last executing test programs: 1.177027213s ago: executing program 0 (id=836): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000000)="18000000010005", 0x7) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000280)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000500)={r2, 0x0, 0x30, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) connect$inet6(r4, &(0x7f0000000840)={0xa, 0x4e21, 0x2, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7}, 0x1c) ioctl$FS_IOC_GETFSLABEL(r4, 0x81009431, &(0x7f0000000180)) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @private0, @mcast2, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10}}}}}}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000040)={'wg2\x00'}) 1.138101824s ago: executing program 2 (id=838): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="1400000016000b63d25a8064000000000124fc60", 0x14}], 0x1}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r2, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) r4 = socket$unix(0x1, 0x1, 0x0) bind$unix(r4, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r5 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, @in={0x2, 0x4e21, @local}], 0x20) listen(r6, 0x7) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}], 0x10) listen(r5, 0x7) listen(r4, 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = socket$unix(0x1, 0x1, 0x0) connect$unix(r7, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) socket$nl_xfrm(0x10, 0x3, 0x6) listen(r4, 0x802) r8 = socket$netlink(0x10, 0x3, 0x4) write(r8, &(0x7f00000002c0)="29000000140005b7ff00000004eabdeb0101b6ff02159f7e5520756b1933b49db96ad24d12595fbea5", 0x29) close(r0) 1.067186509s ago: executing program 3 (id=840): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="528d5501011f"], 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES64=r2, @ANYRESOCT=r0, @ANYRES64], 0x90}}, 0x0) 1.059969351s ago: executing program 0 (id=841): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x2c, 0x40, 0x107, 0x70bd2b, 0x25dfdbfe, {0x3, 0x7c}, [@nested={0x4, 0x1c2}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x1f, 0x0, 0x0, @fd=r1}]}, @typed={0x8, 0x8, 0x0, 0x0, @fd=r1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x20044004) (async) r4 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) (async) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="67000000dc3606ebd4f7a17462913b28012b90c7fa8ee04946a029acc4449e4a97a709a77699c9cd740fbeb4b2c21c77537d903135444cb75b970ff3588743144e92ad9b959219c207287d1b22def77d81dbdd5f912e6a3f7e5a2fd4af2b186e0ea0ee6e7b8c51c90bc16c746cbbd50068b8c03887cd16a7d5e5ae775257736b94123ad6abcccc5035d376f9b7473453e097fd18570edbb0eccc1428b9a219a5df9de129eed8cb68be7822884add4862cdbcb4aa82ae63373fed0d69a6a40bac2d0f8e2602e3b103839e9c27", @ANYRES16=r6, @ANYBLOB="01002cbd701004000000050000000600010005000000080009000200000008000b000000000008000c00a80a00001400080069703667726530000000000000000000"], 0x48}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) (async) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000088f7ffffffffffffaa0aaaaaaaaa08004500002000660000fc2f6bf447ca3fa40231082f8f4a"], 0x32) 1.058661016s ago: executing program 1 (id=842): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x14, 0x2d, 0x9, 0xffffffff, 0x25dfdbfd, {0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001500)={0x11, 0x4, &(0x7f00000003c0)=@framed={{}, [@alu={0x3, 0x1, 0xd, 0x0, 0x0, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000400)='syzkaller\x00', 0x2}, 0x90) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x4000}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x12, 0xa01, 0x0, 0x0, {0x7, 0x0, 0x2}}, 0x14}}, 0x0) 926.616409ms ago: executing program 2 (id=843): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, 0x0, 0x0, 0x200408c0) sendmsg$inet6(r0, &(0x7f0000000f00)={&(0x7f0000000500)={0xa, 0x4e22, 0x6, @remote, 0x6}, 0x1c, &(0x7f0000000d40)=[{&(0x7f0000000700)="b045a4f11158217fa195fd41c5865f367501ef77266dea2df26b367904568225199620ba", 0x24}], 0x1, 0x0, 0x0, 0xfc000000}, 0x24040040) 900.818622ms ago: executing program 4 (id=844): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000080)}, {&(0x7f0000000200)="000000001824", 0x6}], 0x2, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private=0xa010102}}}], 0x20}, 0x240088d4) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f0000000400)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000440)=0x2c) 877.074367ms ago: executing program 3 (id=845): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808100300000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca9100000000000b5090100000000009500000000000000b509000002000000639a04fe00000000b509000000000000c39a04fee1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 802.398438ms ago: executing program 1 (id=846): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x4c, 0xffffffffffffffff, &(0x7f00000002c0)=0x5c) (async) getsockopt$inet6_int(r1, 0x29, 0x4c, 0xffffffffffffffff, &(0x7f00000002c0)=0x5c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='rss_stat\x00', r2, 0x0, 0x40}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='rss_stat\x00', r2, 0x0, 0x40}, 0x18) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendfile(r4, r3, 0x0, 0xfffbffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) 787.62749ms ago: executing program 2 (id=847): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r0}, 0x10) (async) r1 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) read$alg(r2, &(0x7f0000000500)=""/4096, 0x1000) (async) splice(r1, 0x0, r3, 0x0, 0x400000008000f28, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000001b00)=@newtaction={0x18, 0x76, 0x1, 0x0, 0x0, {0x0, 0x0, 0x300}, [{0x4}]}, 0x18}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x1d}, {0x6}]}, 0x10) (async) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x114, 0xe) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'dummy0\x00', 0x0}) (async) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001180)=@newlink={0x30, 0x10, 0x503, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x140}, [@IFLA_NET_NS_FD={0x8, 0x1c, r2}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_getaddr={0x5c, 0x16, 0x20, 0x70bd2a, 0x25dfdbfc, {0xa, 0x40, 0x8, 0xfd, r8}, [@IFA_RT_PRIORITY={0x8, 0x9, 0x72}, @IFA_RT_PRIORITY={0x8, 0x9, 0x1005}, @IFA_FLAGS={0x8, 0x8, 0x50}, @IFA_TARGET_NETNSID={0x8}, @IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @IFA_TARGET_NETNSID={0x8, 0xa, 0x1}, @IFA_FLAGS={0x8, 0x8, 0xa0}]}, 0x5c}}, 0x0) 757.490177ms ago: executing program 4 (id=848): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r1, &(0x7f0000000fc0)={&(0x7f0000001340)=@hci={0x1f, 0x0, 0x31}, 0x80, &(0x7f0000000100)=[{&(0x7f0000001040)="da8dcc01000000a47b", 0x9}, {&(0x7f0000000000)="87bad2414ae22f664d1eafe133a50b7cc6edf4f6c9d453642c24179778685806e0c59be5a17802ae810c09d3d9480bcb1bfffb", 0x33}], 0x2}, 0x20000001) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=r3, @ANYBLOB="00c200bd"], 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x10, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000407000071121500000000009551b627f82875b096340a40182aded41a5bb0420562b7f3b213ac8791c0436ad26423db426c3afeeba0327a57fc821b3d27c4f5106f595fadc33ac6ea4513945533e925c3e44a2ab2ff7f5aa68d81b0cc09e632b635901287a692e03dac9ccb8ba32bbbaecd5562dcd1cc8f828b8cf3fe6ea5fa97ef611006d274e16270b6f975fdab13b949c6c2a1afcd35d0eace648116fad117da26d37df6871170a72859e60385c5bbe05351a3b61881e5000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) 703.142805ms ago: executing program 3 (id=849): socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'wg1\x00'}) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r3, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="78000000100083040400", @ANYRES32=r1, @ANYBLOB="0008000007500500580012800b000100627269"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='h'], 0x68}, 0x9}, 0x0) 701.849602ms ago: executing program 0 (id=850): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) socket$pppoe(0x18, 0x1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4004811) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r4, @ANYBLOB="24005a8020000180140009"], 0x40}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x28, r3, 0x400, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x80, 0x3a}}}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000040}, 0x4040044) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, 0x0, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) syz_emit_ethernet(0x0, 0x0, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) ioctl$int_in(r7, 0x5421, &(0x7f0000000100)=0x9) connect$inet(r7, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) close(r7) r8 = socket$unix(0x1, 0x1, 0x0) sendmmsg(r8, 0x0, 0x0, 0x20040844) ioctl$FS_IOC_GETFSLABEL(r0, 0x800452d3, &(0x7f0000000100)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r9, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x1, 0x6, 0x801, 0x0, 0x0, {0x7, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000004}, 0x85) socket$nl_xfrm(0x10, 0x3, 0x6) 681.680832ms ago: executing program 1 (id=851): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r0, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f00)=[{&(0x7f0000006480)={0x14, 0x27, 0x1, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x4010) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_int(r2, 0x11, 0xb, &(0x7f0000000200)=0x6, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x4e24, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @broadcast}, {0xfffe, 0x4e24, 0x9c, 0x0, @wg=@initiation={0x1, 0x3, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98e3943f6892078bb952854743fe4dddd2e7c0ce70a4ac7d", {"a851525b16af17fe87acbae2ab0b233d", "01422d01cd53c3abe94331d0b7918724"}}}}}}}, 0x0) 657.88677ms ago: executing program 2 (id=852): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FIONCLEX(r0, 0x5450) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000340)) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@getchain={0x24, 0x66, 0x1}, 0x24}}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r2, 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6000000010000104a0518fd50000000000000000e9b21833198f3c9d17f5f829496eaa1256723bed2ad675025724956c43357b3d07eca4f08de7ed27b56cdea6d73967b85565f537045dc430e2174bd991e70ae2a967b7d9070aa81e1d79da864717f1690a0096ced42bd2b2cb24b8d204f3d39627c5dfb4623633a7e200"/135, @ANYRESDEC, @ANYRESOCT=r0], 0x60}, 0x1, 0x0, 0x0, 0x20044054}, 0x4000054) 558.410417ms ago: executing program 3 (id=853): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'veth1_to_bond\x00', 0x0}) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', r1}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='blkio.bfq.time\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r3, 0xffffffffffffffff}, &(0x7f0000000840), &(0x7f00000001c0)}, 0x20) r5 = socket(0x10, 0x3, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r6) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x34, r7, 0x607, 0x270bd07, 0x25dfdbff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}]}, 0x34}, 0x1, 0x0, 0x0, 0x44000}, 0x8480) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000280)={0xffffffff}, 0x10) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x20, 0x12, 0xa01, 0x0, 0x0, {0xa}}, 0x26}}, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000800)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@const={0x1, 0x0, 0x0, 0xa, 0x5}]}, {0x0, [0x5f, 0x61]}}, &(0x7f0000000f80)=""/4096, 0x28, 0x1000, 0x1, 0x40, 0x10000}, 0x28) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)={0x1b, 0x0, 0x0, 0x2, 0x0, r2, 0xc0, '\x00', r1, 0xffffffffffffffff, 0x5, 0x2, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x6, 0x0, 0x0, &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x4, '\x00', r1, 0x25, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f00000009c0)={0x0, 0x4, 0x2, 0x7}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000a00)=[r4], 0x0, 0x10, 0x8c72}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000640)={{r2, 0xffffffffffffffff}, &(0x7f00000005c0), &(0x7f0000000600)='%pi6 \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x1a, &(0x7f00000002c0)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x37b}}, @map_idx={0x18, 0x1, 0x5, 0x0, 0xe}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @btf_id={0x18, 0xa, 0x3, 0x0, 0x2}], &(0x7f00000003c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x1e, '\x00', r1, 0x0, r8, 0x8, &(0x7f0000000480)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000500)={0x1, 0xd, 0x45a, 0x8}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000680)=[r2, r9, r2, r2, r2, r10], &(0x7f00000006c0)=[{0x5, 0x5, 0xa, 0x8}, {0x2, 0x4, 0x5, 0x1}, {0x5, 0x1, 0xb, 0x1}, {0x4, 0x1, 0xb, 0x8}, {0x1, 0x1, 0xb, 0x6}, {0x1, 0x5, 0x1, 0xa}, {0x4, 0x1, 0x3, 0x9}], 0x10, 0x3939}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r11, 0x0, 0x4, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(r11, 0x1, 0x19, &(0x7f00000000c0)='xfrm0\x00', 0x10) connect$inet(r11, &(0x7f0000000080)={0x2, 0x4e20, @private=0xa010100}, 0x10) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) 499.031226ms ago: executing program 1 (id=854): socket$netlink(0x10, 0x3, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) write$tun(r0, &(0x7f0000000740)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x300, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x3c, 0x8016, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x2200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}, 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000040025bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000000080000140012800900010076657468000000000400028008000a00", @ANYRES32=r3, @ANYBLOB="62431cdeab65fa23d8f51a24ea778744c9d74c05ab55401828766b1ba68a34be7141daa4d333739f77b708c49b3e48c673ce996ddbe9fb574102bdf3d17f417bf8b265dc8087f43367d58d32e3fd8b37560ee7a331030181ce2d1df5038c6da613374ab3214f57d47b09b533516fba40fce263c0"], 0x3c}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) 498.702743ms ago: executing program 4 (id=855): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="528d5501011f"], 0x4) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES64=r2, @ANYRESOCT=r0, @ANYRES64], 0x90}}, 0x0) 490.348182ms ago: executing program 2 (id=856): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x54, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x28, 0x3, 0x0, 0x1, [{0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x18, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd8}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r2, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="01002c9d7000ffdbdf2504"], 0x14}}, 0x800) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000001340)=ANY=[@ANYBLOB="18000000000000000000000000000000611234000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) 472.281211ms ago: executing program 0 (id=857): syz_emit_ethernet(0x7e, &(0x7f0000000300)={@multicast, @empty, @void, {@ipv4={0x8fc, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x9, 0x0, 0x0, 0x7, 0x100, {0x15, 0x4, 0x0, 0x4, 0x11d, 0x64, 0x8, 0xf3, 0x89, 0x1, @private=0xa010101, @rand_addr=0x64010102, {[@ssrr={0x89, 0x13, 0xdc, [@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @dev={0xac, 0x14, 0x14, 0x2c}]}, @lsrr={0x83, 0xf, 0xed, [@multicast2, @loopback, @broadcast]}, @generic={0x89, 0xb, "9264ed39f367d88c22"}, @end, @noop, @generic={0x83, 0xe, "0b70e9494bda3bca5a9d11c7"}]}}}}}}}, 0x0) 322.674398ms ago: executing program 0 (id=858): r0 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10, &(0x7f0000000180)=[{&(0x7f0000000080)}, {&(0x7f0000000200)="000000001824", 0x6}], 0x2, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @private=0xa010102}}}], 0x20}, 0x240088d4) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f0000000400)={0x8, 0x7, 0x0, 'syz1\x00'}, &(0x7f0000000440)=0x2c) 322.367481ms ago: executing program 4 (id=859): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) (async) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd31, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x2}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x8902}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004810}, 0x20084084) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0) ioctl$BTRFS_IOC_START_SYNC(r4, 0x80089418, &(0x7f0000000040)) (async) ioctl$BTRFS_IOC_START_SYNC(r4, 0x80089418, &(0x7f0000000040)=0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x4001, 0x3, 0x2e8, 0x250, 0x0, 0x148, 0x0, 0x148, 0x250, 0x240, 0x240, 0x250, 0x240, 0x7fffffe, 0x0, {[{{@ip={@rand_addr, @local, 0x0, 0x0, 'bridge0\x00', 'macvlan0\x00', {}, {}, 0x21}, 0x0, 0x118, 0x180, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_macvtap\x00', {0x0, 0x0, 0x1ff, 0x0, 0x0, 0xed, 0x7}}}, @common=@inet=@multiport={{0x50}, {0x4, 0x0, [0x0, 0x0, 0x0, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e24], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0x98, 0xd0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x3}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x2, 0x4}, {0x2, 0x1}, {0x4, 0x4, 0x4}, 0x3, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x348) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB="0035effa6fbfa6e2f9000000be00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x3}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f00000001c0)='GPL\x00'}, 0x90) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x3}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r8}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f00000001c0)='GPL\x00'}, 0x90) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r4, 0x84009422, &(0x7f0000000340)={0x0, 0x0, {}, {}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) ioctl$BTRFS_IOC_RM_DEV_V2(r5, 0x5000943a, &(0x7f0000000c00)={{r4}, r6, 0x1a, @unused=[0x6, 0xfffffffffffffe01, 0x6, 0x3], @devid=r9}) sendmsg$nl_route_sched(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000b80)=@newtaction={0x6c, 0x30, 0x109, 0x0, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x10}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @private}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000b80)=@newtaction={0x6c, 0x30, 0x109, 0x0, 0x0, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x10}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @private}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) 322.107373ms ago: executing program 2 (id=860): setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x0, @rand_addr=0x64010102}], 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, 0x0, &(0x7f0000000040)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) socket$l2tp(0x2, 0x2, 0x73) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r6, {0xfff3, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) 313.282633ms ago: executing program 3 (id=861): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1400000010000100000000f5000000000700000abc000000030a0500000000000000000001000006700008800c00024000000000000008b60c000140000000000000071f0c00014000000000000080000c00014000000000800000000c00014000000000000000050c00014000000000000000010c00014000000000000000080c00014000000000000001010c000140000000000000343c0900010073797a300000000008000b4000000003080005400000000208000b400000000208000540fffffffa0c000240"], 0x6f4}, 0x1, 0x0, 0x0, 0x20048011}, 0x40000) 262.967203ms ago: executing program 0 (id=862): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="180000002e000100000000000000000004001980040010"], 0x18}], 0x1, 0x0, 0x0, 0x84}, 0x300) syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) (fail_nth: 6) 229.11139ms ago: executing program 1 (id=863): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000500)=@nat={'nat\x00', 0x670, 0x5, 0x4b0, 0x338, 0x338, 0xffffffff, 0x290, 0x0, 0x418, 0x418, 0xffffffff, 0x418, 0x418, 0x5, 0x0, {[{{@uncond, 0x0, 0x198, 0x1e0, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xf, 'kmp\x00', "4801d3e4c6b2bfd892aa7400051624fa86999b13d39b99417a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@rateest={{0x68}, {'wlan1\x00', 'ip6tnl0\x00', 0x12, 0x2, 0x9, 0x2004, 0x5, 0x3, {0xc35}, {0x1ff}}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x12, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@rand_addr=' \x01\x00', @port=0x4e21, @icmp_id=0x68}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0xa, 0x4, "ed481ca2c99b76ccda2879f6a12da5725ea2669d62d23b45710a851be124"}}}, {{@ip={@local, @remote, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @local, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@icmp={{0x28}, {0xc, "1542", 0x1}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x2, @ipv4=@broadcast, @ipv4=@empty, @gre_key=0x3, @icmp_id=0x64}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x510) 134.402021ms ago: executing program 3 (id=864): r0 = socket$inet6(0x10, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xffeffffe}, {0x16, 0x0, 0x0, 0xfffffffc}]}, 0x10) sendto$inet6(r0, &(0x7f00000002c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000010c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$bt_hci(r2, 0x84, 0x6d, &(0x7f0000000000)=""/4102, &(0x7f0000001040)=0x1006) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x2, 0x6, 0x0, 0xe4340000, 0x0, {0x0, 0x0, 0xfffe}}, 0x14}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0x3d, 0xa, 0xa, 0x0, 0x0, 0x71, 0x10, 0x11}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) 134.274807ms ago: executing program 4 (id=865): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="14a1ff0016000b63d25a8064000000000124fc60", 0x14}], 0x1}, 0x0) 106.600327ms ago: executing program 4 (id=866): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FIONCLEX(r0, 0x5450) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@getchain={0x24, 0x66, 0x1}, 0x24}}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r2, 0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtaction={0x68, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x54, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x400, 0xfffffff7}, 0x2}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x68}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6000000010000104a0518fd50000000000000000e9b21833198f3c9d17f5f829496eaa1256723bed2ad675025724956c43357b3d07eca4f08de7ed27b56cdea6d73967b85565f537045dc430e2174bd991e70ae2a967b7d9070aa81e1d79da864717f1690a0096ced42bd2b2cb24b8d204f3d39627c5dfb4623633a7e200"/135, @ANYRESDEC, @ANYRESOCT=r0], 0x60}, 0x1, 0x0, 0x0, 0x20044054}, 0x4000054) 0s ago: executing program 1 (id=867): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.59' (ED25519) to the list of known hosts. [ 65.357892][ T5823] cgroup: Unknown subsys name 'net' [ 65.531860][ T5823] cgroup: Unknown subsys name 'cpuset' [ 65.540760][ T5823] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.955138][ T5823] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 69.229116][ T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 69.237466][ T52] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 69.245352][ T52] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 69.253369][ T52] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 69.261425][ T52] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 69.379374][ T5156] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 69.388013][ T5156] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 69.396320][ T5156] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 69.411600][ T5156] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 69.419620][ T5156] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 69.518127][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 69.530158][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 69.537898][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 69.547097][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 69.555069][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 69.581225][ T5156] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 69.589597][ T5156] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 69.597236][ T5156] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 69.606054][ T5156] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 69.614230][ T5156] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 69.615445][ T5841] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 69.629495][ T5841] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 69.642943][ T5156] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 69.657009][ T5841] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 69.665383][ T5841] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 69.839077][ T5833] chnl_net:caif_netlink_parms(): no params data found [ 70.030780][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.038028][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.046659][ T5833] bridge_slave_0: entered allmulticast mode [ 70.054150][ T5833] bridge_slave_0: entered promiscuous mode [ 70.072946][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.080532][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.087724][ T5833] bridge_slave_1: entered allmulticast mode [ 70.095017][ T5833] bridge_slave_1: entered promiscuous mode [ 70.186471][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.215778][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.295122][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 70.329020][ T5833] team0: Port device team_slave_0 added [ 70.387172][ T5833] team0: Port device team_slave_1 added [ 70.475420][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 70.510058][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.517011][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.543240][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.566201][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 70.579754][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.586717][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.612702][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.662799][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 70.766297][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.773567][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.780984][ T5838] bridge_slave_0: entered allmulticast mode [ 70.787877][ T5838] bridge_slave_0: entered promiscuous mode [ 70.826267][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.834071][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.841300][ T5838] bridge_slave_1: entered allmulticast mode [ 70.848247][ T5838] bridge_slave_1: entered promiscuous mode [ 70.870353][ T5833] hsr_slave_0: entered promiscuous mode [ 70.877209][ T5833] hsr_slave_1: entered promiscuous mode [ 70.930737][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.937918][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.946377][ T5848] bridge_slave_0: entered allmulticast mode [ 70.953510][ T5848] bridge_slave_0: entered promiscuous mode [ 70.987023][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.994257][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.001779][ T5848] bridge_slave_1: entered allmulticast mode [ 71.008870][ T5848] bridge_slave_1: entered promiscuous mode [ 71.017789][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.027238][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.034787][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.042480][ T5844] bridge_slave_0: entered allmulticast mode [ 71.049648][ T5844] bridge_slave_0: entered promiscuous mode [ 71.088392][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.097884][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.105222][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.112551][ T5844] bridge_slave_1: entered allmulticast mode [ 71.119941][ T5844] bridge_slave_1: entered promiscuous mode [ 71.173673][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.181260][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.188465][ T5847] bridge_slave_0: entered allmulticast mode [ 71.195508][ T5847] bridge_slave_0: entered promiscuous mode [ 71.215316][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.245829][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.253146][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.260806][ T5847] bridge_slave_1: entered allmulticast mode [ 71.267777][ T5847] bridge_slave_1: entered promiscuous mode [ 71.283614][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.294934][ T5838] team0: Port device team_slave_0 added [ 71.303426][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.339703][ T5841] Bluetooth: hci0: command tx timeout [ 71.341936][ T5838] team0: Port device team_slave_1 added [ 71.352747][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.414151][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.429484][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.436299][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.453719][ T5848] team0: Port device team_slave_0 added [ 71.483256][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.498319][ T5848] team0: Port device team_slave_1 added [ 71.504140][ T5841] Bluetooth: hci1: command tx timeout [ 71.511122][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.518142][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.544949][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.557806][ T5844] team0: Port device team_slave_0 added [ 71.579080][ T5841] Bluetooth: hci2: command tx timeout [ 71.599708][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.607175][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.633895][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.646771][ T5844] team0: Port device team_slave_1 added [ 71.659079][ T5841] Bluetooth: hci4: command tx timeout [ 71.716752][ T5847] team0: Port device team_slave_0 added [ 71.723128][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.730569][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.756999][ T5841] Bluetooth: hci3: command tx timeout [ 71.757089][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.793362][ T5847] team0: Port device team_slave_1 added [ 71.799834][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.806765][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.833094][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.845374][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.852376][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.878307][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.927150][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.934253][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.960226][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.010653][ T5838] hsr_slave_0: entered promiscuous mode [ 72.016866][ T5838] hsr_slave_1: entered promiscuous mode [ 72.023366][ T5838] debugfs: 'hsr0' already exists in 'hsr' [ 72.029568][ T5838] Cannot create hsr debugfs directory [ 72.035870][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.043214][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.072105][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.095398][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.102426][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.128980][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.216647][ T5848] hsr_slave_0: entered promiscuous mode [ 72.223244][ T5848] hsr_slave_1: entered promiscuous mode [ 72.229736][ T5848] debugfs: 'hsr0' already exists in 'hsr' [ 72.235455][ T5848] Cannot create hsr debugfs directory [ 72.246424][ T5844] hsr_slave_0: entered promiscuous mode [ 72.252737][ T5844] hsr_slave_1: entered promiscuous mode [ 72.258903][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 72.264675][ T5844] Cannot create hsr debugfs directory [ 72.343641][ T5847] hsr_slave_0: entered promiscuous mode [ 72.350370][ T5847] hsr_slave_1: entered promiscuous mode [ 72.356356][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 72.362713][ T5847] Cannot create hsr debugfs directory [ 72.437466][ T5833] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.475820][ T5833] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.511832][ T5833] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.549554][ T5833] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.803616][ T5838] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.816211][ T5838] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.826179][ T5838] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.851465][ T5838] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.904176][ T5847] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 72.915037][ T5847] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 72.926219][ T5847] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 72.936517][ T5847] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.031993][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 73.045749][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 73.057094][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 73.073891][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 73.133928][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.218165][ T5844] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 73.238193][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.245925][ T5844] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 73.258406][ T5844] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 73.270898][ T5844] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 73.322049][ T3860] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.329333][ T3860] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.368311][ T3860] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.375505][ T3860] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.390710][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.428881][ T5841] Bluetooth: hci0: command tx timeout [ 73.444884][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.497131][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.511892][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.533703][ T3547] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.541029][ T3547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.550757][ T3547] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.557850][ T3547] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.571398][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.578806][ T5841] Bluetooth: hci1: command tx timeout [ 73.591736][ T3547] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.598843][ T3547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.630847][ T3860] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.637945][ T3860] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.653704][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.665150][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.671874][ T5841] Bluetooth: hci2: command tx timeout [ 73.724378][ T3860] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.731577][ T3860] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.740181][ T5841] Bluetooth: hci4: command tx timeout [ 73.784618][ T3860] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.791854][ T3860] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.819603][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.827219][ T5841] Bluetooth: hci3: command tx timeout [ 73.866591][ T3964] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.873782][ T3964] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.918007][ T1009] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.925145][ T1009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.003897][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.202689][ T5833] veth0_vlan: entered promiscuous mode [ 74.236734][ T5833] veth1_vlan: entered promiscuous mode [ 74.312735][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.374908][ T5833] veth0_macvtap: entered promiscuous mode [ 74.409448][ T5833] veth1_macvtap: entered promiscuous mode [ 74.522214][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.535838][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.549922][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.565931][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.603290][ T3695] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.614979][ T3695] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.631305][ T3695] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.642760][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.653047][ T3695] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.827931][ T5844] veth0_vlan: entered promiscuous mode [ 74.828957][ T3695] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.843652][ T5847] veth0_vlan: entered promiscuous mode [ 74.850195][ T3695] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.880573][ T5844] veth1_vlan: entered promiscuous mode [ 74.921614][ T3547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.922114][ T5848] veth0_vlan: entered promiscuous mode [ 74.935075][ T3547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.946052][ T5847] veth1_vlan: entered promiscuous mode [ 74.990432][ T5848] veth1_vlan: entered promiscuous mode [ 75.018255][ T5838] veth0_vlan: entered promiscuous mode [ 75.024767][ T5833] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 75.053465][ T5844] veth0_macvtap: entered promiscuous mode [ 75.064469][ T5847] veth0_macvtap: entered promiscuous mode [ 75.086025][ T5844] veth1_macvtap: entered promiscuous mode [ 75.102052][ T5838] veth1_vlan: entered promiscuous mode [ 75.140851][ T5847] veth1_macvtap: entered promiscuous mode [ 75.211717][ T5848] veth0_macvtap: entered promiscuous mode [ 75.226686][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.272774][ T5848] veth1_macvtap: entered promiscuous mode [ 75.281179][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.291910][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.329818][ T5838] veth0_macvtap: entered promiscuous mode [ 75.351363][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.375518][ T1009] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.395700][ T5838] veth1_macvtap: entered promiscuous mode [ 75.405190][ T1009] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.425413][ T1009] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.439449][ T1009] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.464564][ T5949] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 75.476595][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.485219][ T1009] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.494506][ T1009] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.503358][ T5841] Bluetooth: hci0: command tx timeout [ 75.520823][ T1009] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.530178][ T1009] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.552104][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.636686][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.644540][ T1158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.654989][ T1158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.664616][ T5841] Bluetooth: hci1: command tx timeout [ 75.676778][ T1158] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.687909][ T1158] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.714162][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.737075][ T1009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.745718][ T5841] Bluetooth: hci2: command tx timeout [ 75.747322][ T4479] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.760481][ T1009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.776978][ T4479] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.798041][ T4479] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.809683][ T4479] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.820501][ T5841] Bluetooth: hci4: command tx timeout [ 75.871236][ T1009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.881866][ T5952] netlink: 'syz.0.9': attribute type 11 has an invalid length. [ 75.889448][ T1009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.892727][ T5952] netlink: 199816 bytes leftover after parsing attributes in process `syz.0.9'. [ 75.898988][ T5841] Bluetooth: hci3: command tx timeout [ 75.924976][ T1009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.933438][ T1009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.021285][ T1009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.044580][ T1009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.159957][ T1009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.181189][ T1009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.246021][ T1009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.266107][ T1009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.295292][ T5957] vlan2: entered allmulticast mode [ 76.301797][ T5957] hsr0: entered allmulticast mode [ 76.306856][ T5957] hsr_slave_0: entered allmulticast mode [ 76.313717][ T5957] hsr_slave_1: entered allmulticast mode [ 76.389312][ T1158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.397168][ T1158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.494277][ T5964] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2'. [ 76.502653][ T3964] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.525506][ T3964] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.584457][ T5971] netlink: 52 bytes leftover after parsing attributes in process `syz.3.12'. [ 76.996571][ T5996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15'. [ 77.170377][ T6001] warning: `syz.3.17' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 77.282865][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.322576][ T6006] netlink: 152 bytes leftover after parsing attributes in process `syz.0.18'. [ 77.356604][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.367237][ T6011] netlink: 12 bytes leftover after parsing attributes in process `syz.3.20'. [ 77.396336][ T6006] netlink: 152 bytes leftover after parsing attributes in process `syz.0.18'. [ 77.410945][ T6011] netlink: 'syz.3.20': attribute type 1 has an invalid length. [ 77.429251][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.443661][ T6011] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 77.453343][ T6006] netlink: 152 bytes leftover after parsing attributes in process `syz.0.18'. [ 77.485373][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.516455][ T6006] netlink: 152 bytes leftover after parsing attributes in process `syz.0.18'. [ 77.526125][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.562519][ T6006] netlink: 152 bytes leftover after parsing attributes in process `syz.0.18'. [ 77.574362][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.588230][ T5841] Bluetooth: hci0: command tx timeout [ 77.594615][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.630050][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.678015][ T6006] netlink: 'syz.0.18': attribute type 21 has an invalid length. [ 77.739685][ T5841] Bluetooth: hci1: command tx timeout [ 77.794264][ T6020] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 77.820787][ T5841] Bluetooth: hci2: command tx timeout [ 77.898937][ T5841] Bluetooth: hci4: command tx timeout [ 77.979548][ T5841] Bluetooth: hci3: command tx timeout [ 78.155937][ T6049] openvswitch: netlink: IP tunnel dst address not specified [ 78.472434][ T6051] team0 (unregistering): Port device team_slave_0 removed [ 78.495842][ T6069] syz.4.36 uses obsolete (PF_INET,SOCK_PACKET) [ 78.496033][ T6051] team0 (unregistering): Port device team_slave_1 removed [ 78.774475][ T6079] Cannot find add_set index 0 as target [ 78.935968][ T6085] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 78.978066][ T6091] FAULT_INJECTION: forcing a failure. [ 78.978066][ T6091] name failslab, interval 1, probability 0, space 0, times 1 [ 79.018505][ T6091] CPU: 0 UID: 0 PID: 6091 Comm: syz.0.41 Not tainted syzkaller #0 PREEMPT(full) [ 79.018530][ T6091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 79.018546][ T6091] Call Trace: [ 79.018557][ T6091] [ 79.018564][ T6091] dump_stack_lvl+0x189/0x250 [ 79.018595][ T6091] ? __pfx____ratelimit+0x10/0x10 [ 79.018614][ T6091] ? __pfx_dump_stack_lvl+0x10/0x10 [ 79.018629][ T6091] ? __pfx__printk+0x10/0x10 [ 79.018647][ T6091] ? kmalloc_reserve+0xbd/0x290 [ 79.018671][ T6091] ? __lock_acquire+0x6b6/0x2cf0 [ 79.018694][ T6091] should_fail_ex+0x414/0x560 [ 79.018718][ T6091] should_failslab+0xa8/0x100 [ 79.018742][ T6091] kmem_cache_alloc_noprof+0x74/0x6f0 [ 79.018761][ T6091] ? skb_clone+0x212/0x3a0 [ 79.018780][ T6091] skb_clone+0x212/0x3a0 [ 79.018800][ T6091] __netlink_deliver_tap+0x404/0x850 [ 79.018827][ T6091] ? netlink_deliver_tap+0x2e/0x1b0 [ 79.018844][ T6091] netlink_deliver_tap+0x19c/0x1b0 [ 79.018862][ T6091] netlink_unicast+0x7fa/0x9e0 [ 79.018892][ T6091] ? __pfx_netlink_unicast+0x10/0x10 [ 79.018913][ T6091] ? netlink_sendmsg+0x642/0xb30 [ 79.018925][ T6091] ? skb_put+0x11b/0x210 [ 79.018949][ T6091] netlink_sendmsg+0x805/0xb30 [ 79.018971][ T6091] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.018991][ T6091] ? aa_sock_msg_perm+0xf1/0x1b0 [ 79.019009][ T6091] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 79.019029][ T6091] ? __pfx_netlink_sendmsg+0x10/0x10 [ 79.019046][ T6091] __sock_sendmsg+0x21c/0x270 [ 79.019068][ T6091] ____sys_sendmsg+0x505/0x820 [ 79.019097][ T6091] ? __pfx_____sys_sendmsg+0x10/0x10 [ 79.019129][ T6091] ? import_iovec+0x74/0xa0 [ 79.019154][ T6091] ___sys_sendmsg+0x21f/0x2a0 [ 79.019180][ T6091] ? __pfx____sys_sendmsg+0x10/0x10 [ 79.019210][ T6091] ? rcu_read_lock_any_held+0xb3/0x120 [ 79.019256][ T6091] ? __fget_files+0x2a/0x420 [ 79.019271][ T6091] ? __fget_files+0x3a0/0x420 [ 79.019296][ T6091] __x64_sys_sendmsg+0x19b/0x260 [ 79.019322][ T6091] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 79.019355][ T6091] ? __pfx_ksys_write+0x10/0x10 [ 79.019376][ T6091] ? do_syscall_64+0xbe/0xf80 [ 79.019399][ T6091] do_syscall_64+0xfa/0xf80 [ 79.019417][ T6091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.019432][ T6091] ? clear_bhb_loop+0x60/0xb0 [ 79.019449][ T6091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 79.019473][ T6091] RIP: 0033:0x7fba4ef8f749 [ 79.019493][ T6091] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 79.019506][ T6091] RSP: 002b:00007fba4fdb0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 79.019524][ T6091] RAX: ffffffffffffffda RBX: 00007fba4f1e6090 RCX: 00007fba4ef8f749 [ 79.019534][ T6091] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 79.019543][ T6091] RBP: 00007fba4fdb0090 R08: 0000000000000000 R09: 0000000000000000 [ 79.019552][ T6091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 79.019561][ T6091] R13: 00007fba4f1e6128 R14: 00007fba4f1e6090 R15: 00007ffc8b2cbc08 [ 79.019586][ T6091] [ 79.025546][ T6086] veth3: entered promiscuous mode [ 79.047256][ T6090] openvswitch: netlink: Flow actions attr not present in new flow. [ 79.078725][ T6086] veth3: entered allmulticast mode [ 79.385044][ T6096] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.393244][ T6096] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.471126][ T6100] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 79.499790][ T6100] bridge0: entered allmulticast mode [ 79.560793][ T6102] tipc: Started in network mode [ 79.565883][ T6102] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 79.610346][ T6102] tipc: Enabled bearer , priority 10 [ 79.787541][ T6116] xt_l2tp: v2 doesn't support IP mode [ 79.929448][ T6121] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 80.237632][ T6142] syzkaller0: entered promiscuous mode [ 80.246787][ T6142] syzkaller0: entered allmulticast mode [ 80.267504][ T6142] TC_ACT_REPEAT abuse ? [ 80.482521][ T6158] xt_l2tp: v2 doesn't support IP mode [ 80.508027][ T6159] xt_ecn: cannot match TCP bits for non-tcp packets [ 80.569390][ T6159] bond1: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 80.600727][ T6164] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 80.615615][ T6159] bond1 (unregistering): Released all slaves [ 80.729753][ T5940] tipc: Node number set to 1 [ 80.811787][ T6175] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 81.127488][ T6181] openvswitch: netlink: Duplicate or invalid key (type 0). [ 81.199038][ T6181] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 81.221501][ T6188] __nla_validate_parse: 32 callbacks suppressed [ 81.221519][ T6188] netlink: 40 bytes leftover after parsing attributes in process `syz.2.76'. [ 81.661621][ T6212] FAULT_INJECTION: forcing a failure. [ 81.661621][ T6212] name failslab, interval 1, probability 0, space 0, times 0 [ 81.728760][ T6212] CPU: 0 UID: 0 PID: 6212 Comm: syz.3.84 Not tainted syzkaller #0 PREEMPT(full) [ 81.728784][ T6212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 81.728794][ T6212] Call Trace: [ 81.728801][ T6212] [ 81.728808][ T6212] dump_stack_lvl+0x189/0x250 [ 81.728829][ T6212] ? __pfx____ratelimit+0x10/0x10 [ 81.728847][ T6212] ? __pfx_dump_stack_lvl+0x10/0x10 [ 81.728863][ T6212] ? __pfx__printk+0x10/0x10 [ 81.728896][ T6212] should_fail_ex+0x414/0x560 [ 81.728920][ T6212] should_failslab+0xa8/0x100 [ 81.728941][ T6212] kmem_cache_alloc_noprof+0x74/0x6f0 [ 81.728960][ T6212] ? skb_clone+0x212/0x3a0 [ 81.728981][ T6212] skb_clone+0x212/0x3a0 [ 81.728999][ T6212] __netlink_deliver_tap+0x404/0x850 [ 81.729025][ T6212] ? netlink_deliver_tap+0x2e/0x1b0 [ 81.729041][ T6212] netlink_deliver_tap+0x19c/0x1b0 [ 81.729058][ T6212] netlink_sendskb+0x68/0x140 [ 81.729082][ T6212] netlink_unicast+0x397/0x9e0 [ 81.729099][ T6212] ? __asan_memcpy+0x40/0x70 [ 81.729124][ T6212] ? __pfx_netlink_unicast+0x10/0x10 [ 81.729153][ T6212] netlink_rcv_skb+0x28c/0x470 [ 81.729167][ T6212] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 81.729188][ T6212] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 81.729222][ T6212] ? netlink_deliver_tap+0x2e/0x1b0 [ 81.729246][ T6212] netlink_unicast+0x82f/0x9e0 [ 81.729274][ T6212] ? __pfx_netlink_unicast+0x10/0x10 [ 81.729296][ T6212] ? netlink_sendmsg+0x642/0xb30 [ 81.729310][ T6212] ? skb_put+0x11b/0x210 [ 81.729335][ T6212] netlink_sendmsg+0x805/0xb30 [ 81.729361][ T6212] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.729378][ T6212] ? aa_sock_msg_perm+0xf1/0x1b0 [ 81.729397][ T6212] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 81.729417][ T6212] ? __pfx_netlink_sendmsg+0x10/0x10 [ 81.729435][ T6212] __sock_sendmsg+0x21c/0x270 [ 81.729458][ T6212] ____sys_sendmsg+0x505/0x820 [ 81.729487][ T6212] ? __pfx_____sys_sendmsg+0x10/0x10 [ 81.729518][ T6212] ? import_iovec+0x74/0xa0 [ 81.729543][ T6212] ___sys_sendmsg+0x21f/0x2a0 [ 81.729569][ T6212] ? __pfx____sys_sendmsg+0x10/0x10 [ 81.729598][ T6212] ? rcu_read_lock_any_held+0xb3/0x120 [ 81.729643][ T6212] ? __fget_files+0x2a/0x420 [ 81.729655][ T6212] ? __fget_files+0x3a0/0x420 [ 81.729676][ T6212] __x64_sys_sendmsg+0x19b/0x260 [ 81.729702][ T6212] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 81.729732][ T6212] ? __pfx_ksys_write+0x10/0x10 [ 81.729756][ T6212] ? do_syscall_64+0xbe/0xf80 [ 81.729779][ T6212] do_syscall_64+0xfa/0xf80 [ 81.729804][ T6212] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.729819][ T6212] ? clear_bhb_loop+0x60/0xb0 [ 81.729838][ T6212] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 81.729852][ T6212] RIP: 0033:0x7fa31c18f749 [ 81.729867][ T6212] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 81.729880][ T6212] RSP: 002b:00007fa31cf56038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 81.729897][ T6212] RAX: ffffffffffffffda RBX: 00007fa31c3e6090 RCX: 00007fa31c18f749 [ 81.729908][ T6212] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 81.729918][ T6212] RBP: 00007fa31cf56090 R08: 0000000000000000 R09: 0000000000000000 [ 81.729927][ T6212] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 81.729937][ T6212] R13: 00007fa31c3e6128 R14: 00007fa31c3e6090 R15: 00007ffde96b0ce8 [ 81.729966][ T6212] [ 82.707841][ T6237] nbd: illegal input index 2958377 [ 82.760192][ T6241] FAULT_INJECTION: forcing a failure. [ 82.760192][ T6241] name failslab, interval 1, probability 0, space 0, times 0 [ 82.786137][ T6241] CPU: 1 UID: 0 PID: 6241 Comm: syz.2.98 Not tainted syzkaller #0 PREEMPT(full) [ 82.786161][ T6241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 82.786170][ T6241] Call Trace: [ 82.786177][ T6241] [ 82.786185][ T6241] dump_stack_lvl+0x189/0x250 [ 82.786207][ T6241] ? __pfx____ratelimit+0x10/0x10 [ 82.786227][ T6241] ? __pfx_dump_stack_lvl+0x10/0x10 [ 82.786245][ T6241] ? __pfx__printk+0x10/0x10 [ 82.786272][ T6241] ? __pfx___might_resched+0x10/0x10 [ 82.786293][ T6241] should_fail_ex+0x414/0x560 [ 82.786318][ T6241] should_failslab+0xa8/0x100 [ 82.786349][ T6241] kmem_cache_alloc_noprof+0x74/0x6f0 [ 82.786370][ T6241] ? security_file_alloc+0x34/0x330 [ 82.786396][ T6241] security_file_alloc+0x34/0x330 [ 82.786418][ T6241] init_file+0x93/0x2f0 [ 82.786437][ T6241] alloc_empty_file+0x6e/0x1d0 [ 82.786454][ T6241] alloc_file_pseudo+0x13d/0x210 [ 82.786473][ T6241] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 82.786490][ T6241] ? alloc_fd+0x64c/0x6c0 [ 82.786523][ T6241] anon_inode_getfd+0xc8/0x1f0 [ 82.786546][ T6241] map_create+0x1247/0x16a0 [ 82.786569][ T6241] ? security_bpf+0x7e/0x300 [ 82.786593][ T6241] __sys_bpf+0x5f0/0x860 [ 82.786614][ T6241] ? __pfx___sys_bpf+0x10/0x10 [ 82.786647][ T6241] ? ksys_write+0x22a/0x250 [ 82.786669][ T6241] ? __pfx_ksys_write+0x10/0x10 [ 82.786693][ T6241] __x64_sys_bpf+0x7c/0x90 [ 82.786711][ T6241] do_syscall_64+0xfa/0xf80 [ 82.786733][ T6241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.786749][ T6241] ? clear_bhb_loop+0x60/0xb0 [ 82.786769][ T6241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.786785][ T6241] RIP: 0033:0x7fc6eb38f749 [ 82.786799][ T6241] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 82.786813][ T6241] RSP: 002b:00007fc6ec190038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 82.786832][ T6241] RAX: ffffffffffffffda RBX: 00007fc6eb5e5fa0 RCX: 00007fc6eb38f749 [ 82.786844][ T6241] RDX: 0000000000000048 RSI: 0000200000000740 RDI: 0000000000000000 [ 82.786854][ T6241] RBP: 00007fc6ec190090 R08: 0000000000000000 R09: 0000000000000000 [ 82.786864][ T6241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.786873][ T6241] R13: 00007fc6eb5e6038 R14: 00007fc6eb5e5fa0 R15: 00007ffd2fbe2058 [ 82.786902][ T6241] [ 83.053118][ T6245] validate_nla: 28 callbacks suppressed [ 83.053134][ T6245] netlink: 'syz.1.100': attribute type 2 has an invalid length. [ 83.074893][ T6250] netlink: 28 bytes leftover after parsing attributes in process `syz.3.101'. [ 83.103164][ T6245] netlink: 12 bytes leftover after parsing attributes in process `syz.1.100'. [ 83.183098][ T6247] netlink: 24 bytes leftover after parsing attributes in process `syz.1.100'. [ 83.373563][ T6244] Zero length message leads to an empty skb [ 83.404725][ T6254] lo: entered promiscuous mode [ 83.457733][ T6254] lo: entered allmulticast mode [ 83.477680][ T6261] netlink: 24 bytes leftover after parsing attributes in process `syz.2.106'. [ 83.909195][ T6282] netlink: 'syz.1.114': attribute type 21 has an invalid length. [ 83.937472][ T6282] netlink: 168 bytes leftover after parsing attributes in process `syz.1.114'. [ 83.948323][ T6282] IPv6: NLM_F_CREATE should be specified when creating new route [ 83.973328][ T6282] IPv6: Can't replace route, no match found [ 84.065077][ T5907] IPVS: starting estimator thread 0... [ 84.158738][ T6290] IPVS: using max 32 ests per chain, 76800 per kthread [ 84.231417][ T6301] syzkaller0: entered promiscuous mode [ 84.245477][ T6301] syzkaller0: entered allmulticast mode [ 84.259161][ T6301] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 84.312754][ T6302] xt_cluster: node mask cannot exceed total number of nodes [ 84.355348][ T6302] syzkaller0: entered promiscuous mode [ 84.360949][ T6302] syzkaller0: entered allmulticast mode [ 84.452812][ T6313] netlink: 'syz.3.127': attribute type 1 has an invalid length. [ 84.460869][ T6313] netlink: 228 bytes leftover after parsing attributes in process `syz.3.127'. [ 84.481293][ T6321] netlink: 'syz.1.129': attribute type 21 has an invalid length. [ 84.499122][ T6321] netlink: 168 bytes leftover after parsing attributes in process `syz.1.129'. [ 84.508542][ T6321] IPv6: Can't replace route, no match found [ 84.547448][ T6313] bridge1: entered promiscuous mode [ 84.564296][ T6313] bridge1: entered allmulticast mode [ 84.633893][ T6334] netlink: 16 bytes leftover after parsing attributes in process `syz.0.132'. [ 84.932142][ T6352] net_ratelimit: 2 callbacks suppressed [ 84.932159][ T6352] openvswitch: netlink: IP tunnel dst address not specified [ 84.994590][ T6355] openvswitch: netlink: IP tunnel dst address not specified [ 85.054790][ T6355] netlink: 20 bytes leftover after parsing attributes in process `syz.1.141'. [ 85.137069][ T6361] xt_cluster: node mask cannot exceed total number of nodes [ 85.162383][ T6365] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 85.192825][ T6371] wireguard0: entered promiscuous mode [ 85.215925][ T6371] wireguard0: entered allmulticast mode [ 85.244754][ T6371] team0: Device wireguard0 is of different type [ 85.471477][ T6361] syzkaller0: entered promiscuous mode [ 85.477057][ T6361] syzkaller0: entered allmulticast mode [ 85.642553][ T6398] openvswitch: netlink: Duplicate or invalid key (type 0). [ 85.650288][ T6398] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 86.686857][ T6439] Bluetooth: MGMT ver 1.23 [ 86.791097][ T10] cfg80211: failed to load regulatory.db [ 87.234679][ T6472] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.241995][ T6472] bridge0: port 2(bridge_slave_1) entered forwarding state [ 87.250095][ T6472] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.257352][ T6472] bridge0: port 1(bridge_slave_0) entered forwarding state [ 87.273435][ T6472] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 87.435886][ T6476] team0 (unregistering): Port device team_slave_0 removed [ 87.453471][ T6476] team0 (unregistering): Port device team_slave_1 removed [ 87.561346][ T6488] netlink: 36 bytes leftover after parsing attributes in process `syz.3.180'. [ 87.586873][ T6488] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.589855][ T6494] netlink: 64 bytes leftover after parsing attributes in process `syz.4.181'. [ 87.594234][ T6488] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.625929][ T6494] block nbd0: not configured, cannot reconfigure [ 87.965782][ T6512] xt_l2tp: v2 doesn't support IP mode [ 88.135154][ T6515] team0 (unregistering): Port device team_slave_0 removed [ 88.145502][ T6515] team0 (unregistering): Port device team_slave_1 removed [ 88.257871][ T6532] netlink: 8 bytes leftover after parsing attributes in process `syz.0.196'. [ 88.275832][ T6532] netlink: 'syz.0.196': attribute type 5 has an invalid length. [ 88.283759][ T6532] netlink: 20 bytes leftover after parsing attributes in process `syz.0.196'. [ 88.407587][ T6542] netlink: 'syz.2.201': attribute type 1 has an invalid length. [ 88.424107][ T6542] netlink: 224 bytes leftover after parsing attributes in process `syz.2.201'. [ 88.612322][ T6556] netlink: 88 bytes leftover after parsing attributes in process `syz.3.206'. [ 88.623607][ T6556] netlink: 24 bytes leftover after parsing attributes in process `syz.3.206'. [ 88.635217][ T6556] netlink: 24 bytes leftover after parsing attributes in process `syz.3.206'. [ 88.656151][ T6559] netlink: 56 bytes leftover after parsing attributes in process `syz.4.205'. [ 88.656555][ T6557] netlink: 68 bytes leftover after parsing attributes in process `syz.4.205'. [ 88.905142][ T6573] vlan2: entered promiscuous mode [ 88.910919][ T6573] bridge0: entered promiscuous mode [ 88.999300][ T6581] ipvlan2: entered promiscuous mode [ 89.145876][ T6596] syzkaller0: entered promiscuous mode [ 89.151694][ T6596] syzkaller0: entered allmulticast mode [ 89.454777][ T6607] netlink: 'syz.0.220': attribute type 1 has an invalid length. [ 89.493218][ T6607] 8021q: adding VLAN 0 to HW filter on device bond1 [ 89.512296][ T6607] bond1: (slave geneve2): making interface the new active one [ 89.521413][ T6607] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 89.983015][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 90.140387][ T6637] vlan3: entered promiscuous mode [ 90.145469][ T6637] bridge0: entered promiscuous mode [ 90.290939][ T6647] xt_l2tp: v2 doesn't support IP mode [ 90.490661][ T6660] IPv6: NLM_F_CREATE should be specified when creating new route [ 90.540756][ T6660] IPv6: Can't replace route, no match found [ 90.652180][ T6674] openvswitch: netlink: Duplicate or invalid key (type 0). [ 90.678316][ T6676] openvswitch: netlink: Duplicate or invalid key (type 0). [ 90.719090][ T6676] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 90.730921][ T6674] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 90.790776][ T3519] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.828301][ T3519] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.858417][ T3519] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.896113][ T6685] openvswitch: netlink: Tunnel attr 9 has unexpected len 1 expected 2 [ 90.898685][ T3519] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 90.973224][ T6690] tipc: Started in network mode [ 90.978133][ T6690] tipc: Node identity ac14140f, cluster identity 4711 [ 91.007422][ T6690] tipc: New replicast peer: 255.255.255.255 [ 91.030382][ T6690] tipc: Enabled bearer , priority 10 [ 91.051890][ T6693] netlink: 'syz.0.245': attribute type 1 has an invalid length. [ 91.114973][ T6707] openvswitch: netlink: Message has 592 unknown bytes. [ 91.136688][ T6707] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 91.223606][ T6713] openvswitch: netlink: Duplicate or invalid key (type 0). [ 91.270430][ T6713] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 91.447763][ T6730] IPv6: NLM_F_CREATE should be specified when creating new route [ 91.462802][ T6730] IPv6: Can't replace route, no match found [ 91.846821][ T6758] netlink: 'syz.2.271': attribute type 4 has an invalid length. [ 92.013295][ T6771] IPv6: Can't replace route, no match found [ 92.029690][ T24] tipc: Node number set to 2886997007 [ 92.198535][ T6785] FAULT_INJECTION: forcing a failure. [ 92.198535][ T6785] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 92.213770][ T6785] CPU: 0 UID: 0 PID: 6785 Comm: syz.2.279 Not tainted syzkaller #0 PREEMPT(full) [ 92.213793][ T6785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 92.213802][ T6785] Call Trace: [ 92.213809][ T6785] [ 92.213816][ T6785] dump_stack_lvl+0x189/0x250 [ 92.213839][ T6785] ? __pfx____ratelimit+0x10/0x10 [ 92.213859][ T6785] ? __pfx_dump_stack_lvl+0x10/0x10 [ 92.213877][ T6785] ? __pfx__printk+0x10/0x10 [ 92.213897][ T6785] ? __might_fault+0xb0/0x130 [ 92.213926][ T6785] should_fail_ex+0x414/0x560 [ 92.213949][ T6785] _copy_from_user+0x2d/0xb0 [ 92.213971][ T6785] ___sys_sendmsg+0x158/0x2a0 [ 92.213996][ T6785] ? __pfx____sys_sendmsg+0x10/0x10 [ 92.214025][ T6785] ? rcu_read_lock_any_held+0xb3/0x120 [ 92.214071][ T6785] ? __fget_files+0x2a/0x420 [ 92.214084][ T6785] ? __fget_files+0x3a0/0x420 [ 92.214109][ T6785] __x64_sys_sendmsg+0x19b/0x260 [ 92.214135][ T6785] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 92.214168][ T6785] ? __pfx_ksys_write+0x10/0x10 [ 92.214192][ T6785] ? do_syscall_64+0xbe/0xf80 [ 92.214215][ T6785] do_syscall_64+0xfa/0xf80 [ 92.214235][ T6785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.214252][ T6785] ? clear_bhb_loop+0x60/0xb0 [ 92.214270][ T6785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.214286][ T6785] RIP: 0033:0x7fc6eb38f749 [ 92.214301][ T6785] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 92.214315][ T6785] RSP: 002b:00007fc6ec190038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 92.214334][ T6785] RAX: ffffffffffffffda RBX: 00007fc6eb5e5fa0 RCX: 00007fc6eb38f749 [ 92.214346][ T6785] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000008 [ 92.214356][ T6785] RBP: 00007fc6ec190090 R08: 0000000000000000 R09: 0000000000000000 [ 92.214365][ T6785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.214375][ T6785] R13: 00007fc6eb5e6038 R14: 00007fc6eb5e5fa0 R15: 00007ffd2fbe2058 [ 92.214403][ T6785] [ 92.486526][ T6794] vlan3: entered promiscuous mode [ 92.761852][ T6822] __nla_validate_parse: 12 callbacks suppressed [ 92.761870][ T6822] netlink: 40 bytes leftover after parsing attributes in process `syz.3.290'. [ 92.835597][ T6799] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 92.869298][ T6800] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 93.132792][ T6838] tipc: Enabled bearer , priority 0 [ 93.140412][ T6838] syzkaller0: entered promiscuous mode [ 93.145894][ T6838] syzkaller0: entered allmulticast mode [ 93.190696][ T6851] netlink: 132 bytes leftover after parsing attributes in process `syz.3.297'. [ 93.213618][ T6837] tipc: Resetting bearer [ 93.265868][ T6837] tipc: Disabling bearer [ 93.336613][ T6860] netlink: 40 bytes leftover after parsing attributes in process `syz.2.301'. [ 93.466492][ T6871] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 93.556756][ T6879] netlink: 12 bytes leftover after parsing attributes in process `syz.4.305'. [ 93.569114][ T6876] netlink: 12 bytes leftover after parsing attributes in process `syz.3.307'. [ 93.657690][ T6879] netlink: 'syz.4.305': attribute type 7 has an invalid length. [ 93.740360][ T6890] netlink: 20 bytes leftover after parsing attributes in process `syz.1.310'. [ 93.846589][ T6899] netlink: 48 bytes leftover after parsing attributes in process `syz.0.315'. [ 94.029857][ T6911] netlink: 'syz.0.319': attribute type 1 has an invalid length. [ 94.202162][ T6911] 8021q: adding VLAN 0 to HW filter on device bond3 [ 94.245581][ T6911] bond2: (slave bond3): making interface the new active one [ 94.281798][ T6911] bond2: (slave bond3): Enslaving as an active interface with an up link [ 94.347554][ T6911] netlink: 40 bytes leftover after parsing attributes in process `syz.0.319'. [ 94.380779][ T6935] netlink: 'syz.4.325': attribute type 1 has an invalid length. [ 94.532398][ T6921] bond2: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 94.588519][ T6921] bond2: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 94.677000][ T6939] bond1: (slave geneve2): making interface the new active one [ 94.723877][ T6939] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 94.749152][ T1158] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 94.785760][ T1158] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 94.814337][ T1158] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 94.885190][ T1158] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 94.931514][ T6963] netlink: 'syz.3.330': attribute type 1 has an invalid length. [ 95.011847][ T6968] --map-set only usable from mangle table [ 95.014574][ T6963] bond2: entered promiscuous mode [ 95.025879][ T6963] 8021q: adding VLAN 0 to HW filter on device bond2 [ 95.039970][ T6968] netlink: 256 bytes leftover after parsing attributes in process `syz.0.333'. [ 95.082162][ T6963] bond2: (slave bridge1): making interface the new active one [ 95.089975][ T6963] bridge1: entered promiscuous mode [ 95.091967][ T6968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.333'. [ 95.096269][ T6963] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 95.145021][ T6963] gtp0: entered promiscuous mode [ 95.150508][ T6963] gtp0: entered allmulticast mode [ 95.160163][ T6968] net_ratelimit: 7 callbacks suppressed [ 95.160178][ T6968] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.228538][ T6979] netlink: 'syz.4.337': attribute type 6 has an invalid length. [ 95.766114][ T7015] trusted_key: syz.2.348 sent an empty control message without MSG_MORE. [ 95.818520][ T6997] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 95.844811][ T6997] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.855678][ T6997] bond0 (unregistering): Released all slaves [ 95.986715][ T7022] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 96.275044][ T7044] netlink: 'syz.0.358': attribute type 1 has an invalid length. [ 96.299794][ T7044] netlink: 'syz.0.358': attribute type 1 has an invalid length. [ 96.400373][ T7057] vlan2: entered promiscuous mode [ 96.406689][ T7057] bridge0: entered promiscuous mode [ 96.605953][ T7073] openvswitch: netlink: Message has 8 unknown bytes. [ 96.614707][ T7070] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.621888][ T7070] bridge0: port 1(bridge_slave_0) entered listening state [ 96.673399][ T7070] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 96.727170][ T7077] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 96.964516][ T7094] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 97.028042][ T7098] tipc: Started in network mode [ 97.034440][ T7098] tipc: Node identity 6ad314036f2c, cluster identity 4711 [ 97.041881][ T7098] tipc: Enabled bearer , priority 0 [ 97.095379][ T7104] openvswitch: netlink: Message has 8 unknown bytes. [ 97.110608][ T7106] openvswitch: netlink: Tunnel attr 9 has unexpected len 1 expected 2 [ 97.187547][ T7098] syzkaller0: entered promiscuous mode [ 97.199926][ T7098] syzkaller0: entered allmulticast mode [ 97.236997][ T7098] tipc: Resetting bearer [ 97.274559][ T7112] bond0: entered promiscuous mode [ 97.280004][ T7112] bond_slave_0: entered promiscuous mode [ 97.285899][ T7112] bond_slave_1: entered promiscuous mode [ 97.293796][ T7112] ip6gretap0: entered promiscuous mode [ 97.301427][ T7112] hsr1: entered promiscuous mode [ 97.313862][ T7117] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 97.348080][ T7097] tipc: Resetting bearer [ 97.448316][ T7128] netlink: 'syz.0.391': attribute type 21 has an invalid length. [ 98.316825][ T7097] tipc: Disabling bearer [ 98.326675][ T7132] netem: incorrect gi model size [ 98.333234][ T7132] netem: change failed [ 98.390701][ T5973] tipc: Node number set to 100602883 [ 98.434773][ T7144] openvswitch: netlink: Message has 8 unknown bytes. [ 98.551015][ T7150] __nla_validate_parse: 9 callbacks suppressed [ 98.551032][ T7150] netlink: 4 bytes leftover after parsing attributes in process `syz.2.398'. [ 98.621439][ T5973] IPVS: starting estimator thread 0... [ 98.668456][ T7161] netlink: 'syz.0.403': attribute type 21 has an invalid length. [ 98.676664][ T7161] netlink: 168 bytes leftover after parsing attributes in process `syz.0.403'. [ 98.699581][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 98.718711][ T7158] IPVS: using max 31 ests per chain, 74400 per kthread [ 99.141786][ T7193] netlink: 'syz.4.415': attribute type 1 has an invalid length. [ 99.149786][ T7193] netlink: 224 bytes leftover after parsing attributes in process `syz.4.415'. [ 99.176961][ T7196] netlink: 8 bytes leftover after parsing attributes in process `syz.1.416'. [ 99.321290][ T7207] netlink: 'syz.2.420': attribute type 1 has an invalid length. [ 99.395015][ T7207] 8021q: adding VLAN 0 to HW filter on device bond1 [ 99.402350][ T7213] netlink: 40 bytes leftover after parsing attributes in process `syz.1.421'. [ 99.529031][ T7226] raw_sendmsg: syz.0.426 forgot to set AF_INET. Fix it! [ 99.546391][ T7226] netlink: 4 bytes leftover after parsing attributes in process `syz.0.426'. [ 99.560251][ T7220] syzkaller0: entered promiscuous mode [ 99.565773][ T7220] syzkaller0: entered allmulticast mode [ 99.701399][ T7235] netlink: 'syz.1.430': attribute type 1 has an invalid length. [ 99.713994][ T7235] netlink: 224 bytes leftover after parsing attributes in process `syz.1.430'. [ 99.760618][ T7239] netlink: 'syz.2.432': attribute type 8 has an invalid length. [ 99.786935][ T7239] FAULT_INJECTION: forcing a failure. [ 99.786935][ T7239] name failslab, interval 1, probability 0, space 0, times 0 [ 99.808836][ T7239] CPU: 0 UID: 0 PID: 7239 Comm: syz.2.432 Not tainted syzkaller #0 PREEMPT(full) [ 99.808860][ T7239] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 99.808870][ T7239] Call Trace: [ 99.808877][ T7239] [ 99.808884][ T7239] dump_stack_lvl+0x189/0x250 [ 99.808907][ T7239] ? __pfx____ratelimit+0x10/0x10 [ 99.808925][ T7239] ? __pfx_dump_stack_lvl+0x10/0x10 [ 99.808941][ T7239] ? __pfx__printk+0x10/0x10 [ 99.808963][ T7239] ? neigh_dump_info+0x659/0x1a40 [ 99.808989][ T7239] should_fail_ex+0x414/0x560 [ 99.809013][ T7239] should_failslab+0xa8/0x100 [ 99.809038][ T7239] kmem_cache_alloc_noprof+0x74/0x6f0 [ 99.809058][ T7239] ? skb_clone+0x212/0x3a0 [ 99.809080][ T7239] skb_clone+0x212/0x3a0 [ 99.809100][ T7239] __netlink_deliver_tap+0x404/0x850 [ 99.809127][ T7239] ? netlink_deliver_tap+0x2e/0x1b0 [ 99.809146][ T7239] netlink_deliver_tap+0x19c/0x1b0 [ 99.809163][ T7239] __netlink_sendskb+0x47/0x90 [ 99.809187][ T7239] netlink_dump+0xa84/0xe90 [ 99.809215][ T7239] ? __pfx_netlink_dump+0x10/0x10 [ 99.809228][ T7239] ? __netlink_lookup+0x7db/0x8a0 [ 99.809261][ T7239] ? netlink_lookup+0x30/0x200 [ 99.809275][ T7239] ? netlink_lookup+0x30/0x200 [ 99.809288][ T7239] ? netlink_lookup+0x30/0x200 [ 99.809309][ T7239] __netlink_dump_start+0x5cb/0x7e0 [ 99.809341][ T7239] rtnetlink_rcv_msg+0x9eb/0xb70 [ 99.809365][ T7239] ? __pfx_neigh_dump_info+0x10/0x10 [ 99.809381][ T7239] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 99.809402][ T7239] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.809421][ T7239] ? ref_tracker_free+0x63a/0x7d0 [ 99.809439][ T7239] ? __pfx_neigh_dump_info+0x10/0x10 [ 99.809458][ T7239] ? __skb_clone+0x63/0x7a0 [ 99.809482][ T7239] netlink_rcv_skb+0x208/0x470 [ 99.809498][ T7239] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 99.809522][ T7239] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 99.809550][ T7239] ? netlink_deliver_tap+0x2e/0x1b0 [ 99.809575][ T7239] netlink_unicast+0x82f/0x9e0 [ 99.809607][ T7239] ? __pfx_netlink_unicast+0x10/0x10 [ 99.809632][ T7239] ? netlink_sendmsg+0x642/0xb30 [ 99.809646][ T7239] ? skb_put+0x11b/0x210 [ 99.809672][ T7239] netlink_sendmsg+0x805/0xb30 [ 99.809698][ T7239] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.809719][ T7239] ? aa_sock_msg_perm+0xf1/0x1b0 [ 99.809842][ T7239] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 99.809869][ T7239] ? __pfx_netlink_sendmsg+0x10/0x10 [ 99.809886][ T7239] __sock_sendmsg+0x21c/0x270 [ 99.809910][ T7239] sock_write_iter+0x279/0x360 [ 99.809928][ T7239] ? __pfx_sock_write_iter+0x10/0x10 [ 99.809954][ T7239] ? kstrtoull+0x12f/0x1d0 [ 99.809978][ T7239] do_iter_readv_writev+0x623/0x8c0 [ 99.810005][ T7239] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 99.810024][ T7239] ? common_file_perm+0x1b5/0x220 [ 99.810044][ T7239] ? bpf_lsm_file_permission+0x9/0x20 [ 99.810066][ T7239] ? security_file_permission+0x75/0x290 [ 99.810092][ T7239] ? rw_verify_area+0x255/0x4d0 [ 99.810116][ T7239] vfs_writev+0x31a/0x960 [ 99.810130][ T7239] ? vfs_write+0x956/0xb30 [ 99.810157][ T7239] ? __pfx_vfs_writev+0x10/0x10 [ 99.810185][ T7239] ? __fget_files+0x2a/0x420 [ 99.810205][ T7239] ? __fget_files+0x3a0/0x420 [ 99.810218][ T7239] ? __fget_files+0x2a/0x420 [ 99.810243][ T7239] do_writev+0x14d/0x2d0 [ 99.810261][ T7239] ? __pfx_do_writev+0x10/0x10 [ 99.810280][ T7239] ? do_syscall_64+0xbe/0xf80 [ 99.810305][ T7239] do_syscall_64+0xfa/0xf80 [ 99.810325][ T7239] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.810341][ T7239] ? clear_bhb_loop+0x60/0xb0 [ 99.810362][ T7239] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.810377][ T7239] RIP: 0033:0x7fc6eb38f749 [ 99.810394][ T7239] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 99.810407][ T7239] RSP: 002b:00007fc6ec190038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 99.810425][ T7239] RAX: ffffffffffffffda RBX: 00007fc6eb5e5fa0 RCX: 00007fc6eb38f749 [ 99.810437][ T7239] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000003 [ 99.810447][ T7239] RBP: 00007fc6ec190090 R08: 0000000000000000 R09: 0000000000000000 [ 99.810457][ T7239] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 99.810464][ T7239] R13: 00007fc6eb5e6038 R14: 00007fc6eb5e5fa0 R15: 00007ffd2fbe2058 [ 99.810489][ T7239] [ 100.318232][ T7246] netlink: 40 bytes leftover after parsing attributes in process `syz.1.435'. [ 100.368100][ T7249] net_ratelimit: 2 callbacks suppressed [ 100.368118][ T7249] openvswitch: netlink: Tunnel attr 9 has unexpected len 1 expected 2 [ 100.598738][ T7266] netlink: 64 bytes leftover after parsing attributes in process `syz.4.444'. [ 100.608953][ T7266] block nbd0: not configured, cannot reconfigure [ 100.618552][ T7266] netlink: 12 bytes leftover after parsing attributes in process `syz.4.444'. [ 100.629470][ T7266] block nbd0: Unsupported socket: should be TCP or UNIX. [ 100.643981][ T7264] syzkaller0: entered promiscuous mode [ 100.650739][ T7264] syzkaller0: entered allmulticast mode [ 100.705101][ T7272] netlink: 'syz.0.446': attribute type 1 has an invalid length. [ 100.778827][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.786106][ C1] bridge0: topology change detected, propagating [ 101.082878][ T7299] netlink: zone id is out of range [ 101.088274][ T7299] netlink: zone id is out of range [ 101.093863][ T7299] netlink: zone id is out of range [ 101.101632][ T7299] netlink: get zone limit has 4 unknown bytes [ 101.102233][ T7289] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.119365][ T7297] netlink: 'syz.4.455': attribute type 18 has an invalid length. [ 101.142674][ T7299] netlink: zone id is out of range [ 101.147826][ T7299] netlink: zone id is out of range [ 101.154425][ T7299] netlink: zone id is out of range [ 101.159638][ T7299] netlink: get zone limit has 4 unknown bytes [ 101.196161][ T36] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 101.207748][ T7297] netlink: 'syz.4.455': attribute type 18 has an invalid length. [ 101.247975][ T36] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 101.282002][ T36] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 101.309015][ T36] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 101.591835][ T7333] netlink: 'syz.4.464': attribute type 8 has an invalid length. [ 101.601862][ T7333] FAULT_INJECTION: forcing a failure. [ 101.601862][ T7333] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 101.618234][ T7333] CPU: 0 UID: 0 PID: 7333 Comm: syz.4.464 Not tainted syzkaller #0 PREEMPT(full) [ 101.618256][ T7333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 101.618266][ T7333] Call Trace: [ 101.618273][ T7333] [ 101.618280][ T7333] dump_stack_lvl+0x189/0x250 [ 101.618304][ T7333] ? __pfx____ratelimit+0x10/0x10 [ 101.618324][ T7333] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.618339][ T7333] ? __pfx__printk+0x10/0x10 [ 101.618370][ T7333] should_fail_ex+0x414/0x560 [ 101.618393][ T7333] _copy_to_user+0x31/0xb0 [ 101.618416][ T7333] simple_read_from_buffer+0xe1/0x170 [ 101.618443][ T7333] proc_fail_nth_read+0x1b3/0x220 [ 101.618467][ T7333] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 101.618490][ T7333] ? rw_verify_area+0x2a6/0x4d0 [ 101.618508][ T7333] ? __lock_acquire+0x6b6/0x2cf0 [ 101.618522][ T7333] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 101.618544][ T7333] vfs_read+0x200/0xa30 [ 101.618570][ T7333] ? fdget_pos+0x247/0x320 [ 101.618587][ T7333] ? __pfx___mutex_lock+0x10/0x10 [ 101.618607][ T7333] ? __pfx_vfs_read+0x10/0x10 [ 101.618627][ T7333] ? __fget_files+0x2a/0x420 [ 101.618645][ T7333] ? __fget_files+0x3a0/0x420 [ 101.618659][ T7333] ? __fget_files+0x2a/0x420 [ 101.618681][ T7333] ksys_read+0x145/0x250 [ 101.618703][ T7333] ? __pfx_ksys_read+0x10/0x10 [ 101.618732][ T7333] do_syscall_64+0xfa/0xf80 [ 101.618753][ T7333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.618769][ T7333] ? clear_bhb_loop+0x60/0xb0 [ 101.618789][ T7333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.618804][ T7333] RIP: 0033:0x7eff49b8e15c [ 101.618820][ T7333] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 101.618833][ T7333] RSP: 002b:00007eff4aac5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 101.618851][ T7333] RAX: ffffffffffffffda RBX: 00007eff49de5fa0 RCX: 00007eff49b8e15c [ 101.618863][ T7333] RDX: 000000000000000f RSI: 00007eff4aac50a0 RDI: 0000000000000004 [ 101.618873][ T7333] RBP: 00007eff4aac5090 R08: 0000000000000000 R09: 0000000000000000 [ 101.618882][ T7333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.618892][ T7333] R13: 00007eff49de6038 R14: 00007eff49de5fa0 R15: 00007ffcf4c44838 [ 101.618922][ T7333] [ 101.933182][ T7336] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 101.964824][ T7336] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.972993][ T7336] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.992687][ T7336] bridge0: left allmulticast mode [ 102.032194][ T7342] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.040000][ T7342] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.173742][ T7348] syzkaller1: entered promiscuous mode [ 102.187798][ T7348] syzkaller1: entered allmulticast mode [ 103.024360][ T7400] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.032147][ T7400] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.147117][ T7402] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.154404][ T7402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.162707][ T7402] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.169897][ T7402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.222470][ T7402] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.229752][ T7402] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.342448][ T5837] Bluetooth: hci4: command 0x0405 tx timeout [ 103.376457][ T7414] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.383725][ T7414] bridge0: port 2(bridge_slave_1) entered listening state [ 103.391179][ T7414] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.398339][ T7414] bridge0: port 1(bridge_slave_0) entered listening state [ 103.611689][ T7414] __nla_validate_parse: 18 callbacks suppressed [ 103.611705][ T7414] netlink: 84 bytes leftover after parsing attributes in process `syz.2.494'. [ 103.653648][ T7414] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.660995][ T7414] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.915972][ T7433] netlink: 'syz.1.499': attribute type 1 has an invalid length. [ 104.148368][ T7448] netlink: 52 bytes leftover after parsing attributes in process `syz.0.504'. [ 104.218478][ T7448] netlink: 76 bytes leftover after parsing attributes in process `syz.0.504'. [ 104.251823][ T7448] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.259140][ T7448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.266725][ T7448] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.273960][ T7448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.286226][ T7448] netlink: 52 bytes leftover after parsing attributes in process `syz.0.504'. [ 104.306669][ T7455] netlink: 12 bytes leftover after parsing attributes in process `syz.4.509'. [ 104.320458][ T7448] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.327707][ T7448] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.835924][ T7493] netlink: 56 bytes leftover after parsing attributes in process `syz.4.519'. [ 105.086239][ T7504] veth0: entered promiscuous mode [ 105.124381][ T7504] veth0: left promiscuous mode [ 105.137703][ T7508] netlink: 72 bytes leftover after parsing attributes in process `syz.0.525'. [ 105.193013][ T7516] netlink: 76 bytes leftover after parsing attributes in process `syz.0.525'. [ 105.225502][ T7516] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.232749][ T7516] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.240315][ T7516] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.247508][ T7516] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.274229][ T7516] netlink: 72 bytes leftover after parsing attributes in process `syz.0.525'. [ 105.304875][ T7508] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.312279][ T7508] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.505877][ T981] net_ratelimit: 3 callbacks suppressed [ 105.505895][ T981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 105.548170][ T7535] openvswitch: netlink: Message has 16 unknown bytes. [ 105.618405][ T7539] netlink: 'syz.0.535': attribute type 1 has an invalid length. [ 105.697182][ T7545] netlink: 52 bytes leftover after parsing attributes in process `syz.2.538'. [ 105.716464][ T7545] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.723724][ T7545] bridge0: port 2(bridge_slave_1) entered listening state [ 105.731170][ T7545] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.738338][ T7545] bridge0: port 1(bridge_slave_0) entered listening state [ 105.781844][ T7545] bridge0: port 2(bridge_slave_1) entered disabled state [ 105.789249][ T7545] bridge0: port 1(bridge_slave_0) entered disabled state [ 105.853254][ T7551] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.860469][ T7551] bridge0: port 1(bridge_slave_0) entered listening state [ 105.890997][ T7551] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 105.946668][ T7558] xt_cgroup: path and classid specified [ 105.981145][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 106.080991][ T7567] openvswitch: netlink: Message has 16 unknown bytes. [ 106.256033][ T7580] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.263285][ T7580] bridge0: port 2(bridge_slave_1) entered listening state [ 106.270802][ T7580] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.277988][ T7580] bridge0: port 1(bridge_slave_0) entered listening state [ 106.295962][ T7580] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 106.313555][ T7582] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.320799][ T7582] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.328423][ T7582] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.335637][ T7582] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.352023][ T7582] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.359371][ T7582] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.543794][ T5973] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 106.582223][ T7593] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 106.627055][ T3481] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 106.855904][ T7612] netlink: 'syz.1.565': attribute type 1 has an invalid length. [ 106.982183][ T7625] netlink: 'syz.2.563': attribute type 8 has an invalid length. [ 107.250660][ T7640] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.257977][ T7640] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.265573][ T7640] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.272774][ T7640] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.293596][ T7640] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 107.485675][ T7653] netlink: 'syz.1.577': attribute type 21 has an invalid length. [ 107.491352][ T7654] xt_l2tp: v2 doesn't support IP mode [ 107.515324][ T7653] IPv6: Can't replace route, no match found [ 107.745732][ T7666] netlink: 'syz.4.583': attribute type 7 has an invalid length. [ 107.845700][ T4479] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 107.902049][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 107.988708][ T7682] netlink: 'syz.2.589': attribute type 1 has an invalid length. [ 108.153454][ T984] IPVS: starting estimator thread 0... [ 108.268806][ T7692] IPVS: using max 34 ests per chain, 81600 per kthread [ 108.308690][ C0] bridge0: port 1(bridge_slave_0) entered learning state [ 108.316014][ C0] bridge0: port 2(bridge_slave_1) entered learning state [ 108.466045][ T7712] can: request_module (can-proto-0) failed. [ 108.502477][ T7721] xt_ecn: cannot match TCP bits for non-tcp packets [ 108.573088][ T3435] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 108.589078][ T3435] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 108.731395][ T7737] FAULT_INJECTION: forcing a failure. [ 108.731395][ T7737] name failslab, interval 1, probability 0, space 0, times 0 [ 108.745633][ T7737] CPU: 0 UID: 0 PID: 7737 Comm: syz.0.608 Not tainted syzkaller #0 PREEMPT(full) [ 108.745657][ T7737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 108.745667][ T7737] Call Trace: [ 108.745674][ T7737] [ 108.745681][ T7737] dump_stack_lvl+0x189/0x250 [ 108.745708][ T7737] ? __pfx____ratelimit+0x10/0x10 [ 108.745729][ T7737] ? __pfx_dump_stack_lvl+0x10/0x10 [ 108.745747][ T7737] ? __pfx__printk+0x10/0x10 [ 108.745774][ T7737] ? __pfx___might_resched+0x10/0x10 [ 108.745790][ T7737] ? fs_reclaim_acquire+0x7d/0x100 [ 108.745816][ T7737] should_fail_ex+0x414/0x560 [ 108.745841][ T7737] should_failslab+0xa8/0x100 [ 108.745871][ T7737] __kmalloc_noprof+0xcb/0x800 [ 108.745891][ T7737] ? tomoyo_encode+0x28b/0x550 [ 108.745914][ T7737] tomoyo_encode+0x28b/0x550 [ 108.745941][ T7737] tomoyo_realpath_from_path+0x58d/0x5d0 [ 108.745960][ T7737] ? tomoyo_domain+0xd8/0x130 [ 108.745983][ T7737] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 108.746006][ T7737] tomoyo_path_number_perm+0x1e8/0x5a0 [ 108.746031][ T7737] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 108.746066][ T7737] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 108.746106][ T7737] ? __fget_files+0x2a/0x420 [ 108.746125][ T7737] ? __fget_files+0x3a0/0x420 [ 108.746138][ T7737] ? __fget_files+0x2a/0x420 [ 108.746156][ T7737] security_file_ioctl+0xcb/0x2d0 [ 108.746179][ T7737] __se_sys_ioctl+0x47/0x170 [ 108.746201][ T7737] do_syscall_64+0xfa/0xf80 [ 108.746223][ T7737] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.746239][ T7737] ? clear_bhb_loop+0x60/0xb0 [ 108.746260][ T7737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 108.746275][ T7737] RIP: 0033:0x7fba4ef8f749 [ 108.746290][ T7737] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 108.746304][ T7737] RSP: 002b:00007fba4fdd1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 108.746322][ T7737] RAX: ffffffffffffffda RBX: 00007fba4f1e5fa0 RCX: 00007fba4ef8f749 [ 108.746334][ T7737] RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000004 [ 108.746344][ T7737] RBP: 00007fba4fdd1090 R08: 0000000000000000 R09: 0000000000000000 [ 108.746354][ T7737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 108.746363][ T7737] R13: 00007fba4f1e6038 R14: 00007fba4f1e5fa0 R15: 00007ffc8b2cbc08 [ 108.746394][ T7737] [ 108.746478][ T7737] ERROR: Out of memory at tomoyo_realpath_from_path. [ 108.972465][ T7745] lo: entered promiscuous mode [ 109.187784][ T7757] FAULT_INJECTION: forcing a failure. [ 109.187784][ T7757] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 109.202314][ T7757] CPU: 0 UID: 0 PID: 7757 Comm: syz.3.615 Not tainted syzkaller #0 PREEMPT(full) [ 109.202338][ T7757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 109.202348][ T7757] Call Trace: [ 109.202355][ T7757] [ 109.202362][ T7757] dump_stack_lvl+0x189/0x250 [ 109.202385][ T7757] ? __pfx____ratelimit+0x10/0x10 [ 109.202405][ T7757] ? __pfx_dump_stack_lvl+0x10/0x10 [ 109.202423][ T7757] ? __pfx__printk+0x10/0x10 [ 109.202445][ T7757] ? fs_reclaim_acquire+0x7d/0x100 [ 109.202476][ T7757] should_fail_ex+0x414/0x560 [ 109.202500][ T7757] prepare_alloc_pages+0x213/0x610 [ 109.202530][ T7757] __alloc_frozen_pages_noprof+0x123/0x370 [ 109.202557][ T7757] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 109.202596][ T7757] alloc_pages_mpol+0x232/0x4a0 [ 109.202624][ T7757] alloc_pages_noprof+0xa9/0x190 [ 109.202648][ T7757] __pmd_alloc+0x3a/0x540 [ 109.202673][ T7757] __handle_mm_fault+0x9ad/0x5420 [ 109.202707][ T7757] ? __pfx___handle_mm_fault+0x10/0x10 [ 109.202745][ T7757] ? find_vma+0xe7/0x160 [ 109.202767][ T7757] ? __pfx_find_vma+0x10/0x10 [ 109.202787][ T7757] handle_mm_fault+0x40a/0x8e0 [ 109.202823][ T7757] do_user_addr_fault+0x764/0x1380 [ 109.202863][ T7757] exc_page_fault+0x82/0x100 [ 109.202886][ T7757] asm_exc_page_fault+0x26/0x30 [ 109.202900][ T7757] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 109.202916][ T7757] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 8d 48 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 109.202930][ T7757] RSP: 0018:ffffc90003697ab8 EFLAGS: 00050202 [ 109.202945][ T7757] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 109.202956][ T7757] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90003697b60 [ 109.202967][ T7757] RBP: ffffc90003697c90 R08: ffffc90003697b77 R09: 1ffff920006d2f6e [ 109.202978][ T7757] R10: dffffc0000000000 R11: fffff520006d2f6f R12: dffffc0000000000 [ 109.202989][ T7757] R13: 1ffff920006d2f68 R14: ffffc90003697b60 R15: 0000200000000100 [ 109.203017][ T7757] _copy_from_user+0x7a/0xb0 [ 109.203041][ T7757] rfcomm_dev_ioctl+0x119/0x1cf0 [ 109.203066][ T7757] ? kasan_quarantine_put+0xdd/0x220 [ 109.203087][ T7757] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 109.203119][ T7757] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.203146][ T7757] ? do_vfs_ioctl+0xbe8/0x1430 [ 109.203164][ T7757] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 109.203187][ T7757] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 109.203213][ T7757] sock_do_ioctl+0xdc/0x300 [ 109.203234][ T7757] ? __pfx_sock_do_ioctl+0x10/0x10 [ 109.203253][ T7757] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 109.203288][ T7757] sock_ioctl+0x576/0x790 [ 109.203309][ T7757] ? __pfx_sock_ioctl+0x10/0x10 [ 109.203330][ T7757] ? __fget_files+0x3a0/0x420 [ 109.203344][ T7757] ? __fget_files+0x2a/0x420 [ 109.203363][ T7757] ? bpf_lsm_file_ioctl+0x9/0x20 [ 109.203378][ T7757] ? __pfx_sock_ioctl+0x10/0x10 [ 109.203395][ T7757] __se_sys_ioctl+0xfc/0x170 [ 109.203417][ T7757] do_syscall_64+0xfa/0xf80 [ 109.203439][ T7757] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.203454][ T7757] ? clear_bhb_loop+0x60/0xb0 [ 109.203473][ T7757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.203488][ T7757] RIP: 0033:0x7fa31c18f749 [ 109.203503][ T7757] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 109.203515][ T7757] RSP: 002b:00007fa31cf77038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 109.203531][ T7757] RAX: ffffffffffffffda RBX: 00007fa31c3e5fa0 RCX: 00007fa31c18f749 [ 109.203542][ T7757] RDX: 0000200000000100 RSI: 00000000800452d3 RDI: 0000000000000004 [ 109.203552][ T7757] RBP: 00007fa31cf77090 R08: 0000000000000000 R09: 0000000000000000 [ 109.203561][ T7757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.203570][ T7757] R13: 00007fa31c3e6038 R14: 00007fa31c3e5fa0 R15: 00007ffde96b0ce8 [ 109.203599][ T7757] [ 109.598856][ T7758] netlink: 'syz.2.614': attribute type 10 has an invalid length. [ 109.618810][ T7758] __nla_validate_parse: 17 callbacks suppressed [ 109.618829][ T7758] netlink: 40 bytes leftover after parsing attributes in process `syz.2.614'. [ 109.738470][ T7758] dummy0: entered promiscuous mode [ 109.774510][ T7758] bridge0: port 3(dummy0) entered blocking state [ 109.786747][ T7758] bridge0: port 3(dummy0) entered disabled state [ 109.789951][ T7765] netlink: 16 bytes leftover after parsing attributes in process `syz.0.617'. [ 109.807739][ T7773] netlink: 'syz.1.620': attribute type 1 has an invalid length. [ 109.816049][ T7773] netlink: 224 bytes leftover after parsing attributes in process `syz.1.620'. [ 109.822713][ T7758] dummy0: entered allmulticast mode [ 109.843665][ T7758] bridge0: port 3(dummy0) entered blocking state [ 109.850207][ T7758] bridge0: port 3(dummy0) entered listening state [ 109.888863][ T7779] netlink: 68 bytes leftover after parsing attributes in process `syz.4.621'. [ 109.978692][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.985958][ C1] bridge0: topology change detected, propagating [ 110.017427][ T7787] xt_l2tp: v2 doesn't support IP mode [ 110.159641][ T3481] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.193236][ T7796] syzkaller1: entered promiscuous mode [ 110.206657][ T7796] syzkaller1: entered allmulticast mode [ 110.275720][ T7803] netlink: 12 bytes leftover after parsing attributes in process `syz.4.629'. [ 110.378668][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 110.386007][ C0] bridge0: topology change detected, propagating [ 110.393254][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 110.400503][ C0] bridge0: topology change detected, propagating [ 110.547603][ T7810] netlink: 'syz.0.632': attribute type 1 has an invalid length. [ 110.702531][ T5973] net_ratelimit: 5 callbacks suppressed [ 110.702550][ T5973] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 110.971721][ T7842] netlink: 12 bytes leftover after parsing attributes in process `syz.0.643'. [ 111.041147][ T7841] syzkaller0: entered promiscuous mode [ 111.046665][ T7841] syzkaller0: entered allmulticast mode [ 111.095760][ T7847] netlink: 4 bytes leftover after parsing attributes in process `syz.2.645'. [ 111.176883][ T7847] macvtap1: entered promiscuous mode [ 111.183473][ T7847] vlan0: entered promiscuous mode [ 111.189698][ T7847] macvtap1: entered allmulticast mode [ 111.195365][ T7847] vlan0: entered allmulticast mode [ 111.202285][ T7847] veth0_vlan: entered allmulticast mode [ 111.210929][ T7850] syzkaller1: entered promiscuous mode [ 111.216759][ T7850] syzkaller1: entered allmulticast mode [ 111.330064][ T6483] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 111.456305][ C1] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 111.468721][ C1] IPv6: bridge0: IPv6 duplicate address fe80::a8aa:aaff:feaa:aa1c used by aa:aa:aa:aa:aa:1c detected! [ 111.626343][ T7874] openvswitch: netlink: VXLAN extension 30 out of range max 1 [ 111.677083][ T7881] FAULT_INJECTION: forcing a failure. [ 111.677083][ T7881] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 111.717451][ T7881] CPU: 1 UID: 0 PID: 7881 Comm: syz.4.659 Not tainted syzkaller #0 PREEMPT(full) [ 111.717492][ T7881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 111.717502][ T7881] Call Trace: [ 111.717509][ T7881] [ 111.717516][ T7881] dump_stack_lvl+0x189/0x250 [ 111.717545][ T7881] ? __pfx____ratelimit+0x10/0x10 [ 111.717564][ T7881] ? __pfx_dump_stack_lvl+0x10/0x10 [ 111.717582][ T7881] ? __pfx__printk+0x10/0x10 [ 111.717606][ T7881] ? fs_reclaim_acquire+0x7d/0x100 [ 111.717637][ T7881] should_fail_ex+0x414/0x560 [ 111.717660][ T7881] prepare_alloc_pages+0x213/0x610 [ 111.717690][ T7881] __alloc_frozen_pages_noprof+0x123/0x370 [ 111.717717][ T7881] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 111.717750][ T7881] ? policy_nodemask+0x27c/0x720 [ 111.717777][ T7881] alloc_pages_mpol+0x232/0x4a0 [ 111.717805][ T7881] alloc_pages_noprof+0xa9/0x190 [ 111.717829][ T7881] pte_alloc_one+0x23/0x310 [ 111.717845][ T7881] ? __pte_alloc+0x1d/0x1a0 [ 111.717869][ T7881] __pte_alloc+0x25/0x1a0 [ 111.717894][ T7881] __handle_mm_fault+0x49b0/0x5420 [ 111.717930][ T7881] ? __pfx___handle_mm_fault+0x10/0x10 [ 111.717969][ T7881] ? find_vma+0xe7/0x160 [ 111.717986][ T7881] ? __pfx_find_vma+0x10/0x10 [ 111.718007][ T7881] handle_mm_fault+0x40a/0x8e0 [ 111.718037][ T7881] do_user_addr_fault+0x764/0x1380 [ 111.718077][ T7881] exc_page_fault+0x82/0x100 [ 111.718101][ T7881] asm_exc_page_fault+0x26/0x30 [ 111.718117][ T7881] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 111.718133][ T7881] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 8d 48 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 111.718147][ T7881] RSP: 0018:ffffc90003827ab8 EFLAGS: 00050202 [ 111.718162][ T7881] RAX: 00007ffffffff001 RBX: 0000000000000018 RCX: 0000000000000018 [ 111.718174][ T7881] RDX: 0000000000000001 RSI: 0000200000000100 RDI: ffffc90003827b60 [ 111.718184][ T7881] RBP: ffffc90003827c90 R08: ffffc90003827b77 R09: 1ffff92000704f6e [ 111.718196][ T7881] R10: dffffc0000000000 R11: fffff52000704f6f R12: dffffc0000000000 [ 111.718208][ T7881] R13: 1ffff92000704f68 R14: ffffc90003827b60 R15: 0000200000000100 [ 111.718238][ T7881] _copy_from_user+0x7a/0xb0 [ 111.718261][ T7881] rfcomm_dev_ioctl+0x119/0x1cf0 [ 111.718288][ T7881] ? kasan_quarantine_put+0xdd/0x220 [ 111.718309][ T7881] ? __pfx_rfcomm_dev_ioctl+0x10/0x10 [ 111.718335][ T7881] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 111.718363][ T7881] ? do_vfs_ioctl+0xbe8/0x1430 [ 111.718380][ T7881] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 111.718403][ T7881] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 111.718430][ T7881] sock_do_ioctl+0xdc/0x300 [ 111.718452][ T7881] ? __pfx_sock_do_ioctl+0x10/0x10 [ 111.718471][ T7881] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 111.718506][ T7881] sock_ioctl+0x576/0x790 [ 111.718532][ T7881] ? __pfx_sock_ioctl+0x10/0x10 [ 111.718557][ T7881] ? __fget_files+0x3a0/0x420 [ 111.718569][ T7881] ? __fget_files+0x2a/0x420 [ 111.718585][ T7881] ? bpf_lsm_file_ioctl+0x9/0x20 [ 111.718599][ T7881] ? __pfx_sock_ioctl+0x10/0x10 [ 111.718615][ T7881] __se_sys_ioctl+0xfc/0x170 [ 111.718635][ T7881] do_syscall_64+0xfa/0xf80 [ 111.718654][ T7881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.718667][ T7881] ? clear_bhb_loop+0x60/0xb0 [ 111.718684][ T7881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 111.718698][ T7881] RIP: 0033:0x7eff49b8f749 [ 111.718713][ T7881] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 111.718724][ T7881] RSP: 002b:00007eff4aac5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 111.718738][ T7881] RAX: ffffffffffffffda RBX: 00007eff49de5fa0 RCX: 00007eff49b8f749 [ 111.718747][ T7881] RDX: 0000200000000100 RSI: 00000000800452d3 RDI: 0000000000000004 [ 111.718756][ T7881] RBP: 00007eff4aac5090 R08: 0000000000000000 R09: 0000000000000000 [ 111.718765][ T7881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 111.718774][ T7881] R13: 00007eff49de6038 R14: 00007eff49de5fa0 R15: 00007ffcf4c44838 [ 111.718802][ T7881] [ 112.116578][ C1] bridge0: port 3(dummy0) entered learning state [ 112.123618][ T142] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 112.138044][ T5973] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 112.179156][ T7889] netlink: 88 bytes leftover after parsing attributes in process `syz.1.663'. [ 112.261795][ T7895] netlink: 'syz.2.664': attribute type 21 has an invalid length. [ 112.269710][ T7895] netlink: 168 bytes leftover after parsing attributes in process `syz.2.664'. [ 112.283378][ T7895] IPv6: Can't replace route, no match found [ 112.545727][ T7907] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 112.587274][ T7913] netlink: 32 bytes leftover after parsing attributes in process `syz.4.673'. [ 112.766850][ T7926] syzkaller0: entered promiscuous mode [ 112.775953][ T7926] syzkaller0: entered allmulticast mode [ 112.935338][ T7936] netlink: 'syz.2.683': attribute type 1 has an invalid length. [ 113.002192][ T7936] bond2: (slave gretap1): making interface the new active one [ 113.022509][ T7936] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 113.032483][ T3481] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 113.045563][ T3481] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 113.056487][ T3481] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 113.179545][ T5973] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 113.235724][ T7952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 113.271995][ T7956] FAULT_INJECTION: forcing a failure. [ 113.271995][ T7956] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.288067][ T7956] CPU: 1 UID: 0 PID: 7956 Comm: syz.2.691 Not tainted syzkaller #0 PREEMPT(full) [ 113.288091][ T7956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 113.288101][ T7956] Call Trace: [ 113.288107][ T7956] [ 113.288114][ T7956] dump_stack_lvl+0x189/0x250 [ 113.288135][ T7956] ? __pfx____ratelimit+0x10/0x10 [ 113.288154][ T7956] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.288172][ T7956] ? __pfx__printk+0x10/0x10 [ 113.288190][ T7956] ? __might_fault+0xb0/0x130 [ 113.288216][ T7956] should_fail_ex+0x414/0x560 [ 113.288237][ T7956] _copy_from_iter+0x1cd/0x1630 [ 113.288257][ T7956] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 113.288286][ T7956] ? policy_nodemask+0x27c/0x720 [ 113.288306][ T7956] ? __pfx__copy_from_iter+0x10/0x10 [ 113.288333][ T7956] ? set_page_refcounted+0xa0/0x1e0 [ 113.288354][ T7956] ? page_copy_sane+0x4e/0x280 [ 113.288382][ T7956] copy_page_from_iter+0xdd/0x170 [ 113.288407][ T7956] tun_get_user+0x1d40/0x3dc0 [ 113.288433][ T7956] ? tun_get_user+0x6fc/0x3dc0 [ 113.288466][ T7956] ? aa_file_perm+0x44c/0x1530 [ 113.288482][ T7956] ? __pfx_tun_get_user+0x10/0x10 [ 113.288505][ T7956] ? __lock_acquire+0x6b6/0x2cf0 [ 113.288523][ T7956] ? kstrtoull+0x12f/0x1d0 [ 113.288548][ T7956] ? ref_tracker_alloc+0x318/0x460 [ 113.288572][ T7956] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 113.288593][ T7956] ? tun_get+0x1c/0x2f0 [ 113.288618][ T7956] ? tun_get+0x1c/0x2f0 [ 113.288638][ T7956] ? tun_get+0x1c/0x2f0 [ 113.288664][ T7956] tun_chr_write_iter+0x113/0x200 [ 113.288687][ T7956] vfs_write+0x5c9/0xb30 [ 113.288712][ T7956] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 113.288734][ T7956] ? __pfx_vfs_write+0x10/0x10 [ 113.288764][ T7956] ? __fget_files+0x2a/0x420 [ 113.288788][ T7956] ksys_write+0x145/0x250 [ 113.288808][ T7956] ? __pfx_ksys_write+0x10/0x10 [ 113.288830][ T7956] ? do_syscall_64+0xbe/0xf80 [ 113.288853][ T7956] do_syscall_64+0xfa/0xf80 [ 113.288873][ T7956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.288889][ T7956] ? clear_bhb_loop+0x60/0xb0 [ 113.288908][ T7956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.288924][ T7956] RIP: 0033:0x7fc6eb38e1ff [ 113.288938][ T7956] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 113.288951][ T7956] RSP: 002b:00007fc6ec190000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 113.288969][ T7956] RAX: ffffffffffffffda RBX: 00007fc6eb5e5fa0 RCX: 00007fc6eb38e1ff [ 113.288980][ T7956] RDX: 000000000000007e RSI: 0000200000000300 RDI: 00000000000000c8 [ 113.288990][ T7956] RBP: 00007fc6ec190090 R08: 0000000000000000 R09: 0000000000000000 [ 113.289000][ T7956] R10: 000000000000007e R11: 0000000000000293 R12: 0000000000000001 [ 113.289009][ T7956] R13: 00007fc6eb5e6038 R14: 00007fc6eb5e5fa0 R15: 00007ffd2fbe2058 [ 113.289038][ T7956] [ 114.138920][ C1] bridge0: port 3(dummy0) entered forwarding state [ 114.145477][ C1] bridge0: topology change detected, propagating [ 114.193308][ T7993] tipc: Enabled bearer , priority 0 [ 114.202970][ T7992] tipc: Resetting bearer [ 114.320602][ T7991] tipc: Disabling bearer [ 114.704338][ T8016] pimreg: entered allmulticast mode [ 114.837826][ T8031] netlink: 'syz.1.720': attribute type 1 has an invalid length. [ 114.898614][ T8031] __nla_validate_parse: 5 callbacks suppressed [ 114.898632][ T8031] netlink: 12 bytes leftover after parsing attributes in process `syz.1.720'. [ 115.007607][ T8045] netlink: 76 bytes leftover after parsing attributes in process `syz.2.725'. [ 115.116580][ T8055] netlink: 'syz.1.730': attribute type 1 has an invalid length. [ 115.126105][ T8055] netlink: 'syz.1.730': attribute type 3 has an invalid length. [ 115.137176][ T8055] netlink: 'syz.1.730': attribute type 7 has an invalid length. [ 115.157502][ T8055] netlink: 'syz.1.730': attribute type 8 has an invalid length. [ 115.170831][ T8055] netlink: 184 bytes leftover after parsing attributes in process `syz.1.730'. [ 115.185271][ T8055] NCSI netlink: No device for ifindex 131092 [ 115.236249][ T8065] netlink: 'syz.3.728': attribute type 4 has an invalid length. [ 115.281274][ T8052] netlink: 'syz.3.728': attribute type 4 has an invalid length. [ 115.340905][ T8062] netlink: 24 bytes leftover after parsing attributes in process `syz.3.728'. [ 115.428755][ T8052] netlink: 'syz.3.728': attribute type 1 has an invalid length. [ 115.486294][ T8078] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 115.543536][ T8078] bond1 (unregistering): Released all slaves [ 115.564896][ T8088] netlink: 12 bytes leftover after parsing attributes in process `syz.4.738'. [ 115.793405][ T8103] net_ratelimit: 10 callbacks suppressed [ 115.793415][ T8103] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 115.796709][ T8106] openvswitch: netlink: Duplicate or invalid key (type 0). [ 115.853406][ T8106] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 116.073822][ T8122] xt_l2tp: v2 doesn't support IP mode [ 116.360035][ T8133] netlink: 'syz.2.755': attribute type 1 has an invalid length. [ 116.367727][ T8133] netlink: 224 bytes leftover after parsing attributes in process `syz.2.755'. [ 116.511808][ T8145] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 116.675387][ T8149] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 117.012750][ T8191] netlink: 12 bytes leftover after parsing attributes in process `syz.4.769'. [ 117.035853][ T8186] tipc: Enabled bearer , priority 0 [ 117.049236][ T8190] syzkaller0: entered promiscuous mode [ 117.054742][ T8190] syzkaller0: entered allmulticast mode [ 117.115019][ T8190] tipc: Resetting bearer [ 117.154934][ T8190] tipc: Disabling bearer [ 117.182952][ T8198] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 117.347927][ T8209] netlink: 'syz.1.773': attribute type 5 has an invalid length. [ 117.359870][ T8216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.775'. [ 117.377436][ T8216] netlink: 4 bytes leftover after parsing attributes in process `syz.2.775'. [ 117.417874][ T8221] netlink: 24 bytes leftover after parsing attributes in process `syz.3.778'. [ 117.492851][ T8226] FAULT_INJECTION: forcing a failure. [ 117.492851][ T8226] name failslab, interval 1, probability 0, space 0, times 0 [ 117.527983][ T8226] CPU: 1 UID: 0 PID: 8226 Comm: syz.2.780 Not tainted syzkaller #0 PREEMPT(full) [ 117.528006][ T8226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 117.528015][ T8226] Call Trace: [ 117.528022][ T8226] [ 117.528029][ T8226] dump_stack_lvl+0x189/0x250 [ 117.528052][ T8226] ? __pfx____ratelimit+0x10/0x10 [ 117.528072][ T8226] ? __pfx_dump_stack_lvl+0x10/0x10 [ 117.528089][ T8226] ? __pfx__printk+0x10/0x10 [ 117.528115][ T8226] ? __pfx___might_resched+0x10/0x10 [ 117.528131][ T8226] ? fs_reclaim_acquire+0x7d/0x100 [ 117.528156][ T8226] should_fail_ex+0x414/0x560 [ 117.528180][ T8226] should_failslab+0xa8/0x100 [ 117.528204][ T8226] __kmalloc_noprof+0xcb/0x800 [ 117.528222][ T8226] ? ethnl_default_start+0x117/0x3e0 [ 117.528240][ T8226] ? __kasan_kmalloc+0x93/0xb0 [ 117.528265][ T8226] ethnl_default_start+0x117/0x3e0 [ 117.528287][ T8226] genl_start+0x4c3/0x6c0 [ 117.528315][ T8226] __netlink_dump_start+0x469/0x7e0 [ 117.528348][ T8226] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 117.528372][ T8226] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 117.528390][ T8226] ? genl_get_cmd+0x67f/0x910 [ 117.528416][ T8226] ? __pfx_genl_start+0x10/0x10 [ 117.528432][ T8226] ? __pfx_genl_dumpit+0x10/0x10 [ 117.528449][ T8226] ? __pfx_genl_done+0x10/0x10 [ 117.528482][ T8226] genl_rcv_msg+0x5da/0x790 [ 117.528507][ T8226] ? __pfx_genl_rcv_msg+0x10/0x10 [ 117.528524][ T8226] ? __pfx_ethnl_default_start+0x10/0x10 [ 117.528539][ T8226] ? __pfx_ethnl_default_dumpit+0x10/0x10 [ 117.528558][ T8226] ? __pfx_ethnl_default_done+0x10/0x10 [ 117.528587][ T8226] netlink_rcv_skb+0x208/0x470 [ 117.528603][ T8226] ? __pfx_genl_rcv_msg+0x10/0x10 [ 117.528625][ T8226] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 117.528659][ T8226] ? down_read+0x274/0x2e0 [ 117.528688][ T8226] ? genl_rcv+0xd/0x40 [ 117.528710][ T8226] genl_rcv+0x28/0x40 [ 117.528727][ T8226] netlink_unicast+0x82f/0x9e0 [ 117.528758][ T8226] ? __pfx_netlink_unicast+0x10/0x10 [ 117.528782][ T8226] ? netlink_sendmsg+0x642/0xb30 [ 117.528796][ T8226] ? skb_put+0x11b/0x210 [ 117.528821][ T8226] netlink_sendmsg+0x805/0xb30 [ 117.528853][ T8226] ? __pfx_netlink_sendmsg+0x10/0x10 [ 117.528874][ T8226] ? aa_sock_msg_perm+0xf1/0x1b0 [ 117.528893][ T8226] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 117.528914][ T8226] ? __pfx_netlink_sendmsg+0x10/0x10 [ 117.528931][ T8226] __sock_sendmsg+0x21c/0x270 [ 117.528951][ T8226] ____sys_sendmsg+0x505/0x820 [ 117.528978][ T8226] ? __pfx_____sys_sendmsg+0x10/0x10 [ 117.529010][ T8226] ? import_iovec+0x74/0xa0 [ 117.529035][ T8226] ___sys_sendmsg+0x21f/0x2a0 [ 117.529061][ T8226] ? __pfx____sys_sendmsg+0x10/0x10 [ 117.529091][ T8226] ? rcu_read_lock_any_held+0xb3/0x120 [ 117.529139][ T8226] ? __fget_files+0x2a/0x420 [ 117.529152][ T8226] ? __fget_files+0x3a0/0x420 [ 117.529176][ T8226] __x64_sys_sendmsg+0x19b/0x260 [ 117.529202][ T8226] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 117.529234][ T8226] ? __pfx_ksys_write+0x10/0x10 [ 117.529258][ T8226] ? do_syscall_64+0xbe/0xf80 [ 117.529282][ T8226] do_syscall_64+0xfa/0xf80 [ 117.529303][ T8226] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.529318][ T8226] ? clear_bhb_loop+0x60/0xb0 [ 117.529339][ T8226] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 117.529353][ T8226] RIP: 0033:0x7fc6eb38f749 [ 117.529369][ T8226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 117.529392][ T8226] RSP: 002b:00007fc6ec190038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 117.529411][ T8226] RAX: ffffffffffffffda RBX: 00007fc6eb5e5fa0 RCX: 00007fc6eb38f749 [ 117.529422][ T8226] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 117.529432][ T8226] RBP: 00007fc6ec190090 R08: 0000000000000000 R09: 0000000000000000 [ 117.529442][ T8226] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 117.529452][ T8226] R13: 00007fc6eb5e6038 R14: 00007fc6eb5e5fa0 R15: 00007ffd2fbe2058 [ 117.529483][ T8226] [ 117.915345][ T8221] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 117.934765][ T8230] IPv6: Can't replace route, no match found [ 117.974462][ T8221] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 118.012877][ T8221] bond0 (unregistering): Released all slaves [ 118.168944][ T8242] syzkaller0: entered promiscuous mode [ 118.174458][ T8242] syzkaller0: entered allmulticast mode [ 118.388793][ T8254] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 118.769147][ T8286] erspan0: entered promiscuous mode [ 118.854374][ T8292] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.861625][ T8292] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.869203][ T8292] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.876362][ T8292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.914278][ T8292] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 119.443782][ T8337] Cannot find set identified by id 0 to match [ 119.543891][ T8340] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 120.117446][ T8362] team0 (unregistering): Port device team_slave_0 removed [ 120.135064][ T8384] __nla_validate_parse: 10 callbacks suppressed [ 120.135081][ T8384] netlink: 88 bytes leftover after parsing attributes in process `syz.4.835'. [ 120.148173][ T8362] team0 (unregistering): Port device team_slave_1 removed [ 120.183083][ T8384] netlink: 76 bytes leftover after parsing attributes in process `syz.4.835'. [ 120.203940][ T8384] netlink: 88 bytes leftover after parsing attributes in process `syz.4.835'. [ 120.385754][ T8394] netlink: 8 bytes leftover after parsing attributes in process `syz.0.841'. [ 120.707869][ T8427] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 120.714721][ T8427] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 120.730860][ T8428] netlink: 88 bytes leftover after parsing attributes in process `syz.3.849'. [ 120.756083][ T8428] netlink: 76 bytes leftover after parsing attributes in process `syz.3.849'. [ 120.764824][ T8431] validate_nla: 5 callbacks suppressed [ 120.764841][ T8431] netlink: 'syz.0.850': attribute type 9 has an invalid length. [ 120.766863][ T8428] netlink: 88 bytes leftover after parsing attributes in process `syz.3.849'. [ 120.770781][ T8431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.850'. [ 120.801916][ T8432] unsupported nlmsg_type 40 [ 120.997273][ T8443] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 121.106737][ T8453] netlink: 64 bytes leftover after parsing attributes in process `syz.4.859'. [ 121.115683][ T8453] netlink: 64 bytes leftover after parsing attributes in process `syz.4.859'. [ 121.171651][ T8456] syzkaller0: entered promiscuous mode [ 121.177292][ T8456] syzkaller0: entered allmulticast mode [ 121.275829][ T8460] FAULT_INJECTION: forcing a failure. [ 121.275829][ T8460] name failslab, interval 1, probability 0, space 0, times 0 [ 121.303017][ T8460] CPU: 0 UID: 0 PID: 8460 Comm: syz.0.862 Not tainted syzkaller #0 PREEMPT(full) [ 121.303043][ T8460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 121.303053][ T8460] Call Trace: [ 121.303060][ T8460] [ 121.303067][ T8460] dump_stack_lvl+0x189/0x250 [ 121.303097][ T8460] ? __pfx____ratelimit+0x10/0x10 [ 121.303118][ T8460] ? __pfx_dump_stack_lvl+0x10/0x10 [ 121.303136][ T8460] ? __pfx__printk+0x10/0x10 [ 121.303163][ T8460] ? __pfx___might_resched+0x10/0x10 [ 121.303180][ T8460] ? fs_reclaim_acquire+0x7d/0x100 [ 121.303206][ T8460] should_fail_ex+0x414/0x560 [ 121.303231][ T8460] should_failslab+0xa8/0x100 [ 121.303255][ T8460] kmem_cache_alloc_lru_noprof+0x79/0x6d0 [ 121.303276][ T8460] ? __d_alloc+0x37/0x6f0 [ 121.303292][ T8460] ? __debug_object_init+0x102/0x4b0 [ 121.303313][ T8460] __d_alloc+0x37/0x6f0 [ 121.303335][ T8460] d_alloc_pseudo+0x21/0xc0 [ 121.303354][ T8460] alloc_file_pseudo+0xcc/0x210 [ 121.303374][ T8460] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 121.303397][ T8460] ? alloc_fd+0x64c/0x6c0 [ 121.303424][ T8460] sock_alloc_file+0xb8/0x2e0 [ 121.303442][ T8460] ? __sys_socket+0x12e/0x320 [ 121.303464][ T8460] __sys_socket+0x13e/0x320 [ 121.303488][ T8460] __x64_sys_socket+0x7a/0x90 [ 121.303508][ T8460] do_syscall_64+0xfa/0xf80 [ 121.303529][ T8460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.303546][ T8460] ? clear_bhb_loop+0x60/0xb0 [ 121.303566][ T8460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.303587][ T8460] RIP: 0033:0x7fba4ef91667 [ 121.303604][ T8460] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 121.303618][ T8460] RSP: 002b:00007fba4fdcffa8 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 121.303637][ T8460] RAX: ffffffffffffffda RBX: 00007fba4f1e5fa0 RCX: 00007fba4ef91667 [ 121.303649][ T8460] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 121.303659][ T8460] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 121.303669][ T8460] R10: 0000200000000280 R11: 0000000000000286 R12: 0000000000000001 [ 121.303680][ T8460] R13: 00007fba4f1e6038 R14: 00007fba4f1e5fa0 R15: 00007ffc8b2cbc08 [ 121.303710][ T8460] [ 121.303826][ T8460] VFS_BUG_ON_INODE(inode_state_read_once(inode) & I_CLEAR) encountered for inode ffff8880579eee00 [ 121.303826][ T8460] fs sockfs mode 140777 opflags 0x8 flags 0x0 state 0x300 count 0 [ 121.545445][ T8460] ------------[ cut here ]------------ [ 121.551006][ T8460] kernel BUG at fs/inode.c:1971! [ 121.556005][ T8460] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 121.562258][ T8460] CPU: 0 UID: 0 PID: 8460 Comm: syz.0.862 Not tainted syzkaller #0 PREEMPT(full) [ 121.571445][ T8460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 121.581488][ T8460] RIP: 0010:iput+0xfc9/0x1030 [ 121.586155][ T8460] Code: 8b 7c 24 18 48 c7 c6 a0 df 79 8b e8 e1 58 e8 fe 90 0f 0b e8 e9 6b 81 ff 48 8b 7c 24 18 48 c7 c6 40 df 79 8b e8 c8 58 e8 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef [ 121.605742][ T8460] RSP: 0018:ffffc90003eefde8 EFLAGS: 00010282 [ 121.611796][ T8460] RAX: 000000000000009f RBX: dffffc0000000000 RCX: 3b6a4d599f13d300 [ 121.619759][ T8460] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 121.627733][ T8460] RBP: 1ffffffff1ed620e R08: ffffc90003eefaa7 R09: 1ffff920007ddf54 [ 121.635694][ T8460] R10: dffffc0000000000 R11: fffff520007ddf55 R12: 1ffff1100af3de00 [ 121.643657][ T8460] R13: ffff8880579ef000 R14: 0000000000000200 R15: 1ffffffff1f01192 [ 121.651615][ T8460] FS: 00007fba4fdd16c0(0000) GS:ffff8881260b0000(0000) knlGS:0000000000000000 [ 121.660535][ T8460] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 121.667111][ T8460] CR2: 000000110c3745c8 CR3: 000000003094e000 CR4: 00000000003526f0 [ 121.675077][ T8460] Call Trace: [ 121.678363][ T8460] [ 121.681303][ T8460] ? do_raw_spin_unlock+0x122/0x240 [ 121.686509][ T8460] __sys_socket+0x2bf/0x320 [ 121.691006][ T8460] __x64_sys_socket+0x7a/0x90 [ 121.695696][ T8460] do_syscall_64+0xfa/0xf80 [ 121.700191][ T8460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.706247][ T8460] ? clear_bhb_loop+0x60/0xb0 [ 121.710912][ T8460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.716798][ T8460] RIP: 0033:0x7fba4ef91667 [ 121.721200][ T8460] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 121.740796][ T8460] RSP: 002b:00007fba4fdcffa8 EFLAGS: 00000286 ORIG_RAX: 0000000000000029 [ 121.749206][ T8460] RAX: ffffffffffffffda RBX: 00007fba4f1e5fa0 RCX: 00007fba4ef91667 [ 121.757169][ T8460] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010 [ 121.765127][ T8460] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 121.773085][ T8460] R10: 0000200000000280 R11: 0000000000000286 R12: 0000000000000001 [ 121.781040][ T8460] R13: 00007fba4f1e6038 R14: 00007fba4f1e5fa0 R15: 00007ffc8b2cbc08 [ 121.789007][ T8460] [ 121.792011][ T8460] Modules linked in: [ 121.796646][ T8460] ---[ end trace 0000000000000000 ]--- [ 121.807820][ T8460] RIP: 0010:iput+0xfc9/0x1030 [ 121.812662][ T8460] Code: 8b 7c 24 18 48 c7 c6 a0 df 79 8b e8 e1 58 e8 fe 90 0f 0b e8 e9 6b 81 ff 48 8b 7c 24 18 48 c7 c6 40 df 79 8b e8 c8 58 e8 fe 90 <0f> 0b 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c cd fb ff ff 4c 89 ef [ 121.832700][ T8460] RSP: 0018:ffffc90003eefde8 EFLAGS: 00010282 [ 121.838991][ T8460] RAX: 000000000000009f RBX: dffffc0000000000 RCX: 3b6a4d599f13d300 [ 121.848266][ T8460] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 121.861471][ T8460] RBP: 1ffffffff1ed620e R08: ffffc90003eefaa7 R09: 1ffff920007ddf54 [ 121.872750][ T8460] R10: dffffc0000000000 R11: fffff520007ddf55 R12: 1ffff1100af3de00 [ 121.881602][ T8460] R13: ffff8880579ef000 R14: 0000000000000200 R15: 1ffffffff1f01192 [ 121.889856][ T8460] FS: 00007fba4fdd16c0(0000) GS:ffff8881261b0000(0000) knlGS:0000000000000000 [ 121.899702][ T8460] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 121.906314][ T8460] CR2: 00007fc6eb5b7198 CR3: 000000003094e000 CR4: 00000000003526f0 [ 121.914589][ T8460] Kernel panic - not syncing: Fatal exception [ 121.921092][ T8460] Kernel Offset: disabled [ 121.925493][ T8460] Rebooting in 86400 seconds..