de0 [ 1352.103577][T14285] ? __local_bh_enable_ip+0xd6/0x140 [ 1352.103591][T14285] ? lockdep_hardirqs_on+0x7b/0x110 [ 1352.103601][T14285] ? __dev_queue_xmit+0x29b/0x3820 [ 1352.103615][T14285] ? __local_bh_enable_ip+0xd6/0x140 [ 1352.103627][T14285] ? __dev_queue_xmit+0x29b/0x3820 [ 1352.103644][T14285] ? lock_acquire+0x115/0x350 [ 1352.103654][T14285] ? __pfx_rtnl_newlink+0x10/0x10 [ 1352.103672][T14285] ? __pfx_rtnl_newlink+0x10/0x10 [ 1352.103682][T14285] rtnetlink_rcv_msg+0x802/0xc00 [ 1352.103696][T14285] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1352.103707][T14285] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1352.103717][T14285] ? ref_tracker_free+0x689/0x830 [ 1352.103731][T14285] ? __pfx_ref_tracker_free+0x10/0x10 [ 1352.103748][T14285] netlink_rcv_skb+0x226/0x4a0 [ 1352.103763][T14285] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1352.103775][T14285] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1352.103798][T14285] ? netlink_deliver_tap+0x2e/0x1b0 [ 1352.103814][T14285] ? netlink_deliver_tap+0x2e/0x1b0 [ 1352.103831][T14285] netlink_unicast+0x7bd/0x940 [ 1352.103849][T14285] netlink_sendmsg+0x813/0xb40 [ 1352.103868][T14285] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1352.103893][T14285] ? apparmor_socket_sendmsg+0x98/0x360 [ 1352.103915][T14285] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1352.103938][T14285] sock_sendmsg_nosec+0x13a/0x180 [ 1352.103968][T14285] sock_write_iter+0x2de/0x3e0 [ 1352.103995][T14285] ? __pfx_sock_write_iter+0x10/0x10 [ 1352.104038][T14285] do_iter_readv_writev+0x612/0x8c0 [ 1352.104060][T14285] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1352.104084][T14285] ? bpf_lsm_file_permission+0x9/0x20 [ 1352.104109][T14285] ? security_file_permission+0x75/0x260 [ 1352.104139][T14285] ? rw_verify_area+0x203/0x4c0 [ 1352.104171][T14285] vfs_writev+0x343/0x990 [ 1352.104202][T14285] ? __pfx_vfs_writev+0x10/0x10 [ 1352.104239][T14285] ? __fget_files+0x2a/0x420 [ 1352.104270][T14285] ? __fget_files+0x3a2/0x420 [ 1352.104303][T14285] ? __fget_files+0x2a/0x420 [ 1352.104337][T14285] do_writev+0x154/0x2e0 [ 1352.104362][T14285] ? __pfx_do_writev+0x10/0x10 [ 1352.104396][T14285] do_syscall_64+0x166/0x520 [ 1352.104416][T14285] ? trace_irq_disable+0x3b/0x140 [ 1352.104436][T14285] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.104456][T14285] ? clear_bhb_loop+0x70/0xc0 [ 1352.104481][T14285] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.104500][T14285] RIP: 0033:0x7f3d0b79e159 [ 1352.104519][T14285] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1352.104537][T14285] RSP: 002b:00007f3d0c5c9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1352.104559][T14285] RAX: ffffffffffffffda RBX: 00007f3d0ba25fa0 RCX: 00007f3d0b79e159 [ 1352.104574][T14285] RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000003 [ 1352.104587][T14285] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1352.104600][T14285] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1352.104613][T14285] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1352.104645][T14285] [ 1352.123771][T14285] 0·: entered allmulticast mode [ 1352.123791][T14285] hsr_slave_0: entered allmulticast mode [ 1352.123807][T14285] hsr_slave_1: entered allmulticast mode [ 1352.768461][T14307] netlink: 'syz.1.11599': attribute type 10 has an invalid length. [ 1352.768485][T14307] netlink: 55 bytes leftover after parsing attributes in process `syz.1.11599'. [ 1352.914280][ T980] tipc: Subscription rejected, illegal request [ 1352.921766][T14314] FAULT_INJECTION: forcing a failure. [ 1352.921766][T14314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1352.921796][T14314] CPU: 1 UID: 0 PID: 14314 Comm: syz.4.11600 Not tainted syzkaller #0 PREEMPT(full) [ 1352.921818][T14314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1352.921829][T14314] Call Trace: [ 1352.921838][T14314] [ 1352.921846][T14314] dump_stack_lvl+0xe8/0x150 [ 1352.921879][T14314] should_fail_ex+0x410/0x560 [ 1352.921907][T14314] _copy_to_user+0x31/0xb0 [ 1352.921937][T14314] simple_read_from_buffer+0xe1/0x170 [ 1352.921969][T14314] proc_fail_nth_read+0x1bb/0x230 [ 1352.921996][T14314] ? common_file_perm+0x20e/0x2b0 [ 1352.922021][T14314] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1352.922054][T14314] ? rw_verify_area+0x24a/0x4c0 [ 1352.922083][T14314] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1352.922111][T14314] vfs_read+0x213/0xa80 [ 1352.922152][T14314] ? __pfx___mutex_lock+0x10/0x10 [ 1352.922175][T14314] ? __pfx_vfs_read+0x10/0x10 [ 1352.922204][T14314] ? __fget_files+0x2a/0x420 [ 1352.922233][T14314] ? __fget_files+0x3a2/0x420 [ 1352.922258][T14314] ? __fget_files+0x2a/0x420 [ 1352.922292][T14314] ksys_read+0x150/0x270 [ 1352.922322][T14314] ? __pfx_ksys_read+0x10/0x10 [ 1352.922361][T14314] do_syscall_64+0x166/0x520 [ 1352.922381][T14314] ? trace_irq_disable+0x3b/0x140 [ 1352.922400][T14314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.922420][T14314] ? clear_bhb_loop+0x70/0xc0 [ 1352.922444][T14314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1352.922463][T14314] RIP: 0033:0x7f0bfab5e98e [ 1352.922480][T14314] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1352.922496][T14314] RSP: 002b:00007f0bfba54fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1352.922516][T14314] RAX: ffffffffffffffda RBX: 00007f0bfba556c0 RCX: 00007f0bfab5e98e [ 1352.922530][T14314] RDX: 000000000000000f RSI: 00007f0bfba550a0 RDI: 0000000000000004 [ 1352.922542][T14314] RBP: 00007f0bfba55090 R08: 0000000000000000 R09: 0000000000000000 [ 1352.922555][T14314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1352.922567][T14314] R13: 00007f0bfae26128 R14: 00007f0bfae26090 R15: 00007ffd6e6d4ae8 [ 1352.922599][T14314] [ 1353.715020][T14339] sock: sock_timestamping_bind_phc: sock not bind to device [ 1354.266458][T14305] ip6gretap0: entered promiscuous mode [ 1354.266560][T14305] vlan2: entered promiscuous mode [ 1354.607030][T14346] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11608'. [ 1354.687220][T14350] syzkaller1: entered promiscuous mode [ 1354.687241][T14350] syzkaller1: entered allmulticast mode [ 1354.765405][T14356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11611'. [ 1354.795913][T14359] xt_hashlimit: size too large, truncated to 1048576 [ 1354.814664][ T980] net_ratelimit: 28 callbacks suppressed [ 1354.814679][ T980] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1354.901110][T14363] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11613'. [ 1354.924136][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.036404][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.118173][ T1151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1355.145470][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.222954][T14381] xt_hashlimit: size too large, truncated to 1048576 [ 1355.254233][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.364107][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.373415][T14387] netlink: 'syz.4.11621': attribute type 2 has an invalid length. [ 1355.474378][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.502452][T14389] netlink: 'syz.1.11623': attribute type 15 has an invalid length. [ 1355.586845][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.630668][T14398] FAULT_INJECTION: forcing a failure. [ 1355.630668][T14398] name failslab, interval 1, probability 0, space 0, times 0 [ 1355.630701][T14398] CPU: 0 UID: 0 PID: 14398 Comm: syz.1.11626 Not tainted syzkaller #0 PREEMPT(full) [ 1355.630725][T14398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1355.630737][T14398] Call Trace: [ 1355.630745][T14398] [ 1355.630754][T14398] dump_stack_lvl+0xe8/0x150 [ 1355.630787][T14398] should_fail_ex+0x410/0x560 [ 1355.630815][T14398] should_failslab+0xa8/0x100 [ 1355.630840][T14398] __kmalloc_cache_noprof+0xa3/0x600 [ 1355.630860][T14398] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1355.630878][T14398] ? sctp_add_bind_addr+0x8c/0x370 [ 1355.630904][T14398] ? sctp_add_bind_addr+0x8c/0x370 [ 1355.630936][T14398] sctp_add_bind_addr+0x8c/0x370 [ 1355.630967][T14398] sctp_copy_local_addr_list+0x31a/0x4e0 [ 1355.630997][T14398] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 1355.631025][T14398] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1355.631056][T14398] ? sctp_v4_is_any+0x35/0x60 [ 1355.631082][T14398] ? sctp_copy_one_addr+0x93/0x360 [ 1355.631111][T14398] sctp_bind_addr_copy+0xb3/0x3c0 [ 1355.631138][T14398] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1355.631165][T14398] sctp_connect_new_asoc+0x2ff/0x6b0 [ 1355.631188][T14398] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1355.631213][T14398] ? __local_bh_enable_ip+0xd6/0x140 [ 1355.631236][T14398] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1355.631276][T14398] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1355.631299][T14398] sctp_sendmsg+0x159b/0x2d00 [ 1355.631332][T14398] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1355.631357][T14398] ? __lock_acquire+0x747/0x2de0 [ 1355.631390][T14398] ? aa_sock_msg_perm+0xfc/0x210 [ 1355.631412][T14398] ? sock_rps_record_flow+0x19/0x350 [ 1355.631442][T14398] ? inet_sendmsg+0x298/0x320 [ 1355.631472][T14398] ? __pfx_inet_sendmsg+0x10/0x10 [ 1355.631499][T14398] sock_sendmsg_nosec+0x10e/0x180 [ 1355.631531][T14398] ____sys_sendmsg+0x54e/0x850 [ 1355.631560][T14398] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1355.631593][T14398] ? import_iovec+0x73/0xa0 [ 1355.631621][T14398] ___sys_sendmsg+0x2a5/0x360 [ 1355.631650][T14398] ? __lock_acquire+0x747/0x2de0 [ 1355.631675][T14398] ? __pfx____sys_sendmsg+0x10/0x10 [ 1355.631732][T14398] ? __fget_files+0x2a/0x420 [ 1355.631757][T14398] ? __fget_files+0x3a2/0x420 [ 1355.631794][T14398] __x64_sys_sendmsg+0x1b1/0x290 [ 1355.631819][T14398] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1355.631863][T14398] do_syscall_64+0x166/0x520 [ 1355.631884][T14398] ? trace_irq_disable+0x3b/0x140 [ 1355.631902][T14398] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1355.631921][T14398] ? clear_bhb_loop+0x70/0xc0 [ 1355.631944][T14398] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1355.631962][T14398] RIP: 0033:0x7f0ebff9e159 [ 1355.631980][T14398] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1355.631997][T14398] RSP: 002b:00007f0ec0e00028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1355.632016][T14398] RAX: ffffffffffffffda RBX: 00007f0ec0225fa0 RCX: 00007f0ebff9e159 [ 1355.632030][T14398] RDX: 000000000400e057 RSI: 0000200000000700 RDI: 0000000000000003 [ 1355.632043][T14398] RBP: 00007f0ec0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 1355.632055][T14398] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1355.632067][T14398] R13: 00007f0ec0226038 R14: 00007f0ec0225fa0 R15: 00007ffe22f72348 [ 1355.632099][T14398] [ 1355.704139][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1355.822336][T14402] __nla_validate_parse: 2 callbacks suppressed [ 1355.822355][T14402] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11628'. [ 1355.822372][T14402] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11628'. [ 1356.047519][T14412] FAULT_INJECTION: forcing a failure. [ 1356.047519][T14412] name failslab, interval 1, probability 0, space 0, times 0 [ 1356.047550][T14412] CPU: 0 UID: 0 PID: 14412 Comm: syz.1.11632 Not tainted syzkaller #0 PREEMPT(full) [ 1356.047571][T14412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1356.047583][T14412] Call Trace: [ 1356.047590][T14412] [ 1356.047599][T14412] dump_stack_lvl+0xe8/0x150 [ 1356.047631][T14412] should_fail_ex+0x410/0x560 [ 1356.047658][T14412] should_failslab+0xa8/0x100 [ 1356.047687][T14412] __kmalloc_noprof+0xfe/0x720 [ 1356.047712][T14412] ? ___neigh_create+0x6d2/0x2310 [ 1356.047732][T14412] ? ___neigh_create+0x6d2/0x2310 [ 1356.047757][T14412] ___neigh_create+0x6d2/0x2310 [ 1356.047785][T14412] ? __ipv6_neigh_lookup_noref+0x57d/0x780 [ 1356.047821][T14412] ip6_finish_output2+0x863/0x14b0 [ 1356.047849][T14412] ? ip6_finish_output+0x268/0x480 [ 1356.047867][T14412] ? ip6_output+0x11e/0x540 [ 1356.047887][T14412] ip6_output+0x337/0x540 [ 1356.047906][T14412] ? ip6_send_skb+0x10a/0x380 [ 1356.047929][T14412] ip6_send_skb+0x1cd/0x380 [ 1356.047952][T14412] udp_v6_send_skb+0xab2/0x13a0 [ 1356.047987][T14412] udpv6_sendmsg+0x1e44/0x2610 [ 1356.048023][T14412] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 1356.048045][T14412] ? udp_lib_get_port+0x177b/0x1c60 [ 1356.048103][T14412] ? inet_send_prepare+0x1b4/0x260 [ 1356.048136][T14412] ? lockdep_hardirqs_on+0x7b/0x110 [ 1356.048158][T14412] ? inet_send_prepare+0x1b4/0x260 [ 1356.048184][T14412] ? __local_bh_enable_ip+0xd6/0x140 [ 1356.048209][T14412] ? inet_send_prepare+0x1b4/0x260 [ 1356.048240][T14412] ? inet6_sendmsg+0xe4/0x120 [ 1356.048268][T14412] ? __pfx_inet6_sendmsg+0x10/0x10 [ 1356.048293][T14412] sock_sendmsg_nosec+0x90/0x180 [ 1356.048326][T14412] ____sys_sendmsg+0x54e/0x850 [ 1356.048357][T14412] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1356.048392][T14412] ? import_iovec+0x73/0xa0 [ 1356.048419][T14412] ___sys_sendmsg+0x2a5/0x360 [ 1356.048442][T14412] ? __lock_acquire+0x747/0x2de0 [ 1356.048472][T14412] ? __pfx____sys_sendmsg+0x10/0x10 [ 1356.048503][T14412] ? kstrtouint+0x6e/0xe0 [ 1356.048559][T14412] ? __fget_files+0x2a/0x420 [ 1356.048585][T14412] ? __fget_files+0x3a2/0x420 [ 1356.048622][T14412] __sys_sendmmsg+0x273/0x4d0 [ 1356.048652][T14412] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1356.048684][T14412] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1356.048720][T14412] ? ksys_write+0x242/0x270 [ 1356.048752][T14412] ? __pfx_ksys_write+0x10/0x10 [ 1356.048784][T14412] __x64_sys_sendmmsg+0xa0/0xc0 [ 1356.048811][T14412] do_syscall_64+0x166/0x520 [ 1356.048830][T14412] ? trace_irq_disable+0x3b/0x140 [ 1356.048848][T14412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.048866][T14412] ? clear_bhb_loop+0x70/0xc0 [ 1356.048891][T14412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1356.048909][T14412] RIP: 0033:0x7f0ebff9e159 [ 1356.048928][T14412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1356.048945][T14412] RSP: 002b:00007f0ec0e00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1356.048967][T14412] RAX: ffffffffffffffda RBX: 00007f0ec0225fa0 RCX: 00007f0ebff9e159 [ 1356.048982][T14412] RDX: 0000000000000001 RSI: 00002000000016c0 RDI: 0000000000000003 [ 1356.048994][T14412] RBP: 00007f0ec0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 1356.049008][T14412] R10: 0000000004040084 R11: 0000000000000246 R12: 0000000000000001 [ 1356.049021][T14412] R13: 00007f0ec0226038 R14: 00007f0ec0225fa0 R15: 00007ffe22f72348 [ 1356.049054][T14412] [ 1356.282941][T14419] netlink: 'syz.1.11634': attribute type 2 has an invalid length. [ 1356.282963][T14419] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11634'. [ 1356.817433][T14435] netlink: 830 bytes leftover after parsing attributes in process `syz.1.11639'. [ 1356.817477][T14435] bond_slave_0: entered promiscuous mode [ 1356.841072][T14438] netlink: 830 bytes leftover after parsing attributes in process `syz.4.11641'. [ 1356.904215][T14438] IPVS: persistence engine module ip_vs_pe_ not found [ 1356.951861][T14449] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11644'. [ 1356.956776][T14435] IPVS: persistence engine module ip_vs_pe_ not found [ 1356.979551][T14449] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11644'. [ 1357.006629][T14449] netlink: 'syz.3.11644': attribute type 1 has an invalid length. [ 1357.024146][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1357.143305][T14456] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11646'. [ 1357.143329][T14456] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11646'. [ 1357.674078][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1359.963996][ T40] net_ratelimit: 11 callbacks suppressed [ 1359.964020][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1359.989351][T14486] netlink: 'syz.4.11653': attribute type 2 has an invalid length. [ 1359.989364][T14486] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11653'. [ 1360.074033][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.177362][T14495] FAULT_INJECTION: forcing a failure. [ 1360.177362][T14495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1360.177394][T14495] CPU: 0 UID: 0 PID: 14495 Comm: syz.0.11656 Not tainted syzkaller #0 PREEMPT(full) [ 1360.177416][T14495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1360.177427][T14495] Call Trace: [ 1360.177435][T14495] [ 1360.177443][T14495] dump_stack_lvl+0xe8/0x150 [ 1360.177476][T14495] should_fail_ex+0x410/0x560 [ 1360.177502][T14495] _copy_from_iter+0x3b0/0x1660 [ 1360.177531][T14495] ? __pfx__copy_from_iter+0x10/0x10 [ 1360.177553][T14495] ? ip6_dst_lookup_tail+0x2a4/0x1610 [ 1360.177579][T14495] ? skb_put+0x112/0x210 [ 1360.177602][T14495] rawv6_send_hdrinc+0x894/0x1950 [ 1360.177640][T14495] ? __pfx_rawv6_send_hdrinc+0x10/0x10 [ 1360.177662][T14495] ? txopt_get+0x343/0x3f0 [ 1360.177687][T14495] ? __pfx_txopt_get+0x10/0x10 [ 1360.177717][T14495] rawv6_sendmsg+0x12fb/0x18c0 [ 1360.177756][T14495] ? __pfx_rawv6_sendmsg+0x10/0x10 [ 1360.177800][T14495] ? __lock_acquire+0x747/0x2de0 [ 1360.177826][T14495] ? aa_sock_msg_perm+0xf5/0x210 [ 1360.177849][T14495] ? sock_rps_record_flow+0x19/0x350 [ 1360.177880][T14495] ? inet_sendmsg+0x298/0x320 [ 1360.177905][T14495] ? apparmor_socket_sendmsg+0x98/0x360 [ 1360.177928][T14495] ? __pfx_inet_sendmsg+0x10/0x10 [ 1360.177953][T14495] sock_sendmsg_nosec+0x10e/0x180 [ 1360.177985][T14495] ____sys_sendmsg+0x54e/0x850 [ 1360.178015][T14495] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1360.178047][T14495] ? import_iovec+0x73/0xa0 [ 1360.178071][T14495] ___sys_sendmsg+0x2a5/0x360 [ 1360.178094][T14495] ? __lock_acquire+0x747/0x2de0 [ 1360.178118][T14495] ? __pfx____sys_sendmsg+0x10/0x10 [ 1360.178183][T14495] ? __fget_files+0x2a/0x420 [ 1360.178209][T14495] ? __fget_files+0x3a2/0x420 [ 1360.178245][T14495] __x64_sys_sendmsg+0x1b1/0x290 [ 1360.178272][T14495] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1360.178317][T14495] do_syscall_64+0x166/0x520 [ 1360.178338][T14495] ? trace_irq_disable+0x3b/0x140 [ 1360.178357][T14495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.178377][T14495] ? clear_bhb_loop+0x70/0xc0 [ 1360.178401][T14495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.178421][T14495] RIP: 0033:0x7f3d0b79e159 [ 1360.178439][T14495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1360.178456][T14495] RSP: 002b:00007f3d0c5c9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1360.178478][T14495] RAX: ffffffffffffffda RBX: 00007f3d0ba25fa0 RCX: 00007f3d0b79e159 [ 1360.178493][T14495] RDX: 0000000000000000 RSI: 0000200000001c00 RDI: 0000000000000006 [ 1360.178505][T14495] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1360.178516][T14495] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1360.178529][T14495] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1360.178560][T14495] [ 1360.184236][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.230268][ T1151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1360.230450][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1360.270759][T14498] bond_slave_0: entered promiscuous mode [ 1360.297008][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.505589][T24387] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.540999][T14498] IPVS: persistence engine module ip_vs_pe_ not found [ 1360.541394][T14508] FAULT_INJECTION: forcing a failure. [ 1360.541394][T14508] name failslab, interval 1, probability 0, space 0, times 0 [ 1360.541421][T14508] CPU: 0 UID: 0 PID: 14508 Comm: syz.1.11660 Not tainted syzkaller #0 PREEMPT(full) [ 1360.541441][T14508] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1360.541451][T14508] Call Trace: [ 1360.541459][T14508] [ 1360.541467][T14508] dump_stack_lvl+0xe8/0x150 [ 1360.541498][T14508] should_fail_ex+0x410/0x560 [ 1360.541525][T14508] should_failslab+0xa8/0x100 [ 1360.541548][T14508] ? skb_clone+0x212/0x3a0 [ 1360.541572][T14508] kmem_cache_alloc_noprof+0xa1/0x600 [ 1360.541601][T14508] ? skb_clone+0x212/0x3a0 [ 1360.541631][T14508] skb_clone+0x212/0x3a0 [ 1360.541691][T14508] __netlink_deliver_tap+0x413/0x860 [ 1360.541729][T14508] ? netlink_deliver_tap+0x2e/0x1b0 [ 1360.541757][T14508] netlink_deliver_tap+0x19c/0x1b0 [ 1360.541785][T14508] netlink_unicast+0x781/0x940 [ 1360.541819][T14508] netlink_sendmsg+0x813/0xb40 [ 1360.541855][T14508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1360.541889][T14508] ? apparmor_socket_sendmsg+0x98/0x360 [ 1360.541912][T14508] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1360.541936][T14508] sock_sendmsg_nosec+0x13a/0x180 [ 1360.541965][T14508] ____sys_sendmsg+0x54e/0x850 [ 1360.541991][T14508] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1360.542024][T14508] ? import_iovec+0x73/0xa0 [ 1360.542050][T14508] ___sys_sendmsg+0x2a5/0x360 [ 1360.542073][T14508] ? __lock_acquire+0x747/0x2de0 [ 1360.542098][T14508] ? __pfx____sys_sendmsg+0x10/0x10 [ 1360.542157][T14508] ? __fget_files+0x2a/0x420 [ 1360.542181][T14508] ? __fget_files+0x3a2/0x420 [ 1360.542214][T14508] __x64_sys_sendmsg+0x1b1/0x290 [ 1360.542240][T14508] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1360.542281][T14508] do_syscall_64+0x166/0x520 [ 1360.542301][T14508] ? trace_irq_disable+0x3b/0x140 [ 1360.542320][T14508] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.542342][T14508] ? clear_bhb_loop+0x70/0xc0 [ 1360.542366][T14508] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1360.542386][T14508] RIP: 0033:0x7f0ebff9e159 [ 1360.542404][T14508] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1360.542420][T14508] RSP: 002b:00007f0ec0e00028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1360.542441][T14508] RAX: ffffffffffffffda RBX: 00007f0ec0225fa0 RCX: 00007f0ebff9e159 [ 1360.542456][T14508] RDX: 0000000000000004 RSI: 0000200000000600 RDI: 0000000000000003 [ 1360.542468][T14508] RBP: 00007f0ec0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 1360.542480][T14508] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1360.542492][T14508] R13: 00007f0ec0226038 R14: 00007f0ec0225fa0 R15: 00007ffe22f72348 [ 1360.542523][T14508] [ 1360.696289][T24387] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.807156][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1360.865215][ T980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1360.972240][T14521] __nla_validate_parse: 4 callbacks suppressed [ 1360.973753][T14521] netlink: 68 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.978241][T14521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.978948][T14521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.979312][T14521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.979595][T14521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.979983][T14521] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11664'. [ 1360.989819][T14516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11663'. [ 1361.066702][T14524] netlink: 144 bytes leftover after parsing attributes in process `syz.2.11665'. [ 1361.219230][T14534] netlink: 'syz.3.11669': attribute type 2 has an invalid length. [ 1361.219254][T14534] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11669'. [ 1361.504269][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1361.783937][T14523] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1361.784315][T14524] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1362.490295][T14551] IPVS: persistence engine module ip_vs_pe_ not found [ 1363.731405][T14558] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11676'. [ 1364.258109][ T9641] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1364.531366][T14597] netlink: 'syz.4.11688': attribute type 7 has an invalid length. [ 1364.531388][T14597] netlink: 'syz.4.11688': attribute type 3 has an invalid length. [ 1364.624365][ T9644] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1364.731126][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1364.731148][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1364.905090][T14608] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1365.359735][T14623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1365.394051][T11045] net_ratelimit: 11 callbacks suppressed [ 1365.394071][T11045] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.504085][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.539112][T11045] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1365.539134][T11045] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1365.584531][T14631] IPVS: persistence engine module ip_vs_pe_ not found [ 1365.614081][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.754220][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.767267][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1365.864091][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.974187][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1365.992693][ T1151] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1365.995632][T24387] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1365.995790][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1366.084047][T24387] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1366.126137][T14651] __nla_validate_parse: 8 callbacks suppressed [ 1366.126150][T14651] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11700'. [ 1366.175438][T14653] xt_l2tp: v2 tid > 0xffff: 37482740 [ 1366.284275][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1367.037110][T14665] FAULT_INJECTION: forcing a failure. [ 1367.037110][T14665] name failslab, interval 1, probability 0, space 0, times 0 [ 1367.037144][T14665] CPU: 0 UID: 0 PID: 14665 Comm: syz.0.11706 Not tainted syzkaller #0 PREEMPT(full) [ 1367.037167][T14665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1367.037179][T14665] Call Trace: [ 1367.037187][T14665] [ 1367.037196][T14665] dump_stack_lvl+0xe8/0x150 [ 1367.037236][T14665] should_fail_ex+0x410/0x560 [ 1367.037264][T14665] should_failslab+0xa8/0x100 [ 1367.037288][T14665] ? skb_clone+0x212/0x3a0 [ 1367.037313][T14665] kmem_cache_alloc_noprof+0xa1/0x600 [ 1367.037345][T14665] ? skb_clone+0x212/0x3a0 [ 1367.037377][T14665] skb_clone+0x212/0x3a0 [ 1367.037406][T14665] __netlink_deliver_tap+0x413/0x860 [ 1367.037444][T14665] ? netlink_deliver_tap+0x2e/0x1b0 [ 1367.037472][T14665] netlink_deliver_tap+0x19c/0x1b0 [ 1367.037501][T14665] netlink_sendskb+0x68/0x140 [ 1367.037529][T14665] netlink_rcv_skb+0x2a4/0x4a0 [ 1367.037557][T14665] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1367.037581][T14665] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1367.037624][T14665] ? down_read+0x2be/0x330 [ 1367.037653][T14665] genl_rcv+0x28/0x40 [ 1367.037672][T14665] netlink_unicast+0x7bd/0x940 [ 1367.037711][T14665] netlink_sendmsg+0x813/0xb40 [ 1367.037748][T14665] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1367.037785][T14665] ? apparmor_socket_sendmsg+0x98/0x360 [ 1367.037810][T14665] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1367.037836][T14665] sock_sendmsg_nosec+0x13a/0x180 [ 1367.037869][T14665] ____sys_sendmsg+0x54e/0x850 [ 1367.037900][T14665] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1367.037934][T14665] ? import_iovec+0x73/0xa0 [ 1367.037963][T14665] ___sys_sendmsg+0x2a5/0x360 [ 1367.037987][T14665] ? __lock_acquire+0x747/0x2de0 [ 1367.038011][T14665] ? __pfx____sys_sendmsg+0x10/0x10 [ 1367.038074][T14665] ? __fget_files+0x2a/0x420 [ 1367.038134][T14665] ? __fget_files+0x3a2/0x420 [ 1367.038172][T14665] __x64_sys_sendmsg+0x1b1/0x290 [ 1367.038201][T14665] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1367.038255][T14665] do_syscall_64+0x166/0x520 [ 1367.038275][T14665] ? trace_irq_disable+0x3b/0x140 [ 1367.038295][T14665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.038315][T14665] ? clear_bhb_loop+0x70/0xc0 [ 1367.038340][T14665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.038360][T14665] RIP: 0033:0x7f3d0b79e159 [ 1367.038379][T14665] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1367.038397][T14665] RSP: 002b:00007f3d0c5c9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1367.038418][T14665] RAX: ffffffffffffffda RBX: 00007f3d0ba25fa0 RCX: 00007f3d0b79e159 [ 1367.038433][T14665] RDX: 0000000004000084 RSI: 0000200000000400 RDI: 0000000000000003 [ 1367.038447][T14665] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1367.038460][T14665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1367.038472][T14665] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1367.038505][T14665] [ 1367.046234][T14670] bridge0: port 2(bridge_slave_1) entered blocking state [ 1367.046348][T14670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1367.046644][T14670] bridge0: port 1(bridge_slave_0) entered blocking state [ 1367.046750][T14670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1367.258311][T14670] mac80211_hwsim hwsim51 wlan0: entered promiscuous mode [ 1367.302420][T14670] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1367.339017][T14675] FAULT_INJECTION: forcing a failure. [ 1367.339017][T14675] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1367.339048][T14675] CPU: 1 UID: 0 PID: 14675 Comm: syz.2.11710 Not tainted syzkaller #0 PREEMPT(full) [ 1367.339070][T14675] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1367.339081][T14675] Call Trace: [ 1367.339089][T14675] [ 1367.339096][T14675] dump_stack_lvl+0xe8/0x150 [ 1367.339128][T14675] should_fail_ex+0x410/0x560 [ 1367.339155][T14675] _copy_from_user+0x2d/0xb0 [ 1367.339178][T14675] ___sys_recvmsg+0x173/0x5a0 [ 1367.339207][T14675] ? __pfx____sys_recvmsg+0x10/0x10 [ 1367.339236][T14675] ? lock_acquire+0x115/0x350 [ 1367.339283][T14675] do_recvmmsg+0x31a/0x7f0 [ 1367.339315][T14675] ? __pfx_do_recvmmsg+0x10/0x10 [ 1367.339350][T14675] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1367.339373][T14675] ? __fget_files+0x3a2/0x420 [ 1367.339408][T14675] __x64_sys_recvmmsg+0x198/0x250 [ 1367.339438][T14675] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1367.339475][T14675] do_syscall_64+0x166/0x520 [ 1367.339494][T14675] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.339513][T14675] ? clear_bhb_loop+0x70/0xc0 [ 1367.339536][T14675] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1367.339554][T14675] RIP: 0033:0x7f160519e159 [ 1367.339572][T14675] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1367.339588][T14675] RSP: 002b:00007f1605f9c028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1367.339608][T14675] RAX: ffffffffffffffda RBX: 00007f1605425fa0 RCX: 00007f160519e159 [ 1367.339622][T14675] RDX: 0000000000000004 RSI: 0000200000002e80 RDI: 0000000000000003 [ 1367.339634][T14675] RBP: 00007f1605f9c090 R08: 0000000000000000 R09: 0000000000000000 [ 1367.339647][T14675] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1367.339659][T14675] R13: 00007f1605426038 R14: 00007f1605425fa0 R15: 00007ffeba2a4bd8 [ 1367.339688][T14675] [ 1367.480689][T14676] netlink: 830 bytes leftover after parsing attributes in process `syz.0.11709'. [ 1367.555638][T14680] IPVS: persistence engine module ip_vs_pe_ not found [ 1367.634334][T14686] netlink: 'syz.2.11712': attribute type 16 has an invalid length. [ 1367.634349][T14686] netlink: 'syz.2.11712': attribute type 3 has an invalid length. [ 1367.634357][T14686] netlink: 64066 bytes leftover after parsing attributes in process `syz.2.11712'. [ 1368.215396][ T9664] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1368.215579][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1368.349225][T14721] tipc: Failed to remove unknown binding: 66,0,0/33554436:586871231/586871233 [ 1368.349257][T14721] tipc: Failed to remove unknown binding: 66,0,0/33554436:586871231/586871232 [ 1368.353512][T14724] netlink: 830 bytes leftover after parsing attributes in process `syz.3.11724'. [ 1368.357081][T14721] tipc: Failed to remove unknown binding: 66,0,0/33554436:586871231/586871233 [ 1368.357109][T14721] tipc: Failed to remove unknown binding: 66,0,0/33554436:586871231/586871232 [ 1368.381828][ T9664] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1368.449525][T14724] IPVS: persistence engine module ip_vs_pe_ not found [ 1368.724163][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1369.069068][T14736] netlink: 44 bytes leftover after parsing attributes in process `syz.2.11727'. [ 1369.069104][T14736] netlink: 44 bytes leftover after parsing attributes in process `syz.2.11727'. [ 1369.181590][T14740] netlink: 68 bytes leftover after parsing attributes in process `syz.1.11729'. [ 1369.212529][T14747] netlink: 'syz.2.11727': attribute type 1 has an invalid length. [ 1369.212916][T14740] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11729'. [ 1369.213678][T14740] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11729'. [ 1369.215263][T14740] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11729'. [ 1369.251247][T14741] syzkaller0: entered promiscuous mode [ 1369.251270][T14741] syzkaller0: entered allmulticast mode [ 1369.268710][T14746] syzkaller0: entered promiscuous mode [ 1369.268731][T14746] syzkaller0: entered allmulticast mode [ 1369.817651][T14755] syzkaller1: entered promiscuous mode [ 1369.817666][T14755] syzkaller1: entered allmulticast mode [ 1370.075009][T14771] IPVS: persistence engine module ip_vs_pe_ not found [ 1370.168314][T14781] netlink: 'syz.4.11740': attribute type 15 has an invalid length. [ 1370.446436][ T1151] net_ratelimit: 25 callbacks suppressed [ 1370.446457][ T1151] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1370.554059][T24387] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1370.640791][T14792] syzkaller0: entered promiscuous mode [ 1370.640814][T14792] syzkaller0: entered allmulticast mode [ 1370.664156][T24387] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1370.774043][ T83] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1370.945022][ T83] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1371.140379][T14803] FAULT_INJECTION: forcing a failure. [ 1371.140379][T14803] name failslab, interval 1, probability 0, space 0, times 0 [ 1371.140411][T14803] CPU: 1 UID: 0 PID: 14803 Comm: syz.4.11747 Not tainted syzkaller #0 PREEMPT(full) [ 1371.140433][T14803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1371.140444][T14803] Call Trace: [ 1371.140451][T14803] [ 1371.140460][T14803] dump_stack_lvl+0xe8/0x150 [ 1371.140493][T14803] should_fail_ex+0x410/0x560 [ 1371.140517][T14803] should_failslab+0xa8/0x100 [ 1371.140543][T14803] __kmalloc_noprof+0xfe/0x720 [ 1371.140560][T14803] ? rcu_is_watching+0x16/0xb0 [ 1371.140583][T14803] ? tomoyo_realpath_from_path+0xef/0x640 [ 1371.140609][T14803] ? tomoyo_realpath_from_path+0xef/0x640 [ 1371.140641][T14803] tomoyo_realpath_from_path+0xef/0x640 [ 1371.140675][T14803] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1371.140696][T14803] tomoyo_path_number_perm+0x246/0x5f0 [ 1371.140721][T14803] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1371.140740][T14803] ? __lock_acquire+0x747/0x2de0 [ 1371.140776][T14803] ? hook_file_ioctl+0x1f2/0x600 [ 1371.140817][T14803] ? __fget_files+0x2a/0x420 [ 1371.140846][T14803] ? __fget_files+0x2a/0x420 [ 1371.140870][T14803] ? __fget_files+0x3a2/0x420 [ 1371.140894][T14803] ? __fget_files+0x2a/0x420 [ 1371.140923][T14803] security_file_ioctl+0xc3/0x2a0 [ 1371.140949][T14803] __se_sys_ioctl+0x47/0x170 [ 1371.140974][T14803] do_syscall_64+0x166/0x520 [ 1371.140995][T14803] ? trace_irq_disable+0x3b/0x140 [ 1371.141014][T14803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.141034][T14803] ? clear_bhb_loop+0x70/0xc0 [ 1371.141056][T14803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1371.141075][T14803] RIP: 0033:0x7f0bfab9e159 [ 1371.141092][T14803] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1371.141108][T14803] RSP: 002b:00007f0bfba76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1371.141128][T14803] RAX: ffffffffffffffda RBX: 00007f0bfae25fa0 RCX: 00007f0bfab9e159 [ 1371.141142][T14803] RDX: 0000200000000040 RSI: 00000000000089e0 RDI: 0000000000000003 [ 1371.141155][T14803] RBP: 00007f0bfba76090 R08: 0000000000000000 R09: 0000000000000000 [ 1371.141166][T14803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1371.141177][T14803] R13: 00007f0bfae26038 R14: 00007f0bfae25fa0 R15: 00007ffd6e6d4ae8 [ 1371.141207][T14803] [ 1371.141216][T14803] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1371.516635][ T40] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1371.535215][T14819] SET target dimension over the limit! [ 1371.538269][T14808] syzkaller1: entered promiscuous mode [ 1371.538282][T14808] syzkaller1: entered allmulticast mode [ 1371.583627][T14819] netlink: 'syz.2.11750': attribute type 15 has an invalid length. [ 1371.583650][T14819] __nla_validate_parse: 18 callbacks suppressed [ 1371.583662][T14819] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11750'. [ 1371.748081][ T83] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1371.748262][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1371.750796][ T40] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1371.848900][T14834] netlink: 'syz.2.11750': attribute type 3 has an invalid length. [ 1371.983397][T14831] IPVS: persistence engine module ip_vs_pe_ not found [ 1372.150664][ T83] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1372.164065][T14824] netlink: 830 bytes leftover after parsing attributes in process `syz.1.11751'. [ 1372.385672][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1372.748301][T14847] syzkaller0: entered promiscuous mode [ 1372.748325][T14847] syzkaller0: entered allmulticast mode [ 1373.015719][T14859] netlink: 68 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.052192][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.056670][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.056958][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.057181][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.059792][T14859] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11758'. [ 1373.084807][T14861] batman_adv: batadv0: Adding interface: syzkaller0 [ 1373.084825][T14861] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1373.084855][T14861] batman_adv: batadv0: Interface activated: syzkaller0 [ 1373.125788][T14869] netlink: 40 bytes leftover after parsing attributes in process `syz.2.11761'. [ 1373.154821][T14860] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 1373.244397][T14860] batman_adv: batadv0: Removing interface: syzkaller0 [ 1373.399595][T14873] netlink: 'syz.0.11763': attribute type 1 has an invalid length. [ 1373.511346][T14873] bond2: option mode: invalid value (7) [ 1373.513457][T14910] block nbd0: Unsupported socket: should be TCP or UNIX. [ 1373.519471][T14873] bond2 (unregistering): Released all slaves [ 1373.608595][T14913] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11765'. [ 1374.027968][T14913] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1374.118249][T14913] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1374.304116][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1376.787888][T14892] net_ratelimit: 8 callbacks suppressed [ 1376.787911][T14892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1376.885369][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1377.201747][T14930] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1377.246038][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1377.359233][T14947] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1377.415293][T14953] __nla_validate_parse: 1 callbacks suppressed [ 1377.415308][T14953] netlink: 68 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.459139][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.462771][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.463082][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.463275][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.463436][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11776'. [ 1377.516872][T14892] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.517051][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1377.643015][T14960] syzkaller0: entered promiscuous mode [ 1377.643040][T14960] syzkaller0: entered allmulticast mode [ 1377.650077][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1377.671114][T14960] tipc: Enabled bearer , priority 0 [ 1377.693298][T14962] syzkaller0: entered promiscuous mode [ 1377.693321][T14962] syzkaller0: entered allmulticast mode [ 1377.707786][T14960] syzkaller0: mtu greater than device maximum [ 1377.716502][T14958] tipc: Resetting bearer [ 1377.735966][T14967] netlink: 'syz.2.11782': attribute type 15 has an invalid length. [ 1377.735987][T14967] netlink: 666 bytes leftover after parsing attributes in process `syz.2.11782'. [ 1377.775146][T14958] tipc: Disabling bearer [ 1377.806171][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1377.928790][T14974] FAULT_INJECTION: forcing a failure. [ 1377.928790][T14974] name failslab, interval 1, probability 0, space 0, times 0 [ 1377.928822][T14974] CPU: 0 UID: 0 PID: 14974 Comm: syz.4.11785 Not tainted syzkaller #0 PREEMPT(full) [ 1377.928844][T14974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1377.928856][T14974] Call Trace: [ 1377.928864][T14974] [ 1377.928873][T14974] dump_stack_lvl+0xe8/0x150 [ 1377.928907][T14974] should_fail_ex+0x410/0x560 [ 1377.928946][T14974] should_failslab+0xa8/0x100 [ 1377.928972][T14974] __kmalloc_node_noprof+0x100/0x720 [ 1377.928991][T14974] ? __get_vm_area_node+0x200/0x2f0 [ 1377.929017][T14974] ? __get_vm_area_node+0x283/0x2f0 [ 1377.929041][T14974] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1377.929068][T14974] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1377.929103][T14974] __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1377.929146][T14974] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 1377.929184][T14974] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1377.929214][T14974] ? apparmor_capable+0x126/0x170 [ 1377.929247][T14974] ? bpf_lsm_capable+0x9/0x20 [ 1377.929265][T14974] ? security_capable+0x7e/0x2c0 [ 1377.929289][T14974] ? bpf_check+0x10ee/0x2e10 [ 1377.929309][T14974] __vmalloc_noprof+0xd2/0x120 [ 1377.929336][T14974] ? bpf_check+0x10ee/0x2e10 [ 1377.929359][T14974] bpf_check+0x10ee/0x2e10 [ 1377.929392][T14974] ? ktime_get_with_offset+0x93/0x2d0 [ 1377.929416][T14974] ? __pfx_bpf_check+0x10/0x10 [ 1377.929440][T14974] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1377.929470][T14974] bpf_prog_load+0x14d6/0x1c20 [ 1377.929505][T14974] ? __pfx_bpf_prog_load+0x10/0x10 [ 1377.929553][T14974] __sys_bpf+0xd0d/0xd90 [ 1377.929582][T14974] ? __pfx___sys_bpf+0x10/0x10 [ 1377.929615][T14974] ? __fget_files+0x2a/0x420 [ 1377.929658][T14974] ? ksys_write+0x242/0x270 [ 1377.929689][T14974] ? __pfx_ksys_write+0x10/0x10 [ 1377.929722][T14974] __x64_sys_bpf+0xba/0xd0 [ 1377.929744][T14974] do_syscall_64+0x166/0x520 [ 1377.929765][T14974] ? trace_irq_disable+0x3b/0x140 [ 1377.929785][T14974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1377.929805][T14974] ? clear_bhb_loop+0x70/0xc0 [ 1377.929829][T14974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1377.929849][T14974] RIP: 0033:0x7f0bfab9e159 [ 1377.929868][T14974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1377.929885][T14974] RSP: 002b:00007f0bfba76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1377.929908][T14974] RAX: ffffffffffffffda RBX: 00007f0bfae25fa0 RCX: 00007f0bfab9e159 [ 1377.929923][T14974] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 1377.929942][T14974] RBP: 00007f0bfba76090 R08: 0000000000000000 R09: 0000000000000000 [ 1377.929955][T14974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1377.929967][T14974] R13: 00007f0bfae26038 R14: 00007f0bfae25fa0 R15: 00007ffd6e6d4ae8 [ 1377.929999][T14974] [ 1377.931197][T14974] warn_alloc: 1 callbacks suppressed [ 1377.931211][T14974] syz.4.11785: vmalloc error: size 4096, failed to allocated page array size 8, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1377.931269][T14974] CPU: 0 UID: 0 PID: 14974 Comm: syz.4.11785 Not tainted syzkaller #0 PREEMPT(full) [ 1377.931292][T14974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1377.931303][T14974] Call Trace: [ 1377.931311][T14974] [ 1377.931320][T14974] dump_stack_lvl+0xe8/0x150 [ 1377.931351][T14974] warn_alloc+0x24d/0x270 [ 1377.931376][T14974] ? __pfx_warn_alloc+0x10/0x10 [ 1377.931401][T14974] ? __kmalloc_node_noprof+0x4d7/0x720 [ 1377.931420][T14974] ? __get_vm_area_node+0x200/0x2f0 [ 1377.931445][T14974] ? __get_vm_area_node+0x283/0x2f0 [ 1377.931469][T14974] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1377.931496][T14974] ? __vmalloc_node_range_noprof+0x5b4/0x1540 [ 1377.931531][T14974] __vmalloc_node_range_noprof+0x969/0x1540 [ 1377.931575][T14974] ? lruvec_stat_mod_folio+0x6e/0x3e0 [ 1377.931612][T14974] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1377.931642][T14974] ? apparmor_capable+0x126/0x170 [ 1377.931676][T14974] ? bpf_lsm_capable+0x9/0x20 [ 1377.931694][T14974] ? security_capable+0x7e/0x2c0 [ 1377.931718][T14974] ? bpf_check+0x10ee/0x2e10 [ 1377.931737][T14974] __vmalloc_noprof+0xd2/0x120 [ 1377.931764][T14974] ? bpf_check+0x10ee/0x2e10 [ 1377.931788][T14974] bpf_check+0x10ee/0x2e10 [ 1377.931820][T14974] ? ktime_get_with_offset+0x93/0x2d0 [ 1377.931844][T14974] ? __pfx_bpf_check+0x10/0x10 [ 1377.931867][T14974] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1377.931894][T14974] bpf_prog_load+0x14d6/0x1c20 [ 1377.931935][T14974] ? __pfx_bpf_prog_load+0x10/0x10 [ 1377.931987][T14974] __sys_bpf+0xd0d/0xd90 [ 1377.932017][T14974] ? __pfx___sys_bpf+0x10/0x10 [ 1377.932051][T14974] ? __fget_files+0x2a/0x420 [ 1377.932093][T14974] ? ksys_write+0x242/0x270 [ 1377.932127][T14974] ? __pfx_ksys_write+0x10/0x10 [ 1377.932160][T14974] __x64_sys_bpf+0xba/0xd0 [ 1377.932183][T14974] do_syscall_64+0x166/0x520 [ 1377.932204][T14974] ? trace_irq_disable+0x3b/0x140 [ 1377.932224][T14974] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1377.932243][T14974] ? clear_bhb_loop+0x70/0xc0 [ 1377.932272][T14974] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1377.932295][T14974] RIP: 0033:0x7f0bfab9e159 [ 1377.932313][T14974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1377.932330][T14974] RSP: 002b:00007f0bfba76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1377.932354][T14974] RAX: ffffffffffffffda RBX: 00007f0bfae25fa0 RCX: 00007f0bfab9e159 [ 1377.932368][T14974] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 1377.932382][T14974] RBP: 00007f0bfba76090 R08: 0000000000000000 R09: 0000000000000000 [ 1377.932395][T14974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1377.932407][T14974] R13: 00007f0bfae26038 R14: 00007f0bfae25fa0 R15: 00007ffd6e6d4ae8 [ 1377.932437][T14974] [ 1377.933660][T14974] Mem-Info: [ 1377.933671][T14974] active_anon:27362 inactive_anon:9425 isolated_anon:0 [ 1377.933671][T14974] active_file:473 inactive_file:43817 isolated_file:0 [ 1377.933671][T14974] unevictable:0 dirty:198 writeback:0 [ 1377.933671][T14974] slab_reclaimable:16370 slab_unreclaimable:171309 [ 1377.933671][T14974] mapped:30051 shmem:609 pagetables:1261 [ 1377.933671][T14974] sec_pagetables:0 bounce:0 [ 1377.933671][T14974] kernel_misc_reclaimable:0 [ 1377.933671][T14974] free:1076443 free_pcp:12980 free_cma:0 [ 1377.933724][T14974] Node 0 active_anon:109448kB inactive_anon:37700kB active_file:1892kB inactive_file:175068kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:120204kB dirty:792kB writeback:0kB shmem:2436kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:25024kB pagetables:4892kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1377.933798][T14974] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1377.933850][T14974] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1377.938188][T14974] lowmem_reserve[]: 0 2486 2486 2486 2486 [ 1377.938227][T14974] Node 0 DMA32 free:347824kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:109448kB inactive_anon:37700kB active_file:1892kB inactive_file:175068kB unevictable:0kB writepending:792kB zspages:0kB present:3129332kB managed:2546620kB mlocked:0kB bounce:0kB free_pcp:51916kB local_pcp:29660kB free_cma:0kB [ 1377.938296][T14974] lowmem_reserve[]: 0 0 0 0 0 [ 1377.938327][T14974] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1377.938378][T14974] lowmem_reserve[]: 0 0 0 0 0 [ 1377.938411][T14974] Node 1 Normal free:3942588kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1377.938464][T14974] lowmem_reserve[]: 0 0 0 0 0 [ 1377.938496][T14974] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1377.938601][T14974] Node 0 DMA32: 1095*4kB (UME) 638*8kB (UME) 110*16kB (UME) 172*32kB (UM) 150*64kB (UME) 114*128kB (UM) 47*256kB (UM) 22*512kB (UM) 11*1024kB (UM) 11*2048kB (UME) 61*4096kB (UM) = 347884kB [ 1377.938745][T14974] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1377.939994][T14974] Node 1 Normal: 3*4kB (UM) 4*8kB (UM) 3*16kB (UM) 11*32kB (UM) 10*64kB (UM) 9*128kB (UM) 6*256kB (UM) 5*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (UM) = 3942588kB [ 1377.940138][T14974] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1377.940154][T14974] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1377.940168][T14974] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1377.940184][T14974] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1377.940199][T14974] 44895 total pagecache pages [ 1377.940207][T14974] 0 pages in swap cache [ 1377.940214][T14974] Free swap = 124996kB [ 1377.940221][T14974] Total swap = 124996kB [ 1377.940229][T14974] 2097051 pages RAM [ 1377.940236][T14974] 0 pages HighMem/MovableOnly [ 1377.940243][T14974] 428780 pages reserved [ 1377.940250][T14974] 0 pages cma reserved [ 1378.287132][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1378.452461][T14991] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11793'. [ 1379.166305][T15014] netlink: 64 bytes leftover after parsing attributes in process `syz.2.11799'. [ 1379.175575][T15014] syzkaller1: entered promiscuous mode [ 1379.175594][T15014] syzkaller1: entered allmulticast mode [ 1379.179322][T15014] xt_LOG: prefix is not null-terminated [ 1379.220503][T15016] netlink: 'syz.0.11800': attribute type 16 has an invalid length. [ 1379.220527][T15016] netlink: 'syz.0.11800': attribute type 3 has an invalid length. [ 1379.220540][T15016] netlink: 64066 bytes leftover after parsing attributes in process `syz.0.11800'. [ 1379.416254][T15021] sch_tbf: burst 7 is lower than device bridge0 mtu (226) ! [ 1379.428716][T15021] sch_tbf: burst 7 is lower than device bridge0 mtu (226) ! [ 1379.598930][T15029] netlink: 'syz.1.11805': attribute type 15 has an invalid length. [ 1379.718708][T15036] block nbd0: Unsupported socket: should be TCP or UNIX. [ 1379.745320][T15036] bridge5: entered promiscuous mode [ 1379.803137][T15041] netlink: 'syz.3.11808': attribute type 11 has an invalid length. [ 1380.153637][T15052] IPVS: persistence engine module ip_vs_pe_ not found [ 1382.635320][T24391] net_ratelimit: 9 callbacks suppressed [ 1382.635341][T24391] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1382.796484][ T9] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1382.797578][T15046] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 1382.819677][T15050] __nla_validate_parse: 5 callbacks suppressed [ 1382.819695][T15050] netlink: 830 bytes leftover after parsing attributes in process `syz.3.11814'. [ 1382.853318][T15057] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11815'. [ 1382.877414][T15059] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1382.898968][T15059] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1382.946532][ T9] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 1382.957226][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1383.024533][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.024689][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.024819][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.025143][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.025268][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.025396][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.027482][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.027629][T15064] Dead loop on virtual device lo (net 1385), fix it urgently! [ 1383.102813][T15069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11817'. [ 1383.242416][T15078] netlink: 'syz.1.11822': attribute type 1 has an invalid length. [ 1383.242439][T15078] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11822'. [ 1383.245182][T15071] syzkaller0: entered promiscuous mode [ 1383.245200][T15071] syzkaller0: entered allmulticast mode [ 1383.259742][T15071] tipc: Enabled bearer , priority 0 [ 1383.267443][T15071] tipc: Resetting bearer [ 1383.330268][T15080] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1383.358803][T15071] tipc: Resetting bearer [ 1383.395513][T15071] tipc: Disabling bearer [ 1383.401997][T15084] netlink: 'syz.1.11825': attribute type 15 has an invalid length. [ 1383.402011][T15084] netlink: 666 bytes leftover after parsing attributes in process `syz.1.11825'. [ 1383.419333][ T9664] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1383.420794][T15080] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 1383.449975][ T9664] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 1384.203609][T15094] IPVS: persistence engine module ip_vs_pe_ not found [ 1386.495238][T15093] netlink: 830 bytes leftover after parsing attributes in process `syz.2.11828'. [ 1386.613032][T15108] FAULT_INJECTION: forcing a failure. [ 1386.613032][T15108] name failslab, interval 1, probability 0, space 0, times 0 [ 1386.613066][T15108] CPU: 1 UID: 0 PID: 15108 Comm: syz.3.11832 Not tainted syzkaller #0 PREEMPT(full) [ 1386.613110][T15108] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1386.613122][T15108] Call Trace: [ 1386.613130][T15108] [ 1386.613138][T15108] dump_stack_lvl+0xe8/0x150 [ 1386.613172][T15108] should_fail_ex+0x410/0x560 [ 1386.613200][T15108] should_failslab+0xa8/0x100 [ 1386.613227][T15108] __kvmalloc_node_noprof+0x176/0x820 [ 1386.613251][T15108] ? __kvmalloc_node_noprof+0x345/0x820 [ 1386.613271][T15108] ? sort_subprogs_topo+0xf5/0xf20 [ 1386.613293][T15108] ? sort_subprogs_topo+0xf5/0xf20 [ 1386.613321][T15108] sort_subprogs_topo+0xf5/0xf20 [ 1386.613343][T15108] ? bpf_prune_dead_branches+0xa3b/0xab0 [ 1386.613383][T15108] bpf_check+0x25a5/0x2e10 [ 1386.613412][T15108] ? ktime_get_with_offset+0x93/0x2d0 [ 1386.613435][T15108] ? __pfx_bpf_check+0x10/0x10 [ 1386.613462][T15108] ? bpf_obj_name_cpy+0x194/0x1e0 [ 1386.613493][T15108] bpf_prog_load+0x14d6/0x1c20 [ 1386.613526][T15108] ? __pfx_bpf_prog_load+0x10/0x10 [ 1386.613573][T15108] __sys_bpf+0xd0d/0xd90 [ 1386.613602][T15108] ? __pfx___sys_bpf+0x10/0x10 [ 1386.613635][T15108] ? __fget_files+0x2a/0x420 [ 1386.613678][T15108] ? ksys_write+0x242/0x270 [ 1386.613709][T15108] ? __pfx_ksys_write+0x10/0x10 [ 1386.613743][T15108] __x64_sys_bpf+0xba/0xd0 [ 1386.613765][T15108] do_syscall_64+0x166/0x520 [ 1386.613806][T15108] ? trace_irq_disable+0x3b/0x140 [ 1386.613826][T15108] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1386.613847][T15108] ? clear_bhb_loop+0x70/0xc0 [ 1386.613869][T15108] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1386.613893][T15108] RIP: 0033:0x7f3c8a79e159 [ 1386.613911][T15108] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1386.613927][T15108] RSP: 002b:00007f3c8b5cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1386.613947][T15108] RAX: ffffffffffffffda RBX: 00007f3c8aa25fa0 RCX: 00007f3c8a79e159 [ 1386.613961][T15108] RDX: 0000000000000094 RSI: 0000200000000200 RDI: 0000000000000005 [ 1386.613974][T15108] RBP: 00007f3c8b5cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1386.613986][T15108] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1386.613998][T15108] R13: 00007f3c8aa26038 R14: 00007f3c8aa25fa0 R15: 00007ffcfeedb258 [ 1386.614029][T15108] [ 1386.682299][T15110] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11833'. [ 1386.848621][T15116] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11835'. [ 1386.859204][T15116] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11835'. [ 1386.987215][T15112] netlink: 'syz.4.11834': attribute type 1 has an invalid length. [ 1386.987237][T15112] netlink: 224 bytes leftover after parsing attributes in process `syz.4.11834'. [ 1387.033744][T15125] syz_tun: entered allmulticast mode [ 1387.385445][T15136] netlink: 'syz.1.11842': attribute type 14 has an invalid length. [ 1387.645662][T14882] net_ratelimit: 62 callbacks suppressed [ 1387.645684][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1387.755779][T24391] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1387.866624][ T9664] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1387.867365][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1388.077069][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1388.116171][T15168] netlink: 'syz.1.11849': attribute type 1 has an invalid length. [ 1388.154515][T15172] __nla_validate_parse: 2 callbacks suppressed [ 1388.154537][T15172] netlink: 32 bytes leftover after parsing attributes in process `syz.3.11851'. [ 1388.315310][T24391] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.315517][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1388.720399][ T9664] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1390.309896][T14882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1391.145434][T15169] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1391.197681][T15168] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 1391.198674][T15173] erspan0: entered promiscuous mode [ 1391.198768][T15173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11850'. [ 1391.199101][T15177] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11850'. [ 1391.284111][T14898] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1391.300764][T15192] netlink: Invalid conntrack helper [ 1391.300793][T15192] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1391.415520][T14898] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1391.822398][T15220] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11862'. [ 1391.822425][T15220] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11862'. [ 1392.127327][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1392.137382][T15230] tipc: Enabled bearer , priority 1 [ 1392.152652][T15229] tipc: Resetting bearer [ 1392.218402][T15229] tipc: Disabling bearer [ 1392.306768][T15245] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11870'. [ 1392.707745][T15266] netlink: 'syz.4.11879': attribute type 21 has an invalid length. [ 1392.707766][T15266] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11879'. [ 1392.710609][T15266] bond0: option lacp_rate: mode dependency failed, not supported in mode balance-rr(0) [ 1392.734572][T24391] net_ratelimit: 14 callbacks suppressed [ 1392.734593][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1392.788970][T24391] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1392.834948][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1392.945712][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.045979][T15279] netlink: 48 bytes leftover after parsing attributes in process `syz.2.11884'. [ 1393.054093][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.093498][T15280] netlink: 'syz.4.11882': attribute type 8 has an invalid length. [ 1393.104937][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1393.164416][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.274319][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.384364][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.510362][T15270] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11881'. [ 1393.515194][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.627602][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1393.680808][T15294] netlink: 'syz.2.11888': attribute type 1 has an invalid length. [ 1393.779882][T15294] bond1: option mode: invalid value (7) [ 1393.800107][T15294] bond1 (unregistering): Released all slaves [ 1393.868597][T15298] : renamed from dummy0 [ 1393.981766][T15302] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11890'. [ 1394.047978][T15304] xt_hashlimit: overflow, try lower: 18446744073709551614/255 [ 1394.179546][T15308] netlink: 'syz.3.11892': attribute type 14 has an invalid length. [ 1394.180746][T15308] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11892'. [ 1397.519558][T15351] FAULT_INJECTION: forcing a failure. [ 1397.519558][T15351] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1397.522894][T15351] CPU: 1 UID: 0 PID: 15351 Comm: syz.4.11901 Not tainted syzkaller #0 PREEMPT(full) [ 1397.522918][T15351] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1397.522930][T15351] Call Trace: [ 1397.522938][T15351] [ 1397.522947][T15351] dump_stack_lvl+0xe8/0x150 [ 1397.522979][T15351] should_fail_ex+0x410/0x560 [ 1397.523007][T15351] _copy_from_user+0x2d/0xb0 [ 1397.523031][T15351] kstrtouint_from_user+0xd6/0x180 [ 1397.523055][T15351] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1397.523084][T15351] ? lock_acquire+0x115/0x350 [ 1397.523109][T15351] proc_fail_nth_write+0x8e/0x210 [ 1397.523131][T15351] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1397.523168][T15351] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1397.523197][T15351] vfs_write+0x296/0xba0 [ 1397.523234][T15351] ? __pfx_vfs_write+0x10/0x10 [ 1397.523264][T15351] ? __fget_files+0x2a/0x420 [ 1397.523295][T15351] ? __fget_files+0x3a2/0x420 [ 1397.523319][T15351] ? __fget_files+0x2a/0x420 [ 1397.523353][T15351] ksys_write+0x150/0x270 [ 1397.523387][T15351] ? __pfx_ksys_write+0x10/0x10 [ 1397.523426][T15351] do_syscall_64+0x166/0x520 [ 1397.523448][T15351] ? trace_irq_disable+0x3b/0x140 [ 1397.523467][T15351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.523488][T15351] ? clear_bhb_loop+0x70/0xc0 [ 1397.523512][T15351] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1397.523539][T15351] RIP: 0033:0x7f0bfab5e98e [ 1397.523557][T15351] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1397.523574][T15351] RSP: 002b:00007f0bfba54fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1397.523595][T15351] RAX: ffffffffffffffda RBX: 00007f0bfba556c0 RCX: 00007f0bfab5e98e [ 1397.523611][T15351] RDX: 0000000000000001 RSI: 00007f0bfba550a0 RDI: 0000000000000007 [ 1397.523623][T15351] RBP: 00007f0bfba55090 R08: 0000000000000000 R09: 0000000000000000 [ 1397.523636][T15351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1397.523648][T15351] R13: 00007f0bfae26128 R14: 00007f0bfae26090 R15: 00007ffd6e6d4ae8 [ 1397.523680][T15351] [ 1397.799313][T15357] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11904'. [ 1397.834012][T14878] net_ratelimit: 13 callbacks suppressed [ 1397.834033][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1397.842441][T14878] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1397.842463][T14878] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1397.944063][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.040055][T15370] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11903'. [ 1398.054851][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.063071][T15368] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11907'. [ 1398.075562][T15366] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1398.105560][T15376] xt_l2tp: invalid flags combination: 8 [ 1398.147312][T15377] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1398.150217][T15371] netlink: 'syz.0.11908': attribute type 14 has an invalid length. [ 1398.174401][T14898] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.195697][T15371] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11908'. [ 1398.328583][T14898] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.441112][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.463108][T15383] netlink: 'syz.0.11910': attribute type 2 has an invalid length. [ 1398.466701][T15383] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11910'. [ 1398.532347][T15389] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11910'. [ 1398.670597][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1398.685200][T14878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1398.704908][T15392] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11910'. [ 1398.712463][T15383] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11910'. [ 1398.829379][T15396] FAULT_INJECTION: forcing a failure. [ 1398.829379][T15396] name failslab, interval 1, probability 0, space 0, times 0 [ 1398.829412][T15396] CPU: 1 UID: 0 PID: 15396 Comm: syz.0.11915 Not tainted syzkaller #0 PREEMPT(full) [ 1398.829434][T15396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1398.829446][T15396] Call Trace: [ 1398.829453][T15396] [ 1398.829461][T15396] dump_stack_lvl+0xe8/0x150 [ 1398.829494][T15396] should_fail_ex+0x410/0x560 [ 1398.829519][T15396] should_failslab+0xa8/0x100 [ 1398.829545][T15396] __kmalloc_noprof+0xfe/0x720 [ 1398.829564][T15396] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1398.829586][T15396] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1398.829614][T15396] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1398.829644][T15396] genl_family_rcv_msg_doit+0xda/0x340 [ 1398.829672][T15396] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1398.829700][T15396] ? apparmor_capable+0x126/0x170 [ 1398.829730][T15396] ? bpf_lsm_capable+0x9/0x20 [ 1398.829746][T15396] ? security_capable+0x7e/0x2c0 [ 1398.829773][T15396] genl_rcv_msg+0x614/0x7a0 [ 1398.829800][T15396] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1398.829819][T15396] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1398.829842][T15396] ? __pfx_nl80211_remain_on_channel+0x10/0x10 [ 1398.829861][T15396] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1398.829898][T15396] netlink_rcv_skb+0x226/0x4a0 [ 1398.829925][T15396] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1398.829946][T15396] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1398.829986][T15396] ? down_read+0x2be/0x330 [ 1398.830021][T15396] genl_rcv+0x28/0x40 [ 1398.830043][T15396] netlink_unicast+0x7bd/0x940 [ 1398.830077][T15396] netlink_sendmsg+0x813/0xb40 [ 1398.830113][T15396] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1398.830147][T15396] ? apparmor_socket_sendmsg+0x98/0x360 [ 1398.830171][T15396] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1398.830196][T15396] sock_sendmsg_nosec+0x13a/0x180 [ 1398.830228][T15396] ____sys_sendmsg+0x54e/0x850 [ 1398.830256][T15396] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1398.830289][T15396] ? import_iovec+0x73/0xa0 [ 1398.830317][T15396] ___sys_sendmsg+0x2a5/0x360 [ 1398.830340][T15396] ? __lock_acquire+0x747/0x2de0 [ 1398.830364][T15396] ? __pfx____sys_sendmsg+0x10/0x10 [ 1398.830421][T15396] ? __fget_files+0x2a/0x420 [ 1398.830445][T15396] ? __fget_files+0x3a2/0x420 [ 1398.830480][T15396] __x64_sys_sendmsg+0x1b1/0x290 [ 1398.830506][T15396] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1398.830552][T15396] do_syscall_64+0x166/0x520 [ 1398.830570][T15396] ? trace_irq_disable+0x3b/0x140 [ 1398.830589][T15396] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.830609][T15396] ? clear_bhb_loop+0x70/0xc0 [ 1398.830632][T15396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1398.830650][T15396] RIP: 0033:0x7f3d0b79e159 [ 1398.830668][T15396] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1398.830685][T15396] RSP: 002b:00007f3d0c5c9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1398.830707][T15396] RAX: ffffffffffffffda RBX: 00007f3d0ba25fa0 RCX: 00007f3d0b79e159 [ 1398.830721][T15396] RDX: 0000000004000084 RSI: 0000200000000400 RDI: 0000000000000003 [ 1398.830734][T15396] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1398.830746][T15396] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1398.830758][T15396] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1398.830790][T15396] [ 1398.894237][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1399.183428][T15409] netlink: 'syz.1.11919': attribute type 2 has an invalid length. [ 1399.338731][T15413] tipc: Enabled bearer , priority 0 [ 1399.409552][T15421] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11922'. [ 1399.414793][T15407] tipc: Resetting bearer [ 1399.516772][T15407] tipc: Disabling bearer [ 1399.685475][T15433] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11926'. [ 1399.696228][T15433] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1399.721370][T15430] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1399.728536][T15430] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1399.771902][T15436] netlink: 104 bytes leftover after parsing attributes in process `syz.4.11929'. [ 1399.802560][T15438] FAULT_INJECTION: forcing a failure. [ 1399.802560][T15438] name failslab, interval 1, probability 0, space 0, times 0 [ 1399.802593][T15438] CPU: 0 UID: 0 PID: 15438 Comm: syz.1.11930 Not tainted syzkaller #0 PREEMPT(full) [ 1399.802615][T15438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1399.802627][T15438] Call Trace: [ 1399.802635][T15438] [ 1399.802644][T15438] dump_stack_lvl+0xe8/0x150 [ 1399.802677][T15438] should_fail_ex+0x410/0x560 [ 1399.802705][T15438] should_failslab+0xa8/0x100 [ 1399.802730][T15438] __kmalloc_noprof+0xfe/0x720 [ 1399.802750][T15438] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1399.802774][T15438] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1399.802804][T15438] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 1399.802835][T15438] genl_family_rcv_msg_doit+0xda/0x340 [ 1399.802864][T15438] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1399.802902][T15438] ? apparmor_capable+0x126/0x170 [ 1399.802932][T15438] ? bpf_lsm_capable+0x9/0x20 [ 1399.802949][T15438] ? security_capable+0x7e/0x2c0 [ 1399.802978][T15438] genl_rcv_msg+0x614/0x7a0 [ 1399.803009][T15438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1399.803029][T15438] ? __pfx_batadv_pre_doit+0x10/0x10 [ 1399.803152][T15438] ? __pfx_batadv_netlink_set_mesh+0x10/0x10 [ 1399.803177][T15438] ? __pfx_batadv_post_doit+0x10/0x10 [ 1399.803218][T15438] netlink_rcv_skb+0x226/0x4a0 [ 1399.803246][T15438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1399.803269][T15438] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1399.803310][T15438] ? down_read+0x2be/0x330 [ 1399.803336][T15438] genl_rcv+0x28/0x40 [ 1399.803354][T15438] netlink_unicast+0x7bd/0x940 [ 1399.803387][T15438] netlink_sendmsg+0x813/0xb40 [ 1399.803421][T15438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1399.803454][T15438] ? apparmor_socket_sendmsg+0x98/0x360 [ 1399.803477][T15438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1399.803501][T15438] sock_sendmsg_nosec+0x13a/0x180 [ 1399.803529][T15438] ____sys_sendmsg+0x54e/0x850 [ 1399.803556][T15438] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1399.803589][T15438] ? import_iovec+0x73/0xa0 [ 1399.803616][T15438] ___sys_sendmsg+0x2a5/0x360 [ 1399.803638][T15438] ? __lock_acquire+0x747/0x2de0 [ 1399.803662][T15438] ? __pfx____sys_sendmsg+0x10/0x10 [ 1399.803721][T15438] ? __fget_files+0x2a/0x420 [ 1399.803745][T15438] ? __fget_files+0x3a2/0x420 [ 1399.803780][T15438] __x64_sys_sendmsg+0x1b1/0x290 [ 1399.803807][T15438] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1399.803852][T15438] do_syscall_64+0x166/0x520 [ 1399.803872][T15438] ? trace_irq_disable+0x3b/0x140 [ 1399.803900][T15438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.803920][T15438] ? clear_bhb_loop+0x70/0xc0 [ 1399.803943][T15438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1399.803963][T15438] RIP: 0033:0x7f0ebff9e159 [ 1399.803980][T15438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1399.803997][T15438] RSP: 002b:00007f0ec0e00028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1399.804018][T15438] RAX: ffffffffffffffda RBX: 00007f0ec0225fa0 RCX: 00007f0ebff9e159 [ 1399.804032][T15438] RDX: 00000000000480d8 RSI: 0000200000000540 RDI: 0000000000000003 [ 1399.804044][T15438] RBP: 00007f0ec0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 1399.804056][T15438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1399.804067][T15438] R13: 00007f0ec0226038 R14: 00007f0ec0225fa0 R15: 00007ffe22f72348 [ 1399.804095][T15438] [ 1400.218153][T15450] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11934'. [ 1400.235770][T15445] xt_connbytes: Forcing CT accounting to be enabled [ 1400.366902][T15455] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11936'. [ 1400.366931][T15455] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11936'. [ 1400.591003][T15465] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11939'. [ 1400.686590][T15473] FAULT_INJECTION: forcing a failure. [ 1400.686590][T15473] name failslab, interval 1, probability 0, space 0, times 0 [ 1400.686621][T15473] CPU: 1 UID: 0 PID: 15473 Comm: syz.1.11943 Not tainted syzkaller #0 PREEMPT(full) [ 1400.686643][T15473] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1400.686653][T15473] Call Trace: [ 1400.686661][T15473] [ 1400.686670][T15473] dump_stack_lvl+0xe8/0x150 [ 1400.686702][T15473] should_fail_ex+0x410/0x560 [ 1400.686730][T15473] should_failslab+0xa8/0x100 [ 1400.686757][T15473] __kmalloc_noprof+0xfe/0x720 [ 1400.686776][T15473] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1400.686794][T15473] ? nsim_fib_event_nb+0x283/0x11d0 [ 1400.686823][T15473] ? nsim_fib_event_nb+0x283/0x11d0 [ 1400.686868][T15473] nsim_fib_event_nb+0x283/0x11d0 [ 1400.686902][T15473] ? lock_acquire+0x115/0x350 [ 1400.686929][T15473] notifier_call_chain+0x1a5/0x3d0 [ 1400.686963][T15473] ? atomic_notifier_call_chain+0x26/0x180 [ 1400.686994][T15473] atomic_notifier_call_chain+0xda/0x180 [ 1400.687025][T15473] call_fib_notifiers+0x31/0x60 [ 1400.687053][T15473] fib6_del+0xf72/0x15a0 [ 1400.687077][T15473] ? fib6_del+0x1171/0x15a0 [ 1400.687115][T15473] ? __pfx_fib6_del+0x10/0x10 [ 1400.687135][T15473] ? do_raw_spin_lock+0x12b/0x2f0 [ 1400.687178][T15473] __ip6_del_rt_siblings+0x513/0x7d0 [ 1400.687211][T15473] ip6_route_del+0x1051/0x1100 [ 1400.687242][T15473] ? ip6_route_del+0xe2/0x1100 [ 1400.687264][T15473] ? __pfx_ip6_route_del+0x10/0x10 [ 1400.687285][T15473] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1400.687309][T15473] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1400.687329][T15473] ? l3mdev_fib_table_by_index+0x34/0x2d0 [ 1400.687357][T15473] ipv6_route_ioctl+0x375/0x4e0 [ 1400.687386][T15473] ? __pfx_ipv6_route_ioctl+0x10/0x10 [ 1400.687439][T15473] inet6_ioctl+0x246/0x2e0 [ 1400.687468][T15473] ? __pfx_inet6_ioctl+0x10/0x10 [ 1400.687492][T15473] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1400.687523][T15473] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1400.687552][T15473] sock_do_ioctl+0x101/0x320 [ 1400.687584][T15473] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1400.687609][T15473] ? hook_file_ioctl+0x1f2/0x600 [ 1400.687647][T15473] sock_ioctl+0x57a/0x7e0 [ 1400.687677][T15473] ? __pfx_sock_ioctl+0x10/0x10 [ 1400.687705][T15473] ? __fget_files+0x2a/0x420 [ 1400.687731][T15473] ? __fget_files+0x3a2/0x420 [ 1400.687755][T15473] ? __fget_files+0x2a/0x420 [ 1400.687783][T15473] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1400.687810][T15473] ? __pfx_sock_ioctl+0x10/0x10 [ 1400.687843][T15473] __se_sys_ioctl+0xfc/0x170 [ 1400.687866][T15473] do_syscall_64+0x166/0x520 [ 1400.687888][T15473] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.687908][T15473] ? clear_bhb_loop+0x70/0xc0 [ 1400.687932][T15473] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1400.687951][T15473] RIP: 0033:0x7f0ebff9e159 [ 1400.687970][T15473] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1400.687987][T15473] RSP: 002b:00007f0ec0e00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1400.688008][T15473] RAX: ffffffffffffffda RBX: 00007f0ec0225fa0 RCX: 00007f0ebff9e159 [ 1400.688022][T15473] RDX: 0000200000000000 RSI: 000000000000890c RDI: 0000000000000003 [ 1400.688036][T15473] RBP: 00007f0ec0e00090 R08: 0000000000000000 R09: 0000000000000000 [ 1400.688048][T15473] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1400.688060][T15473] R13: 00007f0ec0226038 R14: 00007f0ec0225fa0 R15: 00007ffe22f72348 [ 1400.688093][T15473] [ 1400.789388][T15472] syzkaller1: entered promiscuous mode [ 1400.789409][T15472] syzkaller1: entered allmulticast mode [ 1401.363082][T15477] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 1401.662957][T15508] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1401.690594][T15510] block nbd97: Unsupported socket: should be TCP or UNIX. [ 1401.793519][T15510] ip6gretap2: entered allmulticast mode [ 1401.808159][T15510] batman_adv: batadv0: Adding interface: ip6gretap2 [ 1401.808176][T15510] batman_adv: batadv0: The MTU of interface ip6gretap2 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1401.808509][T15510] batman_adv: batadv0: Interface activated: ip6gretap2 [ 1401.865148][T15515] netlink: 'syz.4.11956': attribute type 15 has an invalid length. [ 1402.139910][T15524] nbd: must specify a size in bytes for the device [ 1402.220547][T15527] netlink: 'syz.1.11959': attribute type 1 has an invalid length. [ 1402.235352][ T7870] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1402.286382][T15527] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1402.311894][T24389] IPVS: starting estimator thread 0... [ 1402.366399][T15531] bond4: (slave veth5): Enslaving as an active interface with a down link [ 1402.404194][T15534] IPVS: using max 32 ests per chain, 76800 per kthread [ 1402.466409][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1402.747312][T15553] bridge_slave_0: left allmulticast mode [ 1402.747330][T15553] bridge_slave_0: left promiscuous mode [ 1402.749687][T15553] bridge0: port 1(bridge_slave_0) entered disabled state [ 1402.776451][T15553] bridge_slave_1: left allmulticast mode [ 1402.776472][T15553] bridge_slave_1: left promiscuous mode [ 1402.776647][T15553] bridge0: port 2(bridge_slave_1) entered disabled state [ 1402.806902][T15553] bond0: (slave bond_slave_0): Releasing backup interface [ 1402.813454][T15553] bond0: (slave bond_slave_1): Releasing backup interface [ 1402.839894][T15553] team0: Port device team_slave_0 removed [ 1402.842859][T15553] team0: Port device team_slave_1 removed [ 1402.843580][T15553] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1402.843593][T15553] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1402.856135][T15553] net_ratelimit: 27 callbacks suppressed [ 1402.856150][T15553] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1402.955920][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.064213][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.174086][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.284354][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.394081][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.544910][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.570105][T15585] FAULT_INJECTION: forcing a failure. [ 1403.570105][T15585] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1403.570126][T15585] CPU: 1 UID: 0 PID: 15585 Comm: syz.3.11976 Not tainted syzkaller #0 PREEMPT(full) [ 1403.570141][T15585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1403.570148][T15585] Call Trace: [ 1403.570153][T15585] [ 1403.570158][T15585] dump_stack_lvl+0xe8/0x150 [ 1403.570178][T15585] should_fail_ex+0x410/0x560 [ 1403.570195][T15585] prepare_alloc_pages+0x223/0x600 [ 1403.570210][T15585] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 1403.570224][T15585] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1403.570238][T15585] ? __pfx_policy_nodemask+0x10/0x10 [ 1403.570251][T15585] ? lock_acquire+0x115/0x350 [ 1403.570267][T15585] alloc_pages_mpol+0x21e/0x390 [ 1403.570282][T15585] folio_alloc_mpol_noprof+0x39/0x160 [ 1403.570297][T15585] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1403.570311][T15585] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1403.570329][T15585] do_wp_page+0x117d/0x4b80 [ 1403.570352][T15585] ? __pfx_do_wp_page+0x10/0x10 [ 1403.570364][T15585] ? do_raw_spin_lock+0x12b/0x2f0 [ 1403.570379][T15585] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1403.570398][T15585] handle_mm_fault+0x15d7/0x3750 [ 1403.570417][T15585] ? handle_mm_fault+0xf1/0x3750 [ 1403.570436][T15585] ? __pfx_handle_mm_fault+0x10/0x10 [ 1403.570450][T15585] ? follow_page_pte+0xc8f/0xf10 [ 1403.570468][T15585] ? __pfx_follow_page_pte+0x10/0x10 [ 1403.570495][T15585] __get_user_pages+0x1675/0x2750 [ 1403.570548][T15585] __gup_longterm_locked+0xd52/0x15c0 [ 1403.570571][T15585] ? lock_acquire+0x115/0x350 [ 1403.570585][T15585] ? sanity_check_pinned_pages+0x810/0x8d0 [ 1403.570601][T15585] gup_fast_fallback+0x1d92/0x20e0 [ 1403.570630][T15585] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1403.570651][T15585] ? is_valid_gup_args+0x11f/0x200 [ 1403.570665][T15585] ? pin_user_pages_fast+0x4d/0xb0 [ 1403.570679][T15585] iov_iter_extract_pages+0x3a1/0x690 [ 1403.570697][T15585] extract_iter_to_sg+0xeda/0x2610 [ 1403.570716][T15585] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1403.570735][T15585] ? __asan_memset+0x22/0x50 [ 1403.570765][T15585] af_alg_get_rsgl+0x493/0x8d0 [ 1403.570804][T15585] ? af_alg_alloc_areq+0xac/0x200 [ 1403.570834][T15585] skcipher_recvmsg+0x39d/0xe10 [ 1403.570865][T15585] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1403.570879][T15585] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1403.570892][T15585] ? security_socket_recvmsg+0x7e/0x2c0 [ 1403.570908][T15585] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1403.570918][T15585] sock_recvmsg+0x196/0x1e0 [ 1403.570938][T15585] ____sys_recvmsg+0x1e6/0x4a0 [ 1403.570956][T15585] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1403.570977][T15585] ? import_iovec+0x73/0xa0 [ 1403.570991][T15585] ___sys_recvmsg+0x213/0x5a0 [ 1403.571008][T15585] ? __pfx____sys_recvmsg+0x10/0x10 [ 1403.571024][T15585] ? lock_acquire+0x115/0x350 [ 1403.571042][T15585] ? __fget_files+0x3a2/0x420 [ 1403.571062][T15585] __x64_sys_recvmsg+0x1ae/0x290 [ 1403.571077][T15585] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1403.571101][T15585] do_syscall_64+0x166/0x520 [ 1403.571113][T15585] ? trace_irq_disable+0x3b/0x140 [ 1403.571123][T15585] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.571135][T15585] ? clear_bhb_loop+0x70/0xc0 [ 1403.571150][T15585] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.571160][T15585] RIP: 0033:0x7f3c8a79e159 [ 1403.571171][T15585] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1403.571180][T15585] RSP: 002b:00007f3c8b5cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1403.571192][T15585] RAX: ffffffffffffffda RBX: 00007f3c8aa25fa0 RCX: 00007f3c8a79e159 [ 1403.571199][T15585] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 1403.571206][T15585] RBP: 00007f3c8b5cd090 R08: 0000000000000000 R09: 0000000000000000 [ 1403.571212][T15585] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1403.571219][T15585] R13: 00007f3c8aa26038 R14: 00007f3c8aa25fa0 R15: 00007ffcfeedb258 [ 1403.571235][T15585] [ 1403.654502][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.765510][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.821046][T15592] netlink: 'syz.0.11978': attribute type 15 has an invalid length. [ 1403.821067][T15592] __nla_validate_parse: 5 callbacks suppressed [ 1403.821078][T15592] netlink: 666 bytes leftover after parsing attributes in process `syz.0.11978'. [ 1403.874115][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1403.983737][T15597] FAULT_INJECTION: forcing a failure. [ 1403.983737][T15597] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1403.983767][T15597] CPU: 0 UID: 0 PID: 15597 Comm: syz.3.11980 Not tainted syzkaller #0 PREEMPT(full) [ 1403.983788][T15597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1403.983800][T15597] Call Trace: [ 1403.983807][T15597] [ 1403.983814][T15597] dump_stack_lvl+0xe8/0x150 [ 1403.983847][T15597] should_fail_ex+0x410/0x560 [ 1403.983876][T15597] _copy_to_iter+0x1e4/0x1810 [ 1403.983895][T15597] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1403.983926][T15597] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1403.983954][T15597] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 1403.983986][T15597] ? __pfx__copy_to_iter+0x10/0x10 [ 1403.984011][T15597] ? packet_recvmsg+0x294/0x1690 [ 1403.984031][T15597] ? packet_recvmsg+0x294/0x1690 [ 1403.984057][T15597] packet_recvmsg+0x642/0x1690 [ 1403.984074][T15597] ? __lock_acquire+0x747/0x2de0 [ 1403.984112][T15597] ? __pfx_packet_recvmsg+0x10/0x10 [ 1403.984131][T15597] ? __pfx_aa_sk_perm+0x10/0x10 [ 1403.984150][T15597] ? lock_acquire+0x115/0x350 [ 1403.984171][T15597] ? aa_sock_msg_perm+0x144/0x210 [ 1403.984198][T15597] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1403.984219][T15597] ? security_socket_recvmsg+0x7e/0x2c0 [ 1403.984247][T15597] ? __pfx_packet_recvmsg+0x10/0x10 [ 1403.984267][T15597] sock_recvmsg+0x196/0x1e0 [ 1403.984299][T15597] ____sys_recvmsg+0x1e6/0x4a0 [ 1403.984333][T15597] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1403.984372][T15597] ? import_iovec+0x73/0xa0 [ 1403.984399][T15597] ___sys_recvmsg+0x213/0x5a0 [ 1403.984429][T15597] ? __pfx____sys_recvmsg+0x10/0x10 [ 1403.984460][T15597] ? lock_acquire+0x115/0x350 [ 1403.984494][T15597] ? __fget_files+0x3a2/0x420 [ 1403.984531][T15597] do_recvmmsg+0x31a/0x7f0 [ 1403.984565][T15597] ? __pfx_do_recvmmsg+0x10/0x10 [ 1403.984601][T15597] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1403.984624][T15597] ? __fget_files+0x3a2/0x420 [ 1403.984659][T15597] __x64_sys_recvmmsg+0x198/0x250 [ 1403.984688][T15597] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1403.984725][T15597] do_syscall_64+0x166/0x520 [ 1403.984745][T15597] ? trace_irq_disable+0x3b/0x140 [ 1403.984764][T15597] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.984783][T15597] ? clear_bhb_loop+0x70/0xc0 [ 1403.984806][T15597] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1403.984825][T15597] RIP: 0033:0x7f3c8a79e159 [ 1403.984843][T15597] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1403.984860][T15597] RSP: 002b:00007f3c8b5ac028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1403.984880][T15597] RAX: ffffffffffffffda RBX: 00007f3c8aa26090 RCX: 00007f3c8a79e159 [ 1403.984894][T15597] RDX: 0000000000000003 RSI: 0000200000005200 RDI: 0000000000000003 [ 1403.984906][T15597] RBP: 00007f3c8b5ac090 R08: 0000000000000000 R09: 0000000000000000 [ 1403.984919][T15597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1403.984929][T15597] R13: 00007f3c8aa26128 R14: 00007f3c8aa26090 R15: 00007ffcfeedb258 [ 1403.984961][T15597] [ 1404.869767][T15607] netlink: 830 bytes leftover after parsing attributes in process `syz.3.11983'. [ 1405.753723][T15555] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1406.193953][T15631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11993'. [ 1406.260335][T15636] netlink: 'syz.0.11995': attribute type 15 has an invalid length. [ 1406.260356][T15636] netlink: 666 bytes leftover after parsing attributes in process `syz.0.11995'. [ 1406.310272][T14887] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1406.310293][T14887] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1406.432970][T15653] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11996'. [ 1406.468564][T15653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1406.688979][T15658] FAULT_INJECTION: forcing a failure. [ 1406.688979][T15658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1406.689010][T15658] CPU: 0 UID: 0 PID: 15658 Comm: syz.2.11998 Not tainted syzkaller #0 PREEMPT(full) [ 1406.689032][T15658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1406.689044][T15658] Call Trace: [ 1406.689051][T15658] [ 1406.689059][T15658] dump_stack_lvl+0xe8/0x150 [ 1406.689092][T15658] should_fail_ex+0x410/0x560 [ 1406.689119][T15658] _copy_from_user+0x2d/0xb0 [ 1406.689144][T15658] bpf_test_init+0xd8/0x150 [ 1406.689174][T15658] bpf_prog_test_run_skb+0x31e/0x2230 [ 1406.689202][T15658] ? lock_acquire+0x115/0x350 [ 1406.689239][T15658] ? __fget_files+0x3a2/0x420 [ 1406.689264][T15658] ? __fget_files+0x2a/0x420 [ 1406.689293][T15658] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1406.689321][T15658] bpf_prog_test_run+0x2c5/0x340 [ 1406.689348][T15658] __sys_bpf+0xa22/0xd90 [ 1406.689377][T15658] ? __pfx___sys_bpf+0x10/0x10 [ 1406.689418][T15658] ? __fget_files+0x2a/0x420 [ 1406.689459][T15658] ? ksys_write+0x242/0x270 [ 1406.689490][T15658] ? __pfx_ksys_write+0x10/0x10 [ 1406.689525][T15658] __x64_sys_bpf+0xba/0xd0 [ 1406.689548][T15658] do_syscall_64+0x166/0x520 [ 1406.689568][T15658] ? trace_irq_disable+0x3b/0x140 [ 1406.689587][T15658] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1406.689607][T15658] ? clear_bhb_loop+0x70/0xc0 [ 1406.689631][T15658] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1406.689650][T15658] RIP: 0033:0x7f160519e159 [ 1406.689668][T15658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1406.689685][T15658] RSP: 002b:00007f1605f9c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1406.689706][T15658] RAX: ffffffffffffffda RBX: 00007f1605425fa0 RCX: 00007f160519e159 [ 1406.689720][T15658] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 1406.689732][T15658] RBP: 00007f1605f9c090 R08: 0000000000000000 R09: 0000000000000000 [ 1406.689745][T15658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1406.689757][T15658] R13: 00007f1605426038 R14: 00007f1605425fa0 R15: 00007ffeba2a4bd8 [ 1406.689788][T15658] [ 1407.163656][ T7870] Bluetooth: hci3: link tx timeout [ 1407.163675][ T7870] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 1407.253252][T15674] netlink: 'syz.1.12005': attribute type 1 has an invalid length. [ 1407.384911][T15678] bond5: (slave bridge1): Enslaving as a backup interface with an up link [ 1407.428879][T15688] IPVS: length: 110 != 24 [ 1407.447201][T15674] macvlan0: entered promiscuous mode [ 1407.447224][T15674] macvlan0: entered allmulticast mode [ 1407.447830][T15674] bond5: entered promiscuous mode [ 1407.447847][T15674] bridge1: entered promiscuous mode [ 1407.450110][T15674] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 1407.485106][T15674] bond5: left promiscuous mode [ 1407.485126][T15674] bridge1: left promiscuous mode [ 1407.558387][T15693] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12013'. [ 1407.627039][T15696] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12012'. [ 1407.673052][T15700] netlink: 'syz.1.12014': attribute type 15 has an invalid length. [ 1407.673076][T15700] netlink: 666 bytes leftover after parsing attributes in process `syz.1.12014'. [ 1407.876116][T14892] net_ratelimit: 36 callbacks suppressed [ 1407.876139][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1407.994290][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1408.104984][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1408.214725][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1408.224597][T24389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1408.224760][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1408.325171][T14892] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1408.511522][T15705] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12015'. [ 1408.592003][T15713] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1408.864461][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1409.187255][ T7870] Bluetooth: hci3: command 0x0406 tx timeout [ 1409.505942][T14882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1409.506138][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1410.146350][T14887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1410.482591][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1410.606281][T15741] gretap1: entered promiscuous mode [ 1410.613337][T15739] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12021'. [ 1410.636582][T15741] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12022'. [ 1410.719559][T15743] netlink: 'syz.4.12023': attribute type 15 has an invalid length. [ 1410.737937][T15743] netlink: 'syz.4.12023': attribute type 15 has an invalid length. [ 1410.834890][T14898] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 1410.837418][T14898] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 1410.837462][T14898] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 1410.837496][T14898] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 1411.026799][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1411.076668][T15764] wg2 speed is unknown, defaulting to 1000 [ 1411.079758][T15764] lo speed is unknown, defaulting to 1000 [ 1411.219192][T15775] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12034'. [ 1411.219327][T15775] FAULT_INJECTION: forcing a failure. [ 1411.219327][T15775] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1411.219354][T15775] CPU: 1 UID: 0 PID: 15775 Comm: syz.0.12034 Not tainted syzkaller #0 PREEMPT(full) [ 1411.219376][T15775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1411.219390][T15775] Call Trace: [ 1411.219398][T15775] [ 1411.219407][T15775] dump_stack_lvl+0xe8/0x150 [ 1411.219438][T15775] should_fail_ex+0x410/0x560 [ 1411.219464][T15775] _copy_to_user+0x31/0xb0 [ 1411.219490][T15775] simple_read_from_buffer+0xe1/0x170 [ 1411.219521][T15775] proc_fail_nth_read+0x1bb/0x230 [ 1411.219549][T15775] ? common_file_perm+0x20e/0x2b0 [ 1411.219573][T15775] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1411.219604][T15775] ? rw_verify_area+0x24a/0x4c0 [ 1411.219633][T15775] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1411.219659][T15775] vfs_read+0x213/0xa80 [ 1411.219691][T15775] ? __pfx___mutex_lock+0x10/0x10 [ 1411.219715][T15775] ? __pfx_vfs_read+0x10/0x10 [ 1411.219744][T15775] ? __fget_files+0x2a/0x420 [ 1411.219775][T15775] ? __fget_files+0x3a2/0x420 [ 1411.219799][T15775] ? __fget_files+0x2a/0x420 [ 1411.219834][T15775] ksys_read+0x150/0x270 [ 1411.219863][T15775] ? __pfx_ksys_read+0x10/0x10 [ 1411.219898][T15775] do_syscall_64+0x166/0x520 [ 1411.219918][T15775] ? trace_irq_disable+0x3b/0x140 [ 1411.219938][T15775] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1411.219958][T15775] ? clear_bhb_loop+0x70/0xc0 [ 1411.219982][T15775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1411.220000][T15775] RIP: 0033:0x7f3d0b75e98e [ 1411.220017][T15775] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1411.220033][T15775] RSP: 002b:00007f3d0c5c8fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1411.220053][T15775] RAX: ffffffffffffffda RBX: 00007f3d0c5c96c0 RCX: 00007f3d0b75e98e [ 1411.220067][T15775] RDX: 000000000000000f RSI: 00007f3d0c5c90a0 RDI: 0000000000000003 [ 1411.220080][T15775] RBP: 00007f3d0c5c9090 R08: 0000000000000000 R09: 0000000000000000 [ 1411.220092][T15775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1411.220111][T15775] R13: 00007f3d0ba26038 R14: 00007f3d0ba25fa0 R15: 00007ffdb4e74c98 [ 1411.220143][T15775] [ 1411.266182][T27151] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1411.604531][ T9664] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1412.221317][T15801] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12040'. [ 1412.298927][T15812] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1413.266857][T14879] net_ratelimit: 8 callbacks suppressed [ 1413.266879][T14879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1413.267073][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1413.355315][T14879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1414.235647][T15818] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12042'. [ 1414.235677][T15818] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12042'. [ 1415.264993][T24389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1415.265185][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1415.904712][T14886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1417.014137][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1417.115125][T15832] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1417.137977][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1417.190083][T15838] netlink: 'syz.4.12048': attribute type 7 has an invalid length. [ 1417.190104][T15838] netlink: 'syz.4.12048': attribute type 3 has an invalid length. [ 1417.190117][T15838] netlink: 224 bytes leftover after parsing attributes in process `syz.4.12048'. [ 1417.274634][T15836] gretap0: entered promiscuous mode [ 1417.274722][T15836] vlan2: entered promiscuous mode [ 1417.343255][T15847] bridge5: the hash_elasticity option has been deprecated and is always 16 [ 1417.343280][T15847] bridge5: entered allmulticast mode [ 1417.432356][T24389] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1417.751453][T15862] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12054'. [ 1417.772315][T15862] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1418.236832][T15870] netlink: 24 bytes leftover after parsing attributes in process `syz.0.12057'. [ 1418.464573][T14879] net_ratelimit: 4 callbacks suppressed [ 1418.464621][T14879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1418.502768][T15877] netlink: 24 bytes leftover after parsing attributes in process `syz.2.12058'. [ 1418.502801][T15877] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12058'. [ 1419.104559][T14879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1419.104749][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1420.090869][T15832] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 1420.584355][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1420.699258][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1420.718125][T15891] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12063'. [ 1420.752026][T15891] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12063'. [ 1420.806185][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1420.840372][T15901] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12065'. [ 1420.843171][T15903] netlink: 68 bytes leftover after parsing attributes in process `syz.2.12066'. [ 1420.865082][T15903] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12066'. [ 1420.939534][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1421.020635][T15909] xt_nfacct: accounting object `' does not exist [ 1421.029245][T24389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.029445][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1421.055455][T14881] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1421.081906][T15917] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1421.082766][T15917] sch_tbf: burst 7 is lower than device bridge0 mtu (1514) ! [ 1421.104677][T15912] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1421.148497][T15920] FAULT_INJECTION: forcing a failure. [ 1421.148497][T15920] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1421.148529][T15920] CPU: 1 UID: 0 PID: 15920 Comm: syz.4.12073 Not tainted syzkaller #0 PREEMPT(full) [ 1421.148552][T15920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1421.148563][T15920] Call Trace: [ 1421.148571][T15920] [ 1421.148580][T15920] dump_stack_lvl+0xe8/0x150 [ 1421.148612][T15920] should_fail_ex+0x410/0x560 [ 1421.148639][T15920] _copy_to_user+0x31/0xb0 [ 1421.148666][T15920] simple_read_from_buffer+0xe1/0x170 [ 1421.148698][T15920] proc_fail_nth_read+0x1bb/0x230 [ 1421.148726][T15920] ? common_file_perm+0x20e/0x2b0 [ 1421.148753][T15920] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1421.148784][T15920] ? rw_verify_area+0x24a/0x4c0 [ 1421.148813][T15920] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1421.148842][T15920] vfs_read+0x213/0xa80 [ 1421.148876][T15920] ? __pfx___mutex_lock+0x10/0x10 [ 1421.148900][T15920] ? __pfx_vfs_read+0x10/0x10 [ 1421.148929][T15920] ? __fget_files+0x2a/0x420 [ 1421.148959][T15920] ? __fget_files+0x3a2/0x420 [ 1421.148992][T15920] ? __fget_files+0x2a/0x420 [ 1421.149026][T15920] ksys_read+0x150/0x270 [ 1421.149056][T15920] ? __pfx_ksys_read+0x10/0x10 [ 1421.149097][T15920] do_syscall_64+0x166/0x520 [ 1421.149117][T15920] ? trace_irq_disable+0x3b/0x140 [ 1421.149135][T15920] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1421.149155][T15920] ? clear_bhb_loop+0x70/0xc0 [ 1421.149177][T15920] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1421.149198][T15920] RIP: 0033:0x7f0bfab5e98e [ 1421.149217][T15920] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1421.149234][T15920] RSP: 002b:00007f0bfba75fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1421.149255][T15920] RAX: ffffffffffffffda RBX: 00007f0bfba766c0 RCX: 00007f0bfab5e98e [ 1421.149269][T15920] RDX: 000000000000000f RSI: 00007f0bfba760a0 RDI: 0000000000000004 [ 1421.149281][T15920] RBP: 00007f0bfba76090 R08: 0000000000000000 R09: 0000000000000000 [ 1421.149293][T15920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1421.149306][T15920] R13: 00007f0bfae26038 R14: 00007f0bfae25fa0 R15: 00007ffd6e6d4ae8 [ 1421.149338][T15920] [ 1421.464141][T14879] netdevsim netdevsim4 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 1421.464186][T14879] netdevsim netdevsim4 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 1421.464864][T14878] netdevsim netdevsim4 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 1421.465111][T14878] netdevsim netdevsim4 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 1422.391998][T15958] __nla_validate_parse: 5 callbacks suppressed [ 1422.392012][T15958] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12082'. [ 1422.620437][T15962] SET target dimension over the limit! [ 1422.658125][T15962] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12082'. [ 1423.586854][T14882] net_ratelimit: 6 callbacks suppressed [ 1423.586875][T14882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1424.398821][T15960] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12082'. [ 1424.455772][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1424.556521][T15973] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1424.595232][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1424.748550][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1424.771304][T15976] netlink: 16 bytes leftover after parsing attributes in process `syz.2.12087'. [ 1424.858489][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1424.872274][T14881] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1424.872422][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1424.967394][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1425.085217][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1425.399616][T16017] No such timeout policy "s " [ 1425.690667][T16025] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12098'. [ 1426.556436][ T5627] Bluetooth: hci3: ACL packet too small [ 1427.520068][T15971] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1427.733396][T16041] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12104'. [ 1427.900008][T16052] Cannot find del_set index 2 as target [ 1427.901659][T16052] nbd97: detected capacity change from 0 to 127 [ 1427.911168][ T2033] [ 1427.919743][ T2033] ====================================================== [ 1427.926759][ T2033] WARNING: possible circular locking dependency detected [ 1427.933788][ T2033] syzkaller #0 Not tainted [ 1427.938198][ T2033] ------------------------------------------------------ [ 1427.945200][ T2033] kworker/1:1H/2033 is trying to acquire lock: [ 1427.951335][ T2033] ffff88807c178468 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x373/0xff0 [ 1427.960289][ T2033] [ 1427.960289][ T2033] but task is already holding lock: [ 1427.967641][ T2033] ffff888099fee178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 1427.976085][ T2033] [ 1427.976085][ T2033] which lock already depends on the new lock. [ 1427.976085][ T2033] [ 1427.986470][ T2033] [ 1427.986470][ T2033] the existing dependency chain (in reverse order) is: [ 1427.995465][ T2033] [ 1427.995465][ T2033] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 1428.002662][ T2033] __mutex_lock+0x19d/0x1550 [ 1428.007765][ T2033] nbd_queue_rq+0xc1/0xff0 [ 1428.012688][ T2033] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1428.018827][ T2033] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1428.025716][ T2033] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1428.032209][ T2033] blk_mq_run_work_fn+0x16c/0x300 [ 1428.037746][ T2033] process_scheduled_works+0xc3d/0x1630 [ 1428.043802][ T2033] worker_thread+0xa47/0xfb0 [ 1428.048905][ T2033] kthread+0x38b/0x480 [ 1428.053482][ T2033] ret_from_fork+0x514/0xb70 [ 1428.058577][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.063857][ T2033] [ 1428.063857][ T2033] -> #5 (set->srcu){.+.+}-{0:0}: [ 1428.070982][ T2033] __synchronize_srcu+0xc9/0x2f0 [ 1428.076440][ T2033] elevator_switch+0x1e8/0x7b0 [ 1428.081776][ T2033] elevator_change+0x2fa/0x480 [ 1428.087045][ T2033] elevator_set_default+0x375/0x440 [ 1428.092748][ T2033] blk_register_queue+0x3f3/0x4e0 [ 1428.098319][ T2033] __add_disk+0x6b8/0xdb0 [ 1428.103157][ T2033] add_disk_fwnode+0x100/0x3a0 [ 1428.108428][ T2033] nbd_dev_add+0x733/0xb60 [ 1428.113349][ T2033] nbd_init+0x168/0x1f0 [ 1428.118118][ T2033] do_one_initcall+0x250/0x870 [ 1428.123398][ T2033] do_initcall_level+0x10a/0x1a0 [ 1428.128902][ T2033] do_initcalls+0x59/0xa0 [ 1428.133738][ T2033] kernel_init_freeable+0x29d/0x3e0 [ 1428.139447][ T2033] kernel_init+0x22/0x1d0 [ 1428.144291][ T2033] ret_from_fork+0x514/0xb70 [ 1428.149384][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.154666][ T2033] [ 1428.154666][ T2033] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 1428.162473][ T2033] __mutex_lock+0x19d/0x1550 [ 1428.167574][ T2033] elevator_change+0x1af/0x480 [ 1428.172847][ T2033] elevator_set_none+0xb5/0x140 [ 1428.178203][ T2033] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1428.184525][ T2033] nbd_start_device+0x189/0xb30 [ 1428.189881][ T2033] nbd_genl_connect+0x167d/0x1cd0 [ 1428.195424][ T2033] genl_family_rcv_msg_doit+0x233/0x340 [ 1428.201479][ T2033] genl_rcv_msg+0x614/0x7a0 [ 1428.206488][ T2033] netlink_rcv_skb+0x226/0x4a0 [ 1428.211763][ T2033] genl_rcv+0x28/0x40 [ 1428.216255][ T2033] netlink_unicast+0x7bd/0x940 [ 1428.221528][ T2033] netlink_sendmsg+0x813/0xb40 [ 1428.226800][ T2033] sock_sendmsg_nosec+0x13a/0x180 [ 1428.232343][ T2033] ____sys_sendmsg+0x54e/0x850 [ 1428.237615][ T2033] ___sys_sendmsg+0x2a5/0x360 [ 1428.242799][ T2033] __x64_sys_sendmsg+0x1b1/0x290 [ 1428.248243][ T2033] do_syscall_64+0x166/0x520 [ 1428.253342][ T2033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.259742][ T2033] [ 1428.259742][ T2033] -> #3 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 1428.268336][ T2033] blk_alloc_queue+0x544/0x690 [ 1428.273608][ T2033] __blk_mq_alloc_disk+0x194/0x390 [ 1428.279229][ T2033] nbd_dev_add+0x494/0xb60 [ 1428.284148][ T2033] nbd_init+0x168/0x1f0 [ 1428.288816][ T2033] do_one_initcall+0x250/0x870 [ 1428.294091][ T2033] do_initcall_level+0x10a/0x1a0 [ 1428.299534][ T2033] do_initcalls+0x59/0xa0 [ 1428.304369][ T2033] kernel_init_freeable+0x29d/0x3e0 [ 1428.310074][ T2033] kernel_init+0x22/0x1d0 [ 1428.314970][ T2033] ret_from_fork+0x514/0xb70 [ 1428.320077][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.325362][ T2033] [ 1428.325362][ T2033] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 1428.332567][ T2033] fs_reclaim_acquire+0x71/0x100 [ 1428.338017][ T2033] kmem_cache_alloc_node_noprof+0x5f/0x610 [ 1428.344343][ T2033] __alloc_skb+0x1db/0x7a0 [ 1428.349270][ T2033] tcp_stream_alloc_skb+0x3f/0x580 [ 1428.354954][ T2033] tcp_sendmsg_locked+0x138c/0x5400 [ 1428.360664][ T2033] tcp_sendmsg+0x2f/0x50 [ 1428.365414][ T2033] sock_sendmsg_nosec+0x90/0x180 [ 1428.370884][ T2033] sock_sendmsg+0x1ca/0x2d0 [ 1428.375903][ T2033] splice_to_socket+0xb5e/0x12a0 [ 1428.381352][ T2033] direct_splice_actor+0x101/0x160 [ 1428.386977][ T2033] splice_direct_to_actor+0x57b/0xcb0 [ 1428.392858][ T2033] do_splice_direct+0x195/0x290 [ 1428.398223][ T2033] do_sendfile+0x52e/0x7c0 [ 1428.403145][ T2033] __se_sys_sendfile64+0x144/0x1a0 [ 1428.408760][ T2033] do_syscall_64+0x166/0x520 [ 1428.413859][ T2033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1428.420271][ T2033] [ 1428.420271][ T2033] -> #1 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 1428.428334][ T2033] lock_sock_nested+0x41/0x100 [ 1428.433603][ T2033] inet_shutdown+0x6a/0x390 [ 1428.438618][ T2033] nbd_mark_nsock_dead+0x2cb/0x550 [ 1428.444242][ T2033] recv_work+0x1cee/0x1e10 [ 1428.449186][ T2033] process_scheduled_works+0xc3d/0x1630 [ 1428.455258][ T2033] worker_thread+0xa47/0xfb0 [ 1428.460370][ T2033] kthread+0x38b/0x480 [ 1428.464952][ T2033] ret_from_fork+0x514/0xb70 [ 1428.470052][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.475329][ T2033] [ 1428.475329][ T2033] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 1428.482965][ T2033] __lock_acquire+0x164c/0x2de0 [ 1428.488322][ T2033] lock_acquire+0x115/0x350 [ 1428.493331][ T2033] __mutex_lock+0x19d/0x1550 [ 1428.498432][ T2033] nbd_queue_rq+0x373/0xff0 [ 1428.503440][ T2033] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1428.509499][ T2033] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1428.516357][ T2033] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1428.522864][ T2033] blk_mq_run_work_fn+0x16c/0x300 [ 1428.528406][ T2033] process_scheduled_works+0xc3d/0x1630 [ 1428.534470][ T2033] worker_thread+0xa47/0xfb0 [ 1428.539572][ T2033] kthread+0x38b/0x480 [ 1428.544145][ T2033] ret_from_fork+0x514/0xb70 [ 1428.549239][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.554516][ T2033] [ 1428.554516][ T2033] other info that might help us debug this: [ 1428.554516][ T2033] [ 1428.564728][ T2033] Chain exists of: [ 1428.564728][ T2033] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 1428.564728][ T2033] [ 1428.576792][ T2033] Possible unsafe locking scenario: [ 1428.576792][ T2033] [ 1428.584222][ T2033] CPU0 CPU1 [ 1428.589570][ T2033] ---- ---- [ 1428.594915][ T2033] lock(&cmd->lock); [ 1428.598882][ T2033] lock(set->srcu); [ 1428.605279][ T2033] lock(&cmd->lock); [ 1428.611764][ T2033] lock(&nsock->tx_lock); [ 1428.616166][ T2033] [ 1428.616166][ T2033] *** DEADLOCK *** [ 1428.616166][ T2033] [ 1428.624289][ T2033] locks held by kworker/1:1H/2033: 4, last CPU#1: [ 1428.630684][ T2033] #0: ffff88801eef0540 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1428.641727][ T2033] #1: ffffc90006e3fc40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1428.654587][ T2033] #2: ffff8880774bd598 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x144/0x300 [ 1428.663975][ T2033] #3: ffff888099fee178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 1428.672852][ T2033] [ 1428.672852][ T2033] stack backtrace: [ 1428.678748][ T2033] CPU: 1 UID: 0 PID: 2033 Comm: kworker/1:1H Not tainted syzkaller #0 PREEMPT(full) [ 1428.688187][ T2033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 1428.698229][ T2033] Workqueue: kblockd blk_mq_run_work_fn [ 1428.703772][ T2033] Call Trace: [ 1428.707037][ T2033] [ 1428.709960][ T2033] dump_stack_lvl+0xe8/0x150 [ 1428.714542][ T2033] print_circular_bug+0x2e2/0x300 [ 1428.719572][ T2033] check_noncircular+0x12f/0x150 [ 1428.724513][ T2033] __lock_acquire+0x164c/0x2de0 [ 1428.729358][ T2033] ? irqentry_exit+0x218/0x910 [ 1428.734122][ T2033] ? __pfx___schedule+0x10/0x10 [ 1428.738972][ T2033] ? irqentry_exit+0x218/0x910 [ 1428.743730][ T2033] lock_acquire+0x115/0x350 [ 1428.748222][ T2033] ? nbd_queue_rq+0x373/0xff0 [ 1428.752892][ T2033] __mutex_lock+0x19d/0x1550 [ 1428.757475][ T2033] ? nbd_queue_rq+0x373/0xff0 [ 1428.762138][ T2033] ? ret_from_fork_asm+0x1a/0x30 [ 1428.767071][ T2033] ? unwind_next_frame+0x8f/0x2550 [ 1428.772175][ T2033] ? nbd_queue_rq+0x373/0xff0 [ 1428.776838][ T2033] ? __pfx___mutex_lock+0x10/0x10 [ 1428.781852][ T2033] ? ret_from_fork_asm+0x1a/0x30 [ 1428.786784][ T2033] ? stack_trace_save+0xa9/0x100 [ 1428.791715][ T2033] ? __pfx_stack_trace_save+0x10/0x10 [ 1428.797083][ T2033] nbd_queue_rq+0x373/0xff0 [ 1428.801574][ T2033] ? __lock_acquire+0x1511/0x2de0 [ 1428.806586][ T2033] ? __pfx_nbd_queue_rq+0x10/0x10 [ 1428.811601][ T2033] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1428.817143][ T2033] ? sbitmap_get+0x229/0x390 [ 1428.821733][ T2033] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 1428.827700][ T2033] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 1428.833499][ T2033] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1428.839824][ T2033] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 1428.846587][ T2033] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1428.852559][ T2033] ? blk_mq_run_work_fn+0x144/0x300 [ 1428.857748][ T2033] blk_mq_run_work_fn+0x16c/0x300 [ 1428.862765][ T2033] ? process_scheduled_works+0x97a/0x1630 [ 1428.868476][ T2033] process_scheduled_works+0xc3d/0x1630 [ 1428.874030][ T2033] ? __pfx_process_scheduled_works+0x10/0x10 [ 1428.880007][ T2033] ? assign_work+0x3cf/0x5d0 [ 1428.884589][ T2033] worker_thread+0xa47/0xfb0 [ 1428.889175][ T2033] ? __kthread_parkme+0x71/0x1f0 [ 1428.894110][ T2033] kthread+0x38b/0x480 [ 1428.898166][ T2033] ? __pfx_worker_thread+0x10/0x10 [ 1428.903268][ T2033] ? __pfx_kthread+0x10/0x10 [ 1428.907842][ T2033] ret_from_fork+0x514/0xb70 [ 1428.912420][ T2033] ? __pfx_ret_from_fork+0x10/0x10 [ 1428.917524][ T2033] ? __switch_to+0xc89/0x1420 [ 1428.922194][ T2033] ? __pfx_kthread+0x10/0x10 [ 1428.926769][ T2033] ret_from_fork_asm+0x1a/0x30 [ 1428.931530][ T2033] [ 1428.950278][T24391] net_ratelimit: 28 callbacks suppressed [ 1428.950296][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1428.964675][T16058] netlink: 830 bytes leftover after parsing attributes in process `syz.0.12109'. [ 1428.978034][T16052] wg2 speed is unknown, defaulting to 1000 [ 1428.979434][T16052] lo speed is unknown, defaulting to 1000 [ 1428.994138][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994256][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994371][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994473][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994573][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994686][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994807][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1428.994908][T16056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12108'. [ 1429.102770][T14881] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.124287][T16058] IPVS: persistence engine module ip_vs_pe_ not found [ 1429.204533][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.302202][ T5627] block nbd97: Receive control failed (result -104) [ 1429.316652][T14881] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.344808][T14882] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1429.425097][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.534529][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.644355][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.754536][T14887] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1429.864470][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1432.224724][T16064] block nbd97: Connection timed out, retrying (0/1 alive) [ 1432.224769][T16064] block nbd97: Connection timed out, retrying (0/1 alive) [ 1432.224817][T16064] block nbd97: Dead connection, failed to find a fallback [ 1432.224832][T16064] block nbd97: shutting down sockets [ 1432.224844][T16064] I/O error, dev nbd97, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 1432.224871][T16064] Buffer I/O error on dev nbd97, logical block 1, async page read [ 1432.224887][T16064] Buffer I/O error on dev nbd97, logical block 2, async page read [ 1432.224900][T16064] Buffer I/O error on dev nbd97, logical block 3, async page read [ 1432.224920][T16064] I/O error, dev nbd97, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.224940][T16064] Buffer I/O error on dev nbd97, logical block 0, async page read [ 1432.225168][ T2049] I/O error, dev nbd97, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1432.225184][ T2049] Buffer I/O error on dev nbd97, logical block 0, async page read [ 1432.225191][ T2049] Buffer I/O error on dev nbd97, logical block 1, async page read [ 1432.225199][ T2049] Buffer I/O error on dev nbd97, logical block 2, async page read [ 1432.225206][ T2049] Buffer I/O error on dev nbd97, logical block 3, async page read [ 1432.225323][T16064] I/O error, dev nbd97, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 1432.225345][T16064] Buffer I/O error on dev nbd97, logical block 0, async page read [ 1432.225357][T16064] Buffer I/O error on dev nbd97, logical block 1, async page read [ 1432.225490][T16064] I/O error, dev nbd97, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.225561][T16064] I/O error, dev nbd97, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.225640][T16064] I/O error, dev nbd97, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.225708][T16064] I/O error, dev nbd97, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.225787][T16064] I/O error, dev nbd97, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.225855][T16064] I/O error, dev nbd97, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1432.226663][T16018] ldm_validate_partition_table(): Disk read failed. [ 1432.227477][T16018] Dev nbd97: unable to read RDB block 0 [ 1432.228264][T16018] nbd97: unable to read partition table [ 1432.231617][T16018] ldm_validate_partition_table(): Disk read failed. [ 1432.232180][T16018] Dev nbd97: unable to read RDB block 0 [ 1432.232775][T16018] nbd97: unable to read partition table [ 1433.964351][T24391] net_ratelimit: 41 callbacks suppressed [ 1433.964372][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.074225][T14881] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.184486][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.294304][T14879] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.404382][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.465148][T14879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1434.524357][T14882] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.634695][T24391] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.744500][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex [ 1434.854645][T14878] bond6: (slave ip6gretap2): failed to get link speed/duplex