last executing test programs: 2.96163066s ago: executing program 0 (id=858): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x24, 0x2f, 0x9, 0x70bd27, 0x800000, {0x4, 0x0, 0x500}, [@typed={0x4, 0xe, 0x0, 0x0, @binary}, @nested={0xc, 0x9, 0x0, 0x1, [@typed={0x6, 0xae, 0x0, 0x0, @str='/\x00'}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 2.551683895s ago: executing program 2 (id=864): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f00000006c0)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xfffffffb, @remote, 0x5}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)='.', 0x1}], 0x1}}], 0x1, 0x0) shutdown(r2, 0x1) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000000)={r6, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f0000000400)={r6, @in6={{0xa, 0x4e20, 0xffffffff, @private2, 0x7}}}, 0x90) getsockopt$inet_sctp_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f00000001c0)={r4, 0x10001, 0x9, 0x0, 0x646, 0x4e84, 0x6, 0x1, {r4, @in={{0x2, 0x4e23, @remote}}, 0xc0, 0xd8000000, 0x0, 0x7, 0x5}}, &(0x7f0000000280)=0xb0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f0000000540)={r7, @in6={{0xa, 0x4e23, 0xab9, @loopback, 0x8}}}, &(0x7f0000000100)=0x84) sendto$inet(r1, 0x0, 0x0, 0x20000800, &(0x7f0000000040)={0x2, 0x3, @remote}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa5a01f3c2f136083a0001080006040002aaaaaaaaaaaaac1414bbaaaabbaaaaaaac1414bb"], 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r8, 0x10e, 0xb, &(0x7f0000000000)=0x2, 0x4) sendmsg$nl_route_sched(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@gettaction={0x20, 0x32, 0x605, 0x70bd25, 0x25dfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x20}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x5c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0xe803, 0x0, {0x9, 0x1}, {0x4}, {0xe, 0xd}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}, @TCA_INGRESS_BLOCK={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x90}, 0x4000c00) 2.385075196s ago: executing program 0 (id=865): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000680)=@newlink={0x58, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3, 0x2040000}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x20, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x8, 0xc}}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x58}}, 0x0) 2.287272478s ago: executing program 3 (id=867): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYRESHEX, @ANYRES32=r2, @ANYBLOB="3c00238005000500"], 0x6c}, 0x1, 0x0, 0x0, 0x85}, 0x2004c850) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) unshare(0x6a020400) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = accept4(r5, 0x0, 0x0, 0x80000) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x38, 0x1410, 0x8b7fbbc5948fecd9, 0x70bd29, 0x25dfd9fc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000280)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000340)={r8, 0x5, 0x10}, 0xc) recvmmsg(r6, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc804}, 0x40c2010) socket(0x400000000010, 0x3, 0x0) r9 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="d7010000400000001800000000000000000000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xa5}, 0x90) getsockopt$EBT_SO_GET_INFO(r9, 0x0, 0x80, &(0x7f00000001c0)={'filter\x00', 0x0, 0x0, 0x1e01, [0x8, 0x401, 0x7, 0x10000003, 0x911f, 0x100000001]}, &(0x7f0000000080)=0x78) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x7c, 0x2, 0x7, 0x3, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x2}, @NFACCT_FILTER={0x34, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x7}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x80000002}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x9}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x8001}]}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0xc466}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x3}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x6}]}, 0x7c}, 0x1, 0x0, 0x0, 0x48080}, 0x41) 2.278552145s ago: executing program 0 (id=868): unshare(0x6020400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x2b, 0x80801, 0x1) poll(&(0x7f00000000c0)=[{r1, 0x1040}, {r0, 0x2187}], 0x2, 0x403) r2 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000780)={@broadcast, @random="6487a2bed3d6", @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x6c, 0x0, @private}}}}}, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000000)={0x0, @multicast2, @initdev}, &(0x7f0000000100)=0xc) bind$xdp(r1, &(0x7f0000000140)={0x2c, 0xd, r3, 0x29}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r2, 0x0, 0xc, &(0x7f0000000040)=0xfffffffc, 0x4) recvmmsg(r2, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) connect$l2tp(r1, &(0x7f0000000180)={0x2, 0x0, @empty, 0x4}, 0x10) 1.920459308s ago: executing program 4 (id=870): r0 = socket(0x2, 0x80805, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc090) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWSET={0x14, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000000d0a010800000000000000000a0000010900020073794f9d34861c2e6308d05543b513597a31000000000900010073797a3100000000200003801c0000800c000180060001001e1c00000c000a800600010057b80000"], 0x4c}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f0000003440)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x9, @dev={0xfe, 0x80, '\x00', 0xe}, 0x5}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000000)="f2", 0x1}], 0x1}}, {{&(0x7f0000000840)={0xa, 0x4e24, 0x9, @remote, 0x8}, 0x1c, &(0x7f0000000d00)=[{&(0x7f0000000880)="127d", 0x2}], 0x1}}], 0x2, 0x0) shutdown(r5, 0x1) getsockopt$bt_hci(r3, 0x84, 0x85, &(0x7f0000002380)=""/4107, &(0x7f00000000c0)=0x100b) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000016c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="01002abd7000fddbdf253b00000008000300", @ANYRES32=r6, @ANYBLOB="8f15bd95963324f7526cf90a1f555e3be6ada25f71aa51f3b2ce0d257a614bf3102bd9dcc73fc559e62f5a3a69d981a8e11db39da54071fc5c450c16a34d2b88f4a20bf5bf6625b9edefd5e8dfab8092e4f3fedcc28ed6bd0b30b13ff050ab6e4ed0a55b2d48bd25aa37d91fc6aafb57"], 0x1c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_ASSOCIATE(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x28}}, 0xc00) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r8, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x4, @empty}}) getsockopt$bt_hci(r0, 0x84, 0x80, 0x0, &(0x7f0000001080)) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) close(0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r11, 0x0, r12, 0x0, 0xf3a, 0x0) splice(r9, 0x0, r12, 0x0, 0x80, 0x8) write(r10, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1.595095157s ago: executing program 2 (id=872): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newtaction={0x48, 0x30, 0x627, 0x7ffffd, 0x0, {}, [{0x34, 0x1, [@m_gact={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}, 0x48}}, 0x4010) r0 = socket$kcm(0x21, 0x2, 0xa) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newlink={0x60, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x232df, 0x5086a}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x800, 0xcfc, 0x1}}]}]}, @IFLA_IFALIAS={0x14, 0x14, 'bond0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0xc1}, 0x880) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@gettaction={0x1c, 0x32, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000100100000b00"], 0x40}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f00000000c0)) ioctl$NILFS_IOCTL_SET_ALLOC_RANGE(0xffffffffffffffff, 0x40106e8c, &(0x7f00000002c0)=[0xa0eb, 0xf13d]) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=r4, @ANYBLOB="00300000000000003c011a803800048034"], 0x5c}, 0x1, 0x0, 0x0, 0x800c000}, 0x4000) 1.473192438s ago: executing program 0 (id=873): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x24000000, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x7}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xcc}}, 0x0) 1.393244521s ago: executing program 2 (id=874): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r1, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r2 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)=ANY=[], 0x57) setsockopt$inet_mreqsrc(r0, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) 1.375944977s ago: executing program 0 (id=875): unshare(0x20400) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="00001000252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646, 0x10c04}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8, 0xb, r2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40e95}, 0x20048040) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0x2d, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x400}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x200}, @exit, @generic={0xff, 0xd, 0x7, 0x9, 0x88}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}, @jmp={0x5, 0x0, 0x9, 0x1, 0x5, 0x80, 0x3}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}, @func={0x85, 0x0, 0x1, 0x0, 0x1}, @printk={@lu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x40}}]}, &(0x7f0000000500)='GPL\x00', 0xf, 0x61, &(0x7f0000000680)=""/97, 0x40f00, 0x31, '\x00', r2, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000740)={0x2, 0x10, 0xcf, 0x81}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000780)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x2}, 0x94) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r8, @ANYBLOB="060015000700fdff0c00168008000100", @ANYRES32=r7], 0x38}}, 0x20044804) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r9) sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000a80)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x85080001}, 0xc, &(0x7f0000000a40)={&(0x7f00000009c0)=ANY=[@ANYBLOB="007035bf", @ANYRES16=r10, @ANYBLOB="000129bd7000fddbdf25010000000000000008410000004c0018fffffffc75647000"/98], 0x68}, 0x1, 0x0, 0x0, 0x44040}, 0x20004005) r11 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000880)={0xffffffffffffffff}, 0x4) r12 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffbfffff01"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x17, &(0x7f0000000240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r12}}, {}, [@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4d}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000380)='GPL\x00', 0x6, 0x6, &(0x7f00000004c0)=""/6, 0x40f00, 0xa, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) r13 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000900)=@generic={&(0x7f00000008c0)='./file0\x00'}, 0x18) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=@newlink={0x68, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x63148, 0x3f00}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_XDP={0x24, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r6}, @IFLA_XDP_FD={0x8, 0x1, r7}, @IFLA_XDP_FD={0x8, 0x1, r11}, @IFLA_XDP_FD={0x8, 0x1, r13}]}, @IFLA_GSO_MAX_SEGS={0x8, 0x28, 0xf48f}]}, 0x68}, 0x1, 0x0, 0x0, 0x20004081}, 0x40000) r14 = socket(0x1e, 0x1, 0x1) setsockopt$XDP_UMEM_REG(r14, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/76, 0x2000, 0x2800, 0xfffffffd}, 0x20) bind$inet(r14, &(0x7f0000000180)={0x2, 0x4e21, @multicast1}, 0x10) 1.093540128s ago: executing program 1 (id=878): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r1) sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x24, r2, 0x400, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xfa5}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x80800) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000400)={&(0x7f0000000240)=ANY=[@ANYBLOB="9f700164180000001bc80000140000f40c00"], &(0x7f0000001f80)=""/226, 0x18, 0xe2, 0x9}, 0x28) sendmmsg$inet6(r0, &(0x7f0000002400)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000080)=[{&(0x7f0000000000)="7f", 0x1}], 0x1}}, {{&(0x7f0000000180)={0xa, 0x4e21, 0x100, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}, 0x1c, &(0x7f00000003c0)=[{&(0x7f00000001c0)='_', 0x1}], 0x1}}], 0x2, 0x20040140) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000afdfc84e00009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 1.090607938s ago: executing program 3 (id=879): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001040), r1) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fbdbdf25010000004000000002410000001000137564703a73797a3200000000"], 0x2c}, 0x1, 0x0, 0x0, 0x50}, 0x4000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB='\b\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000001000000080000001400028004000400080002000000000004000100180001801400020073797a5f74756e000000000000000000"], 0x40}}, 0x4048086) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_0\x00'}) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000180)}, 0x10) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x8}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x158, 0x2c, 0xd27, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x9, 0xf}, {}, {0x10, 0x5}}, [@filter_kind_options=@f_flow={{0x9}, {0x128, 0x2, [@TCA_FLOW_EMATCHES={0x124, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x110, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0x10c, 0x1, 0x0, 0x0, {{0xe6a7, 0x0, 0xfffe}, "77ae5018f5b05e8be1daf07edc8b5408d13a67efc185afcf80247e9aa4f89e1e0be8b3f16bb7d9843adad91f47cc7215bc01be6e2d5b0a5724ebf2f7ab74b2042db5efe9d0e29b99b7f6e7754a0189fdc6ed128555bf92a7f5d8a71693f8eab2e0bdbfaf76236283763674d42d095ff3df28e47bf570d0a37e10769ab5a40895ee84dde18f99e6473edb7e57a3d02ca0b84c3671c8b2501728314642f1f563ac1a63d285f0163e6811192cde9f059e9102b19e3424bcefe0d6e0e574576021c3856847bcdd7b3f64a6d5dd804ed7879f6f360caef2ee30ab7e41b733a21edaa285a9afe485d5c200f9e7a1589960e1aeabd85b3eb884ed7a7132697d1d441c"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x203}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x7}}]}]}}]}, 0x158}, 0x1, 0x0, 0x0, 0x40004}, 0x2008c010) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r8, &(0x7f0000000600)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @multicast2, @loopback}, &(0x7f0000000340)=0xc) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000880)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x64, 0x0, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x3c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, 0x0, 0x8018) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "399421fe8a4c9563", "00b147fbbfc100", "d6dc09ff", "16de86d67a8426bd"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) recvfrom(r0, &(0x7f0000000280)=""/5, 0x5, 0x40000041, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000980)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@fwd={0x4}]}, {0x0, [0x2e, 0x51, 0x30, 0x61, 0x5f]}}, 0x0, 0x2b, 0x0, 0x1, 0x3}, 0x28) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r9) 1.000430012s ago: executing program 4 (id=880): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "eeba1daa3c696e33", "8cd11084a86e02071031ecd5f1cb8efeeee1da564cf9831268724500b699fa5e", "990ff934", "917ab8da99afa933"}, 0x38) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x20000000ec071, r0, 0x5ac1a000) sendto$inet6(r0, &(0x7f0000000100)='0', 0x3fec, 0x0, 0x0, 0x3fec) 964.818408ms ago: executing program 1 (id=881): r0 = socket$unix(0x1, 0x1, 0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000080), 0x10) bind$unix(r0, &(0x7f0000000180)=@file={0x1}, 0x6e) r1 = socket$unix(0x1, 0x1, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x1}, 0x6e) 900.661596ms ago: executing program 4 (id=882): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000305000000000000000000cf0000", @ANYRES32=0x0, @ANYBLOB="03000000000000002000128008000100677265001400028008000600ac14142e080007"], 0x48}, 0x1, 0x0, 0x0, 0x24040000}, 0x2000800) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) 781.055964ms ago: executing program 1 (id=883): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20040000) bind$unix(0xffffffffffffffff, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="58000ffe55003d09000000000000000007000000", @ANYRES32=r1, @ANYBLOB="20000280", @ANYRES32=r0, @ANYBLOB="0000000000000000000000000a000000000000000000001420000100", @ANYRES32=r1], 0x58}}, 0x0) 714.527938ms ago: executing program 1 (id=884): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000240)={0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x214801, &(0x7f00000003c0)={@align=0x1000000002, {0xff80, 0x68, 0x9, 0xfffffffffffffffd}}, 0x200, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x6}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1c, 0x6, &(0x7f0000000000)=ANY=[@ANYRES32=r0], &(0x7f0000000080)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x51}, 0xfffffffffffffdff) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000000c0)={0x0, 0x99, "b2067699ad305b6150a7790cf3b310d0291212f779910614840ebdf7d0c104cd320e8780f539d431d91928173ee74758e48a565321876a71c7c865e4cf91205698060c1bc63366482419b2f6ccf0605b03afff18cd641533aed3cab5c26ad90ded90b7f3f015f8dcc3df25a71c3bae71ffee8c8a79ad0efc1ddd132120faf10f393b1fd8fd51b84ddcde6fefb2a94b7764204839b7ed35702e"}, &(0x7f0000000340)=0xa1) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000380)=@sack_info={r1, 0x3, 0x6}, 0xc) socket$can_bcm(0x1d, 0x2, 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0xb, 0x80000, 0xa) socket$netlink(0x10, 0x3, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000880)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000840)={&(0x7f0000000700)={0x110, r5, 0x20, 0x70bd2d, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0x2}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_BSS_SELECT={0x18, 0xe3, 0x0, 0x1, {0x14, 0x0, [@NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0xffffffff}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x9, 0xc9}}]}}, @NL80211_ATTR_IE={0xc0, 0x2a, [@mesh_chsw={0x76, 0x6, {0x1, 0xff, 0x37, 0xd6ea}}, @peer_mgmt={0x75, 0x6, {0x0, 0x3, @val=0x7, @void, @void}}, @rann={0x7e, 0x15, {{0x1, 0x72}, 0xea, 0xb4, @device_b, 0xb, 0x5, 0x80000001}}, @dsss={0x3, 0x1, 0x3}, @measure_req={0x26, 0x8c, {0x8, 0x5, 0x3, "c3d8baa213574df3b5903bd75264b0cf9c3c3b157fc6d3519fef51d5dc3256a7b5bcc799848f2f3a85aaf30a7ed95ba6b1d4d813deb4d74e98826dbe43dfea712c5eb74605e646afe588dea138c5db3c23f87e7600c597a11532f4cb8708ccd26651a88a1a6644a257681fc3b56494495579d8d7d2ae501e2a1e4e53161880b8b6ddaafe799692b756"}}, @ibss={0x6, 0x2, 0x4}]}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_VHT_CAPABILITY_MASK={0x10, 0xb0, {0x0, {0x4, 0x4, 0x5, 0xff81}}}]}, 0x110}}, 0x80) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000680)={0x54, r3, 0x1, 0xfffffffd, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SEC_DEVKEY={0x38, 0x2f, 0x0, 0x1, [@NL802154_DEVKEY_ATTR_FRAME_COUNTER={0x8}, @NL802154_DEVKEY_ATTR_EXTENDED_ADDR={0xc, 0x2, {0xaaaaaaaaaaaa0202}}, @NL802154_DEVKEY_ATTR_ID={0x20, 0x3, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0xf691}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0x6, 0x5, 0x100}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x54}, 0x1, 0x0, 0x0, 0xd49920d352514f42}, 0x80) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r2) 672.476716ms ago: executing program 0 (id=885): socket$netlink(0x10, 0x3, 0x8000000004) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r7, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r7, 0x0) setsockopt$inet6_tcp_TLS_TX(r6, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r6, &(0x7f0000006500)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000001c0)=""/61, 0x3d}], 0x1}, 0x3}, {{0x0, 0x0, &(0x7f0000000a80)=[{&(0x7f0000000440)=""/123, 0x7b}], 0x1, &(0x7f0000000b00)=""/6, 0x6}, 0x1}], 0x2, 0x23, 0x0) writev(r6, &(0x7f0000001540)=[{&(0x7f0000000300)='.', 0x1}], 0x1) setsockopt$sock_int(r6, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) listen(r5, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000240)={@in6={{0xa, 0x4e23, 0xfffffffe, @mcast1, 0x87}}, 0x0, 0x0, 0x3a, 0x0, "276148cd1259e41d8f0ffd4be8b6d180a19ecb3e60c92e9fe908c95534a69b91fe9e2770ba387440609895d7fbb1c08bdfd96493f4fc1810d150cc3f2bbd548044dcec63bc8b2168c59e27175814071e"}, 0xd8) 645.356238ms ago: executing program 4 (id=886): socket$inet_tcp(0x2, 0x1, 0x0) unshare(0x22020600) r0 = socket(0x2b, 0x1, 0x1) connect$pppoe(r0, &(0x7f00000002c0)={0x18, 0x0, {0x3, @broadcast, 'gretap0\x00'}}, 0x1e) 601.440335ms ago: executing program 2 (id=887): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB="bf16000000000000b70700000200f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6879fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025f2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da083e8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb5ff0f000002ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481455e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c22e46af480c300000000000000000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634e89aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3319f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f98638009c142751518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c1b9a8a14604fe52837a19dd6952fe2724c0105ab158a54a4a23ff0f4bc43c0e0e426e51258e40bb4b68ff4e3a8fe314a0"], &(0x7f0000000140)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000780)=r2, 0x4) sendmsg$inet(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000400)="0000e7ff00ec", 0x6}], 0x1}, 0x20040880) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00010000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa4}}, 0x0) 549.573205ms ago: executing program 3 (id=888): unshare(0x20400) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, &(0x7f0000000080)) 409.083881ms ago: executing program 4 (id=889): r0 = socket$inet_tcp(0x2, 0x1, 0x6) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) (async) listen(r0, 0x5) (async) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e24, @loopback}, 0x10) (async) r2 = socket(0x23, 0x5, 0x0) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="01000000040000000200000007"], 0x50) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000b98cad95850000000100000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async, rerun: 64) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) (async, rerun: 32) sendmsg$unix(r6, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 32) setsockopt$inet_opts(r2, 0x0, 0x9, 0x0, 0x0) (async, rerun: 32) r8 = accept$inet(r0, 0x0, 0x0) (rerun: 32) sendto$inet(r1, &(0x7f0000000300)='\x00', 0x4000, 0x40, 0x0, 0x0) (async) recvfrom$inet(r8, &(0x7f0000000000)=""/7, 0x4000, 0x0, 0x0, 0x28) (async) syz_80211_inject_frame(&(0x7f0000000300), 0x0, 0x0) 386.428598ms ago: executing program 1 (id=890): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 386.244163ms ago: executing program 3 (id=891): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000000c0)="4736a5b4be726ed7bccc900fc1fb5ead6f2b7c157c17e3f63584e050b4f90a57ae07afedc06cccb32c6cd7316c090c7eec1f4e859544f847c70757b4e15553319fe24cd78ee497c6ddbe681e837fabc2f8476d07d52a2b7bf84a16b52fcbe61f916fae360c0f539a47f8d3a3ed8a5208f354757ce6f51758ca04f3ba4cfdf1354837a0a861b0083e4294668683dec91dd888ed8c5e474dd5e19e83545bfe28d887c1d6a8af516bdf2e4b167f5d2c51939eaee0c31786323e961236e01c7e19fd914ad216c9fee2c27a15c64d352528e85a46fbf34366833b44f536b3a1cb0dbc65ed1cd14082b3628ff15480cd5bcbc05c6c5364805f0f5dae34232caede7282") (async) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="40000000680001002abd7000fdffff7f00000000000000000c00020001002e0f5a96000014000c80080003000104000006ffffffff0000000600030001"], 0x40}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 337.405676ms ago: executing program 2 (id=892): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r1, &(0x7f0000001d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0xa3, @loopback, 0x8}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x804) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000080)={0x0, 0x8, 0x3, 0x1ff}, &(0x7f0000000540)=0x10) r2 = socket(0x10, 0x803, 0x0) write(r2, &(0x7f0000000100)="1c0000005e001f3814584707f9f4ffffff0000000d000000f3f80000", 0x1c) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000140)="68000000000905040000000000f5ffff010000000900010073797a300000000014000280060001400002000005000200a0d6be0000000000007d0f002c000480080001000000d0fc1f26ec921631b7783c450001200002800c0001003361889b63790b0008000200", 0x68}], 0x1}, 0x4008040) 218.492536ms ago: executing program 3 (id=893): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xc, 0x16, &(0x7f00000003c0)=ANY=[@ANYBLOB="6112bc000000001861139f0000000000bf2000000000000007000000180000003d030100000000009500f0f3000000006926000000000000bf67000000000000560602000f0200006706000020000000620a00ff0ee60000bf250000000000002d35f3ff000000006507000002080000070700004c0000003e75000000000000bf54000000000000070400000400f9ffcd35010000000000ce040000000000001c000000000000009500000000000000db13d5d8b741f2cdaabc8383c8f56bb5df3083d20f8c2bf304000000815dcf0066d7ded3c5c49a08a503ea6d54f7f3125a8200578ac0836d6454745e70a27444003c5b20451b624db6f5320e9befc1e00b8b32917c4d30d16b7edb732bc3ac330b16c442aff70d27659bc58e296b16750c5577c848754b4894b07f15bab1c640a5c0c4fd62f9db829b301ef67fd2b2726f3af0c54af2412313b17c4c8081c4ed0572261960e227d34cfbfda047bc2351c9d8363a8cb18b7330604da78b0aba47545f9a25a80dd7d28a5ae41824f611dd2de6dd581c52698f9542a444a8a3969946faded527a0bfe5504eb355cb0000000000000073be27152effbed9ed6a4e8f9c55a2ff11245f2c20856d491b80d749cf8917dbe01cc6c7b747923621bb16efb2025d19a1a27b0348135e32e442da8f26e05283ece8ad92c77f8141c7a2037380f28c9c638ee0151f4620b9b64185db0321a4e809a5438cdef28f7adac1735a50006fbae20d0930b55f0081db6fa0d14024cefa1611ef384de38787324bfb9f79a1e164c8fe80a2d9e4199960"], &(0x7f0000000100)='GPL\x00'}, 0x27) 125.130648ms ago: executing program 4 (id=894): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x0, 0x80}}, 0x1c}}, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f0000000280)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 29) 916.91µs ago: executing program 2 (id=895): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180200002343ffff0000000000000000850000004100000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r1, r2, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x11dc0, &(0x7f00000004c0)=ANY=[], 0x0) 554.929µs ago: executing program 3 (id=896): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000700)=@base={0x10, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000180)={r0, &(0x7f00000005c0)="dc9b709847", &(0x7f00000003c0)=""/79}, 0x20) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'veth0_vlan\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x1}, {0x3, 0xfff2}, {0xffff, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0xc015}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x4c, r1, 0x1, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x8, 0x8e}}]}, 0x4c}}, 0x0) 0s ago: executing program 1 (id=897): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000980)={0x2, 0x4, 0x0, 0x3, 0xe, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_address={0x5, 0x6, 0x3c, 0x0, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x9, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7, 0xffffff80}, 0x8000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.210' (ED25519) to the list of known hosts. [ 64.315685][ T5592] cgroup: Unknown subsys name 'net' [ 64.469528][ T5592] cgroup: Unknown subsys name 'cpuset' [ 64.478064][ T5592] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 65.779380][ T5592] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 67.815202][ T5609] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 67.823271][ T5609] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 67.839833][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 67.847769][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 67.856945][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 67.864438][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 67.881295][ T5611] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 67.888926][ T5614] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 67.889779][ T5611] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 67.898137][ T5614] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 67.904989][ T5611] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 67.911116][ T5614] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 67.919131][ T5611] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 67.925537][ T5614] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 67.939980][ T5614] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 67.955064][ T5604] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 67.969888][ T5604] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 67.984816][ T5614] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 67.997946][ T5604] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.005295][ T5611] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 68.014639][ T5611] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.021776][ T5604] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 68.030798][ T5611] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 68.039831][ T5609] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 68.066840][ T5609] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 69.492232][ T5603] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.499471][ T5603] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.506733][ T5603] bridge_slave_0: entered allmulticast mode [ 69.513724][ T5603] bridge_slave_0: entered promiscuous mode [ 69.555303][ T5603] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.562760][ T5603] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.570318][ T5603] bridge_slave_1: entered allmulticast mode [ 69.578129][ T5603] bridge_slave_1: entered promiscuous mode [ 69.672845][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.680100][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.687315][ T5610] bridge_slave_0: entered allmulticast mode [ 69.694207][ T5610] bridge_slave_0: entered promiscuous mode [ 69.721225][ T5603] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.735895][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.743934][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.751308][ T5610] bridge_slave_1: entered allmulticast mode [ 69.758323][ T5610] bridge_slave_1: entered promiscuous mode [ 69.769875][ T5602] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.777063][ T5602] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.785291][ T5602] bridge_slave_0: entered allmulticast mode [ 69.792548][ T5602] bridge_slave_0: entered promiscuous mode [ 69.801577][ T5603] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.841514][ T5602] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.848681][ T5602] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.855936][ T5602] bridge_slave_1: entered allmulticast mode [ 69.863096][ T5602] bridge_slave_1: entered promiscuous mode [ 69.878020][ T5618] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.885174][ T5618] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.892549][ T5618] bridge_slave_0: entered allmulticast mode [ 69.899431][ T5618] bridge_slave_0: entered promiscuous mode [ 69.938163][ T5618] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.945357][ T5618] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.952853][ T5618] bridge_slave_1: entered allmulticast mode [ 69.960280][ T5618] bridge_slave_1: entered promiscuous mode [ 69.977739][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.987376][ T5609] Bluetooth: hci0: command tx timeout [ 69.990420][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.993371][ T5611] Bluetooth: hci1: command tx timeout [ 70.023955][ T5603] team0: Port device team_slave_0 added [ 70.058237][ T5602] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.067183][ T5611] Bluetooth: hci2: command tx timeout [ 70.070600][ T5602] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.083539][ T5603] team0: Port device team_slave_1 added [ 70.100215][ T5618] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.118625][ T5615] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.125822][ T5615] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.133603][ T5615] bridge_slave_0: entered allmulticast mode [ 70.140867][ T5615] bridge_slave_0: entered promiscuous mode [ 70.146761][ T5611] Bluetooth: hci4: command tx timeout [ 70.147018][ T5611] Bluetooth: hci3: command tx timeout [ 70.174910][ T5618] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.194184][ T5610] team0: Port device team_slave_0 added [ 70.200142][ T5615] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.207450][ T5615] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.214576][ T5615] bridge_slave_1: entered allmulticast mode [ 70.222095][ T5615] bridge_slave_1: entered promiscuous mode [ 70.241121][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.248326][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.274497][ T5603] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.296203][ T5610] team0: Port device team_slave_1 added [ 70.313055][ T5602] team0: Port device team_slave_0 added [ 70.319508][ T5603] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.326520][ T5603] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.352445][ T5603] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.364970][ T5618] team0: Port device team_slave_0 added [ 70.389839][ T5602] team0: Port device team_slave_1 added [ 70.407493][ T5618] team0: Port device team_slave_1 added [ 70.424154][ T5615] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.459629][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.467032][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.493026][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.505928][ T5615] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.523848][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.530999][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.557036][ T5602] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.577804][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.584843][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.611015][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.640818][ T5602] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.648026][ T5602] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.674166][ T5602] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.685993][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.693015][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.719254][ T5618] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 70.751656][ T5603] hsr_slave_0: entered promiscuous mode [ 70.757999][ T5603] hsr_slave_1: entered promiscuous mode [ 70.770619][ T5618] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 70.777623][ T5618] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 70.803878][ T5618] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 70.817318][ T5615] team0: Port device team_slave_0 added [ 70.834055][ T5615] team0: Port device team_slave_1 added [ 70.949094][ T5610] hsr_slave_0: entered promiscuous mode [ 70.955233][ T5610] hsr_slave_1: entered promiscuous mode [ 70.961813][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 70.967740][ T5610] Cannot create hsr debugfs directory [ 70.973904][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 70.981725][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.007845][ T5615] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.023685][ T5602] hsr_slave_0: entered promiscuous mode [ 71.030017][ T5602] hsr_slave_1: entered promiscuous mode [ 71.036013][ T5602] debugfs: 'hsr0' already exists in 'hsr' [ 71.041879][ T5602] Cannot create hsr debugfs directory [ 71.052967][ T5618] hsr_slave_0: entered promiscuous mode [ 71.059442][ T5618] hsr_slave_1: entered promiscuous mode [ 71.065474][ T5618] debugfs: 'hsr0' already exists in 'hsr' [ 71.071429][ T5618] Cannot create hsr debugfs directory [ 71.090256][ T5615] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.097371][ T5615] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.123392][ T5615] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.270859][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.277596][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.289826][ T5615] hsr_slave_0: entered promiscuous mode [ 71.295993][ T5615] hsr_slave_1: entered promiscuous mode [ 71.302391][ T5615] debugfs: 'hsr0' already exists in 'hsr' [ 71.308181][ T5615] Cannot create hsr debugfs directory [ 71.623998][ T5603] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 71.636326][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.652197][ T5603] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 71.661324][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.669648][ T5603] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 71.681182][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.689211][ T5603] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 71.698986][ T5603] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.766202][ T5618] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 71.778555][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.792035][ T5618] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 71.802194][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.810438][ T5618] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 71.819913][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.839257][ T5618] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 71.848876][ T5618] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.914270][ T5602] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 71.924146][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.932750][ T5602] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 71.942390][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.950746][ T5602] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 71.960073][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.973221][ T5602] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 71.983038][ T5602] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.067012][ T5611] Bluetooth: hci1: command tx timeout [ 72.067382][ T5609] Bluetooth: hci0: command tx timeout [ 72.097594][ T5603] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.120664][ T5610] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 72.130762][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.147338][ T5609] Bluetooth: hci2: command tx timeout [ 72.156443][ T5610] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 72.166478][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.179845][ T5610] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 72.189458][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.198677][ T5603] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.216328][ T5610] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 72.226088][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.228375][ T5609] Bluetooth: hci3: command tx timeout [ 72.239010][ T5611] Bluetooth: hci4: command tx timeout [ 72.267392][ T5618] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.278543][ T907] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.285713][ T907] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.323351][ T907] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.330474][ T907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.360661][ T5615] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 72.370420][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 72.388777][ T5615] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 72.398756][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 72.406511][ T5615] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 72.416467][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 72.424682][ T5615] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 72.434304][ T5615] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 72.452697][ T5618] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.496683][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.503831][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.530440][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.537597][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.554552][ T5602] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.621263][ T5602] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.674559][ T3318] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.681763][ T3318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.708847][ T907] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.715974][ T907] bridge0: port 2(bridge_slave_1) entered forwarding state [ 72.770596][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 72.888133][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 72.911478][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.918715][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 72.952121][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.959329][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.054629][ T5615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.165412][ T5615] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.238430][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.245616][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.281293][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.288566][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.463041][ T5615] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.558473][ T5618] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.584671][ T5603] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.780312][ T5603] veth0_vlan: entered promiscuous mode [ 73.838594][ T5603] veth1_vlan: entered promiscuous mode [ 73.852417][ T5618] veth0_vlan: entered promiscuous mode [ 73.893563][ T5618] veth1_vlan: entered promiscuous mode [ 73.940267][ T5602] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.008029][ T5603] veth0_macvtap: entered promiscuous mode [ 74.029813][ T5618] veth0_macvtap: entered promiscuous mode [ 74.043942][ T5603] veth1_macvtap: entered promiscuous mode [ 74.059372][ T5618] veth1_macvtap: entered promiscuous mode [ 74.137321][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.147779][ T5609] Bluetooth: hci0: command tx timeout [ 74.153781][ T5611] Bluetooth: hci1: command tx timeout [ 74.174382][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.197778][ T5618] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.211600][ T5603] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.229701][ T5611] Bluetooth: hci2: command tx timeout [ 74.239465][ T5602] veth0_vlan: entered promiscuous mode [ 74.253131][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.268859][ T3318] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.307938][ T5611] Bluetooth: hci3: command tx timeout [ 74.307968][ T5609] Bluetooth: hci4: command tx timeout [ 74.335470][ T5602] veth1_vlan: entered promiscuous mode [ 74.344422][ T5615] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.411536][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.488836][ T36] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.546479][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.556276][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.576436][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.584523][ T36] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.584667][ T36] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.586856][ T907] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.651275][ T5602] veth0_macvtap: entered promiscuous mode [ 74.697349][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.707574][ T907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.710675][ T5602] veth1_macvtap: entered promiscuous mode [ 74.723428][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.730135][ T5610] veth0_vlan: entered promiscuous mode [ 74.731878][ T907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.766805][ T907] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.829387][ T5610] veth1_vlan: entered promiscuous mode [ 74.855700][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.855766][ T5618] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 74.871966][ T5602] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.892260][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.911064][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.024333][ T5615] veth0_vlan: entered promiscuous mode [ 75.060523][ T5610] veth0_macvtap: entered promiscuous mode [ 75.088305][ T5796] lo speed is unknown, defaulting to 1000 [ 75.097945][ T139] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.121062][ T5610] veth1_macvtap: entered promiscuous mode [ 75.152741][ T5615] veth1_vlan: entered promiscuous mode [ 75.165946][ T5796] lo speed is unknown, defaulting to 1000 [ 75.167012][ T907] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.196755][ T5796] lo speed is unknown, defaulting to 1000 [ 75.246591][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.261852][ T907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.271233][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.285387][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.287255][ T907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.310490][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.366839][ T5615] veth0_macvtap: entered promiscuous mode [ 75.417683][ T5615] veth1_macvtap: entered promiscuous mode [ 75.434521][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.450095][ T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.466803][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.487296][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.525555][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.599552][ T5615] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.733816][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.780277][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.819772][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.849051][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.897070][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.972098][ T5796] infiniband syz0: set active [ 75.978949][ T139] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.979343][ T9] lo speed is unknown, defaulting to 1000 [ 75.998688][ T5796] infiniband syz0: added lo [ 76.014178][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.034119][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.059539][ T139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.078930][ T139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.083677][ T5815] Bluetooth: MGMT ver 1.23 [ 76.088570][ T5796] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 76.108310][ T5796] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 76.129437][ T3318] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.129727][ T5796] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 76.157898][ T3318] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.226846][ T5609] Bluetooth: hci1: command tx timeout [ 76.227100][ T5611] Bluetooth: hci0: command tx timeout [ 76.256592][ T5796] RDS/IB: syz0: added [ 76.283036][ T5796] smc: adding ib device syz0 with port count 1 [ 76.307498][ T5611] Bluetooth: hci2: command tx timeout [ 76.307659][ T139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.338244][ T5796] smc: ib device syz0 port 1 has no pnetid [ 76.356117][ T139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.374503][ T9] lo speed is unknown, defaulting to 1000 [ 76.388173][ T5611] Bluetooth: hci3: command tx timeout [ 76.388623][ T5609] Bluetooth: hci4: command tx timeout [ 76.462907][ T5796] lo speed is unknown, defaulting to 1000 [ 76.766351][ T5829] netlink: 'syz.3.11': attribute type 1 has an invalid length. [ 76.797794][ T5831] syz.4.5 uses obsolete (PF_INET,SOCK_PACKET) [ 76.825860][ T5829] bond0: (slave gretap1): Enslaving as an active interface with an up link [ 76.838840][ T5832] netlink: 132 bytes leftover after parsing attributes in process `syz.1.12'. [ 77.324711][ T5796] lo speed is unknown, defaulting to 1000 [ 78.064029][ T5796] lo speed is unknown, defaulting to 1000 [ 78.330412][ T5866] netlink: 68 bytes leftover after parsing attributes in process `syz.4.19'. [ 78.476071][ T5869] veth0_macvtap: left promiscuous mode [ 78.496501][ T5871] xt_hashlimit: size too large, truncated to 1048576 [ 78.751505][ T5796] lo speed is unknown, defaulting to 1000 [ 78.989713][ T5882] netlink: 'syz.4.23': attribute type 4 has an invalid length. [ 79.031353][ T5882] netlink: 'syz.4.23': attribute type 4 has an invalid length. [ 79.477832][ T5909] netlink: 16 bytes leftover after parsing attributes in process `syz.1.27'. [ 79.564009][ T5796] lo speed is unknown, defaulting to 1000 [ 79.844532][ T5922] netlink: 'syz.1.30': attribute type 4 has an invalid length. [ 79.885979][ T5922] netlink: 'syz.1.30': attribute type 4 has an invalid length. [ 79.994845][ T5269] veth0_macvtap: entered promiscuous mode [ 80.175267][ T5896] lo speed is unknown, defaulting to 1000 [ 80.301427][ T5933] netlink: 12 bytes leftover after parsing attributes in process `syz.1.32'. [ 80.480136][ T5796] lo speed is unknown, defaulting to 1000 [ 80.933300][ T5950] netlink: 104 bytes leftover after parsing attributes in process `syz.2.33'. [ 80.937021][ T5906] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 80.984613][ T5906] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 81.004015][ T5906] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 81.022533][ T5906] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 81.051506][ T5906] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 81.679165][ T5965] netlink: 68 bytes leftover after parsing attributes in process `syz.3.36'. [ 83.362642][ T5982] netlink: 'syz.1.41': attribute type 4 has an invalid length. [ 83.373444][ T5982] netlink: 'syz.1.41': attribute type 4 has an invalid length. [ 84.410476][ T5959] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 84.758464][ T5996] netlink: 15 bytes leftover after parsing attributes in process `syz.3.47'. [ 84.825539][ T5994] Driver unsupported XDP return value 0 on prog (id 7) dev N/A, expect packet loss! [ 84.999531][ T6010] netlink: 32 bytes leftover after parsing attributes in process `syz.3.47'. [ 85.109261][ T6015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.48'. [ 85.596498][ T6041] netlink: 28 bytes leftover after parsing attributes in process `syz.4.55'. [ 85.649878][ T6033] smbdirect: ib_dev[syz1] removed [ 85.837285][ T6047] netlink: 112 bytes leftover after parsing attributes in process `syz.4.57'. [ 85.870110][ T6023] veth3: entered promiscuous mode [ 86.144845][ T187] cfg80211: failed to load regulatory.db [ 86.188805][ T6062] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 86.313086][ T6068] FAULT_INJECTION: forcing a failure. [ 86.313086][ T6068] name failslab, interval 1, probability 0, space 0, times 1 [ 86.354866][ T6069] netlink: 'syz.3.61': attribute type 2 has an invalid length. [ 86.366006][ T6068] CPU: 0 UID: 0 PID: 6068 Comm: syz.0.62 Not tainted syzkaller #0 PREEMPT(full) [ 86.366039][ T6068] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 86.366054][ T6068] Call Trace: [ 86.366060][ T6068] [ 86.366065][ T6068] dump_stack_lvl+0xe8/0x150 [ 86.366097][ T6068] should_fail_ex+0x40c/0x560 [ 86.366116][ T6068] should_failslab+0xa8/0x100 [ 86.366134][ T6068] __kmalloc_cache_noprof+0xa8/0x660 [ 86.366151][ T6068] ? xfrm_policy_alloc+0x78/0x2b0 [ 86.366167][ T6068] ? xfrm_policy_alloc+0x78/0x2b0 [ 86.366186][ T6068] xfrm_policy_alloc+0x78/0x2b0 [ 86.366202][ T6068] pfkey_compile_policy+0x303/0xbc0 [ 86.366226][ T6068] xfrm_user_policy+0x46a/0x790 [ 86.366242][ T6068] ? xfrm_user_policy+0x2c5/0x790 [ 86.366260][ T6068] ? __pfx_xfrm_user_policy+0x10/0x10 [ 86.366275][ T6068] ? apparmor_capable+0x126/0x170 [ 86.366291][ T6068] ? bpf_lsm_capable+0x9/0x20 [ 86.366305][ T6068] ? security_capable+0x7e/0x2c0 [ 86.366328][ T6068] do_ip_setsockopt+0x19eb/0x2e30 [ 86.366351][ T6068] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 86.366368][ T6068] ? aa_sk_perm+0x6d5/0x900 [ 86.366386][ T6068] ? __fget_files+0x2a/0x420 [ 86.366404][ T6068] ? __pfx_aa_sk_perm+0x10/0x10 [ 86.366423][ T6068] ? __fget_files+0x2a/0x420 [ 86.366436][ T6068] ? aa_sock_opt_perm+0xff/0x1a0 [ 86.366449][ T6068] ip_setsockopt+0x66/0x110 [ 86.366460][ T6068] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 86.366474][ T6068] do_sock_setsockopt+0x17c/0x1b0 [ 86.366492][ T6068] __x64_sys_setsockopt+0x13d/0x1b0 [ 86.366508][ T6068] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.366521][ T6068] do_syscall_64+0x174/0x580 [ 86.366539][ T6068] ? trace_irq_disable+0x3b/0x140 [ 86.366554][ T6068] ? clear_bhb_loop+0x70/0xc0 [ 86.366568][ T6068] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.366580][ T6068] RIP: 0033:0x7fd93d79e0d9 [ 86.366596][ T6068] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.366610][ T6068] RSP: 002b:00007fd93e6d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 86.366628][ T6068] RAX: ffffffffffffffda RBX: 00007fd93da25fa0 RCX: 00007fd93d79e0d9 [ 86.366639][ T6068] RDX: 0008008000000010 RSI: 0000000000000000 RDI: 0000000000000003 [ 86.366646][ T6068] RBP: 00007fd93e6d4090 R08: 00000000000000b8 R09: 0000000000000000 [ 86.366654][ T6068] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 86.366661][ T6068] R13: 00007fd93da26038 R14: 00007fd93da25fa0 R15: 00007ffde1e79a68 [ 86.366682][ T6068] [ 86.386341][ T6069] netlink: 232 bytes leftover after parsing attributes in process `syz.3.61'. [ 86.730392][ T6083] netlink: 68 bytes leftover after parsing attributes in process `syz.1.66'. [ 86.787010][ T6069] netlink: 4 bytes leftover after parsing attributes in process `syz.3.61'. [ 86.957907][ T6100] netlink: 8 bytes leftover after parsing attributes in process `syz.2.71'. [ 86.979862][ T6100] netlink: 8 bytes leftover after parsing attributes in process `syz.2.71'. [ 87.025870][ T6100] netlink: 'syz.2.71': attribute type 1 has an invalid length. [ 87.324225][ T6098] syz.1.70 (6098) used greatest stack depth: 18048 bytes left [ 87.471120][ T6125] FAULT_INJECTION: forcing a failure. [ 87.471120][ T6125] name failslab, interval 1, probability 0, space 0, times 0 [ 87.518509][ T6125] CPU: 0 UID: 0 PID: 6125 Comm: syz.1.76 Not tainted syzkaller #0 PREEMPT(full) [ 87.518531][ T6125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.518540][ T6125] Call Trace: [ 87.518547][ T6125] [ 87.518554][ T6125] dump_stack_lvl+0xe8/0x150 [ 87.518582][ T6125] should_fail_ex+0x40c/0x560 [ 87.518607][ T6125] should_failslab+0xa8/0x100 [ 87.518631][ T6125] __kmalloc_node_noprof+0x105/0x740 [ 87.518651][ T6125] ? qdisc_create+0x64/0xf00 [ 87.518667][ T6125] ? lock_acquire+0x106/0x350 [ 87.518684][ T6125] ? qdisc_alloc+0x92/0x9d0 [ 87.518701][ T6125] ? qdisc_alloc+0x92/0x9d0 [ 87.518724][ T6125] qdisc_alloc+0x92/0x9d0 [ 87.518748][ T6125] qdisc_create+0x12c/0xf00 [ 87.518765][ T6125] ? lockdep_rtnl_is_held+0x26/0x40 [ 87.518787][ T6125] ? qdisc_lookup+0x364/0x6c0 [ 87.518810][ T6125] tc_modify_qdisc+0x17af/0x2390 [ 87.518838][ T6125] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 87.518855][ T6125] ? __dev_queue_xmit+0x29b/0x3820 [ 87.518900][ T6125] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 87.518914][ T6125] rtnetlink_rcv_msg+0x7b9/0xc00 [ 87.518935][ T6125] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 87.518952][ T6125] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 87.518966][ T6125] ? ref_tracker_free+0x689/0x830 [ 87.518986][ T6125] ? __pfx_ref_tracker_free+0x10/0x10 [ 87.519004][ T6125] ? __asan_memcpy+0x40/0x70 [ 87.519020][ T6125] ? __skb_clone+0x5c/0x6c0 [ 87.519052][ T6125] netlink_rcv_skb+0x226/0x4a0 [ 87.519076][ T6125] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 87.519094][ T6125] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 87.519123][ T6125] ? netlink_deliver_tap+0x2e/0x1b0 [ 87.519140][ T6125] ? netlink_deliver_tap+0x2e/0x1b0 [ 87.519164][ T6125] netlink_unicast+0x7bb/0x940 [ 87.519192][ T6125] netlink_sendmsg+0x813/0xb40 [ 87.519219][ T6125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 87.519242][ T6125] ? aa_sock_msg_perm+0xf1/0x1b0 [ 87.519263][ T6125] ? __pfx_netlink_sendmsg+0x10/0x10 [ 87.519282][ T6125] sock_sendmsg_nosec+0x13a/0x180 [ 87.519307][ T6125] ____sys_sendmsg+0x54e/0x850 [ 87.519329][ T6125] ? __pfx_____sys_sendmsg+0x10/0x10 [ 87.519354][ T6125] ? import_iovec+0x73/0xa0 [ 87.519378][ T6125] ___sys_sendmsg+0x2a5/0x360 [ 87.519394][ T6125] ? __lock_acquire+0x683/0x2cf0 [ 87.519418][ T6125] ? __pfx____sys_sendmsg+0x10/0x10 [ 87.519470][ T6125] ? __fget_files+0x2a/0x420 [ 87.519488][ T6125] ? __fget_files+0x3a2/0x420 [ 87.519515][ T6125] __x64_sys_sendmsg+0x1b1/0x290 [ 87.519537][ T6125] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 87.519569][ T6125] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.519586][ T6125] do_syscall_64+0x174/0x580 [ 87.519606][ T6125] ? trace_irq_disable+0x3b/0x140 [ 87.519624][ T6125] ? clear_bhb_loop+0x70/0xc0 [ 87.519643][ T6125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.519658][ T6125] RIP: 0033:0x7f325259e0d9 [ 87.519675][ T6125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.519687][ T6125] RSP: 002b:00007f3253443028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 87.519704][ T6125] RAX: ffffffffffffffda RBX: 00007f3252825fa0 RCX: 00007f325259e0d9 [ 87.519715][ T6125] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000003 [ 87.519724][ T6125] RBP: 00007f3253443090 R08: 0000000000000000 R09: 0000000000000000 [ 87.519734][ T6125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 87.519743][ T6125] R13: 00007f3252826038 R14: 00007f3252825fa0 R15: 00007ffea3f12e28 [ 87.519771][ T6125] [ 87.950377][ T6129] FAULT_INJECTION: forcing a failure. [ 87.950377][ T6129] name failslab, interval 1, probability 0, space 0, times 0 [ 88.055218][ T6129] CPU: 1 UID: 0 PID: 6129 Comm: syz.3.77 Not tainted syzkaller #0 PREEMPT(full) [ 88.055242][ T6129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.055251][ T6129] Call Trace: [ 88.055259][ T6129] [ 88.055265][ T6129] dump_stack_lvl+0xe8/0x150 [ 88.055293][ T6129] should_fail_ex+0x40c/0x560 [ 88.055316][ T6129] should_failslab+0xa8/0x100 [ 88.055340][ T6129] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 88.055360][ T6129] ? skb_clone+0x212/0x3a0 [ 88.055387][ T6129] ? skb_clone+0x212/0x3a0 [ 88.055412][ T6129] skb_clone+0x212/0x3a0 [ 88.055434][ T6129] __netlink_deliver_tap+0x413/0x860 [ 88.055465][ T6129] ? netlink_deliver_tap+0x2e/0x1b0 [ 88.055486][ T6129] netlink_deliver_tap+0x19c/0x1b0 [ 88.055506][ T6129] netlink_unicast+0x77f/0x940 [ 88.055533][ T6129] netlink_sendmsg+0x813/0xb40 [ 88.055562][ T6129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.055585][ T6129] ? aa_sock_msg_perm+0xf1/0x1b0 [ 88.055606][ T6129] ? __pfx_netlink_sendmsg+0x10/0x10 [ 88.055624][ T6129] sock_sendmsg_nosec+0x13a/0x180 [ 88.055650][ T6129] ____sys_sendmsg+0x54e/0x850 [ 88.055675][ T6129] ? __pfx_____sys_sendmsg+0x10/0x10 [ 88.055701][ T6129] ? import_iovec+0x73/0xa0 [ 88.055725][ T6129] ___sys_sendmsg+0x2a5/0x360 [ 88.055743][ T6129] ? __lock_acquire+0x683/0x2cf0 [ 88.055768][ T6129] ? __pfx____sys_sendmsg+0x10/0x10 [ 88.055820][ T6129] ? __fget_files+0x2a/0x420 [ 88.055838][ T6129] ? __fget_files+0x3a2/0x420 [ 88.055867][ T6129] __x64_sys_sendmsg+0x1b1/0x290 [ 88.055889][ T6129] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 88.055924][ T6129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.055941][ T6129] do_syscall_64+0x174/0x580 [ 88.055962][ T6129] ? trace_irq_disable+0x3b/0x140 [ 88.055981][ T6129] ? clear_bhb_loop+0x70/0xc0 [ 88.056001][ T6129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.056017][ T6129] RIP: 0033:0x7fa37ff9e0d9 [ 88.056033][ T6129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 88.056045][ T6129] RSP: 002b:00007fa380ef0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 88.056063][ T6129] RAX: ffffffffffffffda RBX: 00007fa380225fa0 RCX: 00007fa37ff9e0d9 [ 88.056075][ T6129] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 88.056084][ T6129] RBP: 00007fa380ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 88.056094][ T6129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.056103][ T6129] R13: 00007fa380226038 R14: 00007fa380225fa0 R15: 00007ffec6026958 [ 88.056131][ T6129] [ 88.440198][ T6144] syzkaller0: entered promiscuous mode [ 88.461473][ T6144] syzkaller0: entered allmulticast mode [ 88.563935][ T6149] A link change request failed with some changes committed already. Interface syzkallerB may have been left with an inconsistent configuration, please check. [ 88.692682][ T6156] FAULT_INJECTION: forcing a failure. [ 88.692682][ T6156] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 88.692897][ T6151] syzkaller0: entered promiscuous mode [ 88.718973][ T6151] syzkaller0: entered allmulticast mode [ 88.721667][ T6156] CPU: 0 UID: 0 PID: 6156 Comm: syz.2.85 Not tainted syzkaller #0 PREEMPT(full) [ 88.721691][ T6156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 88.721700][ T6156] Call Trace: [ 88.721708][ T6156] [ 88.721714][ T6156] dump_stack_lvl+0xe8/0x150 [ 88.721742][ T6156] should_fail_ex+0x40c/0x560 [ 88.721766][ T6156] _copy_from_iter+0x1d3/0x1660 [ 88.721786][ T6156] ? skb_set_owner_w+0x263/0x3d0 [ 88.721816][ T6156] ? __pfx__copy_from_iter+0x10/0x10 [ 88.721843][ T6156] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 88.721866][ T6156] skb_copy_datagram_from_iter+0xe6/0x720 [ 88.721900][ T6156] ? skb_put+0x112/0x210 [ 88.721920][ T6156] tun_get_user+0x1520/0x4370 [ 88.721957][ T6156] ? aa_file_perm+0x18b/0x15f0 [ 88.721978][ T6156] ? aa_file_perm+0x4ed/0x15f0 [ 88.721993][ T6156] ? __pfx_tun_get_user+0x10/0x10 [ 88.722016][ T6156] ? __lock_acquire+0x683/0x2cf0 [ 88.722038][ T6156] ? kstrtoull+0x12f/0x1d0 [ 88.722063][ T6156] ? ref_tracker_alloc+0x341/0x4b0 [ 88.722080][ T6156] ? get_pid_task+0x20/0x1f0 [ 88.722101][ T6156] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 88.722121][ T6156] ? tun_get+0x1c/0x2f0 [ 88.722142][ T6156] ? tun_get+0x1c/0x2f0 [ 88.722168][ T6156] ? tun_get+0x1c/0x2f0 [ 88.722187][ T6156] ? tun_get+0x1c/0x2f0 [ 88.722212][ T6156] tun_chr_write_iter+0x113/0x200 [ 88.722236][ T6156] vfs_write+0x612/0xba0 [ 88.722267][ T6156] ? __pfx_vfs_write+0x10/0x10 [ 88.722295][ T6156] ? __fget_files+0x2a/0x420 [ 88.722322][ T6156] ksys_write+0x150/0x270 [ 88.722345][ T6156] ? __pfx_ksys_write+0x10/0x10 [ 88.722373][ T6156] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.722389][ T6156] do_syscall_64+0x174/0x580 [ 88.722410][ T6156] ? trace_irq_disable+0x3b/0x140 [ 88.722428][ T6156] ? clear_bhb_loop+0x70/0xc0 [ 88.722447][ T6156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.722463][ T6156] RIP: 0033:0x7ff56235e90e [ 88.722479][ T6156] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 88.722491][ T6156] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 88.722507][ T6156] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 88.722518][ T6156] RDX: 0000000000000dff RSI: 00002000000004c0 RDI: 00000000000000c8 [ 88.722528][ T6156] RBP: 00007ff56326e090 R08: 0000000000000000 R09: 0000000000000000 [ 88.722537][ T6156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 88.722546][ T6156] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 88.722572][ T6156] [ 88.985007][ T6164] netlink: 'syz.4.87': attribute type 4 has an invalid length. [ 89.011170][ T6164] netlink: 'syz.4.87': attribute type 4 has an invalid length. [ 89.314801][ T6175] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 89.352688][ T6175] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 89.363694][ T6175] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 89.554975][ T6183] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 89.581422][ T6183] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 89.658530][ T6183] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 89.716948][ T6178] lo speed is unknown, defaulting to 1000 [ 89.811983][ T6183] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 90.045635][ T6205] tipc: Can't bind to reserved service type 0 [ 90.190967][ T6213] __nla_validate_parse: 6 callbacks suppressed [ 90.190983][ T6213] netlink: 68 bytes leftover after parsing attributes in process `syz.4.105'. [ 90.384453][ T6220] macvlan2: entered promiscuous mode [ 90.543137][ T6225] Zero length message leads to an empty skb [ 91.343140][ T6268] netlink: 'syz.0.126': attribute type 4 has an invalid length. [ 91.360362][ T6268] netlink: 'syz.0.126': attribute type 4 has an invalid length. [ 91.625640][ T6277] netlink: 12 bytes leftover after parsing attributes in process `syz.3.129'. [ 91.888844][ T6282] pim6reg1: entered promiscuous mode [ 91.904399][ T6282] pim6reg1: entered allmulticast mode [ 91.923283][ T6290] netlink: 'syz.4.135': attribute type 9 has an invalid length. [ 92.214597][ T6299] netlink: 'syz.4.138': attribute type 4 has an invalid length. [ 92.231781][ T6299] netlink: 'syz.4.138': attribute type 4 has an invalid length. [ 92.353617][ T6304] netlink: 'syz.4.140': attribute type 4 has an invalid length. [ 92.374696][ T6304] netlink: 'syz.4.140': attribute type 4 has an invalid length. [ 92.444257][ T6309] netlink: 'syz.1.141': attribute type 15 has an invalid length. [ 92.456580][ T6309] netlink: 24 bytes leftover after parsing attributes in process `syz.1.141'. [ 92.906015][ T6332] FAULT_INJECTION: forcing a failure. [ 92.906015][ T6332] name failslab, interval 1, probability 0, space 0, times 0 [ 92.930057][ T6332] CPU: 0 UID: 0 PID: 6332 Comm: syz.0.148 Not tainted syzkaller #0 PREEMPT(full) [ 92.930080][ T6332] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.930089][ T6332] Call Trace: [ 92.930096][ T6332] [ 92.930103][ T6332] dump_stack_lvl+0xe8/0x150 [ 92.930129][ T6332] should_fail_ex+0x40c/0x560 [ 92.930152][ T6332] should_failslab+0xa8/0x100 [ 92.930176][ T6332] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 92.930195][ T6332] ? skb_clone+0x212/0x3a0 [ 92.930212][ T6332] ? skb_clone+0x212/0x3a0 [ 92.930237][ T6332] skb_clone+0x212/0x3a0 [ 92.930260][ T6332] __netlink_deliver_tap+0x413/0x860 [ 92.930292][ T6332] ? netlink_deliver_tap+0x2e/0x1b0 [ 92.930323][ T6332] netlink_deliver_tap+0x19c/0x1b0 [ 92.930344][ T6332] netlink_unicast+0x77f/0x940 [ 92.930373][ T6332] netlink_sendmsg+0x813/0xb40 [ 92.930403][ T6332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 92.930427][ T6332] ? aa_sock_msg_perm+0xf1/0x1b0 [ 92.930448][ T6332] ? __pfx_netlink_sendmsg+0x10/0x10 [ 92.930466][ T6332] sock_sendmsg_nosec+0x13a/0x180 [ 92.930492][ T6332] sock_write_iter+0x2de/0x3e0 [ 92.930514][ T6332] ? __pfx_sock_write_iter+0x10/0x10 [ 92.930541][ T6332] ? bpf_lsm_file_permission+0x9/0x20 [ 92.930558][ T6332] ? security_file_permission+0x75/0x260 [ 92.930585][ T6332] vfs_write+0x612/0xba0 [ 92.930611][ T6332] ? __pfx_vfs_write+0x10/0x10 [ 92.930633][ T6332] ? do_sys_openat2+0x14e/0x200 [ 92.930648][ T6332] ? kmem_cache_free+0x182/0x650 [ 92.930663][ T6332] ? fd_install+0x94/0x3d0 [ 92.930693][ T6332] ksys_write+0x150/0x270 [ 92.930714][ T6332] ? __pfx_ksys_write+0x10/0x10 [ 92.930740][ T6332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.930756][ T6332] do_syscall_64+0x174/0x580 [ 92.930777][ T6332] ? trace_irq_disable+0x3b/0x140 [ 92.930794][ T6332] ? clear_bhb_loop+0x70/0xc0 [ 92.930812][ T6332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.930826][ T6332] RIP: 0033:0x7fd93d79e0d9 [ 92.930841][ T6332] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.930853][ T6332] RSP: 002b:00007fd93e6d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 92.930870][ T6332] RAX: ffffffffffffffda RBX: 00007fd93da25fa0 RCX: 00007fd93d79e0d9 [ 92.930880][ T6332] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 000000000000000d [ 92.930889][ T6332] RBP: 00007fd93e6d4090 R08: 0000000000000000 R09: 0000000000000000 [ 92.930897][ T6332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 92.930906][ T6332] R13: 00007fd93da26038 R14: 00007fd93da25fa0 R15: 00007ffde1e79a68 [ 92.930933][ T6332] [ 92.930963][ T6332] netlink: 4 bytes leftover after parsing attributes in process `syz.0.148'. [ 93.746542][ T6350] netlink: 24 bytes leftover after parsing attributes in process `syz.0.152'. [ 93.857331][ T6354] netlink: 332 bytes leftover after parsing attributes in process `syz.2.155'. [ 93.876230][ T6354] netlink: 108 bytes leftover after parsing attributes in process `syz.2.155'. [ 93.898464][ T6354] netlink: 32 bytes leftover after parsing attributes in process `syz.2.155'. [ 94.253261][ T6366] netlink: 60 bytes leftover after parsing attributes in process `syz.1.160'. [ 94.404418][ T6372] validate_nla: 7 callbacks suppressed [ 94.404435][ T6372] netlink: 'syz.1.162': attribute type 4 has an invalid length. [ 94.459042][ T6374] netlink: 'syz.1.162': attribute type 4 has an invalid length. [ 94.655748][ T6384] netlink: 'syz.1.166': attribute type 1 has an invalid length. [ 94.812614][ T6390] bond1: (slave gretap1): making interface the new active one [ 94.824379][ T6390] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 94.993772][ T6399] netlink: 12 bytes leftover after parsing attributes in process `syz.1.172'. [ 95.223265][ T6409] netlink: 'syz.2.176': attribute type 4 has an invalid length. [ 95.245372][ T2164] lo speed is unknown, defaulting to 1000 [ 95.251412][ T6409] netlink: 'syz.2.176': attribute type 4 has an invalid length. [ 95.268756][ T2164] syz0: Port: 1 Link DOWN [ 95.288893][ T5744] lo speed is unknown, defaulting to 1000 [ 95.301118][ T5717] lo speed is unknown, defaulting to 1000 [ 95.308178][ T5717] syz0: Port: 1 Link ACTIVE [ 95.400140][ T6413] __nla_validate_parse: 1 callbacks suppressed [ 95.400155][ T6413] netlink: 160 bytes leftover after parsing attributes in process `syz.3.177'. [ 95.444994][ T6413] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 95.585115][ T6423] netlink: 'syz.2.182': attribute type 3 has an invalid length. [ 95.666079][ T6420] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 95.690912][ T6431] netlink: 272 bytes leftover after parsing attributes in process `syz.2.182'. [ 95.715963][ T6420] bond1 (unregistering): Released all slaves [ 96.022947][ T6443] x_tables: duplicate entry at hook 1 [ 96.098863][ T6447] netlink: 'syz.4.189': attribute type 4 has an invalid length. [ 96.150619][ T6447] netlink: 'syz.4.189': attribute type 4 has an invalid length. [ 96.168879][ T6443] netlink: 12 bytes leftover after parsing attributes in process `syz.0.187'. [ 96.534497][ T6463] netlink: 60 bytes leftover after parsing attributes in process `syz.0.196'. [ 96.659789][ T6466] netlink: Conntrack attr has 4 unknown bytes [ 96.873500][ T6480] netlink: 'syz.4.201': attribute type 4 has an invalid length. [ 96.917604][ T6480] netlink: 'syz.4.201': attribute type 4 has an invalid length. [ 97.041017][ T6489] netlink: 8 bytes leftover after parsing attributes in process `syz.4.206'. [ 97.271777][ T6503] netlink: 60 bytes leftover after parsing attributes in process `syz.2.209'. [ 97.604228][ T6518] syzkaller0: entered promiscuous mode [ 97.626022][ T6518] syzkaller0: entered allmulticast mode [ 97.785181][ T6526] netlink: 16 bytes leftover after parsing attributes in process `syz.3.215'. [ 99.611560][ T6597] netlink: 68 bytes leftover after parsing attributes in process `syz.0.235'. [ 99.802948][ T6615] validate_nla: 5 callbacks suppressed [ 99.802964][ T6615] netlink: 'syz.3.241': attribute type 4 has an invalid length. [ 100.021250][ T6623] netlink: 'syz.2.245': attribute type 4 has an invalid length. [ 100.055885][ T6387] lo speed is unknown, defaulting to 1000 [ 100.070854][ T6623] netlink: 'syz.2.245': attribute type 4 has an invalid length. [ 100.096757][ T6387] syz0: Port: 1 Link DOWN [ 100.123176][ T187] lo speed is unknown, defaulting to 1000 [ 100.141441][ T187] syz0: Port: 1 Link ACTIVE [ 100.149059][ T5710] lo speed is unknown, defaulting to 1000 [ 100.238350][ T6633] x_tables: duplicate entry at hook 3 [ 100.360516][ T6636] xt_hashlimit: size too large, truncated to 1048576 [ 100.387924][ T6639] netlink: 'syz.3.252': attribute type 4 has an invalid length. [ 100.458032][ T6643] tipc: Started in network mode [ 100.468440][ T6643] tipc: Node identity 000000002e0000000000000000000001, cluster identity 4711 [ 100.516793][ T6643] tipc: Enabling of bearer rejected, failed to enable media [ 100.554854][ T6640] syzkaller0: entered promiscuous mode [ 100.576418][ T6640] syzkaller0: entered allmulticast mode [ 100.670793][ T6645] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.981145][ T6645] bridge_slave_0 (unregistering): left allmulticast mode [ 101.001029][ T6645] bridge_slave_0 (unregistering): left promiscuous mode [ 101.014527][ T6645] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.141030][ T6648] FAULT_INJECTION: forcing a failure. [ 101.141030][ T6648] name failslab, interval 1, probability 0, space 0, times 0 [ 101.157933][ T6648] CPU: 0 UID: 0 PID: 6648 Comm: syz.3.254 Not tainted syzkaller #0 PREEMPT(full) [ 101.157976][ T6648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.157993][ T6648] Call Trace: [ 101.157999][ T6648] [ 101.158006][ T6648] dump_stack_lvl+0xe8/0x150 [ 101.158032][ T6648] should_fail_ex+0x40c/0x560 [ 101.158055][ T6648] should_failslab+0xa8/0x100 [ 101.158078][ T6648] __kmalloc_node_noprof+0x105/0x740 [ 101.158097][ T6648] ? qdisc_create+0x64/0xf00 [ 101.158112][ T6648] ? lock_acquire+0x106/0x350 [ 101.158130][ T6648] ? qdisc_alloc+0x92/0x9d0 [ 101.158147][ T6648] ? qdisc_alloc+0x92/0x9d0 [ 101.158171][ T6648] qdisc_alloc+0x92/0x9d0 [ 101.158205][ T6648] qdisc_create+0x12c/0xf00 [ 101.158222][ T6648] ? lockdep_rtnl_is_held+0x26/0x40 [ 101.158243][ T6648] ? qdisc_lookup+0x364/0x6c0 [ 101.158266][ T6648] tc_modify_qdisc+0x17af/0x2390 [ 101.158296][ T6648] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 101.158340][ T6648] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 101.158356][ T6648] rtnetlink_rcv_msg+0x7b9/0xc00 [ 101.158378][ T6648] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 101.158395][ T6648] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 101.158411][ T6648] ? ref_tracker_free+0x689/0x830 [ 101.158432][ T6648] ? __pfx_ref_tracker_free+0x10/0x10 [ 101.158448][ T6648] ? __asan_memcpy+0x40/0x70 [ 101.158467][ T6648] ? __skb_clone+0x5c/0x6c0 [ 101.158491][ T6648] netlink_rcv_skb+0x226/0x4a0 [ 101.158512][ T6648] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 101.158530][ T6648] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 101.158559][ T6648] ? netlink_deliver_tap+0x2e/0x1b0 [ 101.158577][ T6648] ? netlink_deliver_tap+0x2e/0x1b0 [ 101.158601][ T6648] netlink_unicast+0x7bb/0x940 [ 101.158630][ T6648] netlink_sendmsg+0x813/0xb40 [ 101.158659][ T6648] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.158682][ T6648] ? aa_sock_msg_perm+0xf1/0x1b0 [ 101.158703][ T6648] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.158722][ T6648] sock_sendmsg_nosec+0x13a/0x180 [ 101.158746][ T6648] ____sys_sendmsg+0x54e/0x850 [ 101.158768][ T6648] ? __pfx_____sys_sendmsg+0x10/0x10 [ 101.158795][ T6648] ? import_iovec+0x73/0xa0 [ 101.158820][ T6648] ___sys_sendmsg+0x2a5/0x360 [ 101.158836][ T6648] ? __lock_acquire+0x683/0x2cf0 [ 101.158858][ T6648] ? __pfx____sys_sendmsg+0x10/0x10 [ 101.158906][ T6648] ? __fget_files+0x2a/0x420 [ 101.158923][ T6648] ? __fget_files+0x3a2/0x420 [ 101.158947][ T6648] __x64_sys_sendmsg+0x1b1/0x290 [ 101.158964][ T6648] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 101.158992][ T6648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.159005][ T6648] do_syscall_64+0x174/0x580 [ 101.159022][ T6648] ? trace_irq_disable+0x3b/0x140 [ 101.159036][ T6648] ? clear_bhb_loop+0x70/0xc0 [ 101.159051][ T6648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.159063][ T6648] RIP: 0033:0x7fa37ff9e0d9 [ 101.159075][ T6648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.159085][ T6648] RSP: 002b:00007fa380ef0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.159099][ T6648] RAX: ffffffffffffffda RBX: 00007fa380225fa0 RCX: 00007fa37ff9e0d9 [ 101.159107][ T6648] RDX: 0000000000000804 RSI: 00002000000012c0 RDI: 0000000000000005 [ 101.159115][ T6648] RBP: 00007fa380ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 101.159122][ T6648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.159129][ T6648] R13: 00007fa380226038 R14: 00007fa380225fa0 R15: 00007ffec6026958 [ 101.159149][ T6648] [ 101.210837][ T6668] FAULT_INJECTION: forcing a failure. [ 101.210837][ T6668] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 101.558081][ T6668] CPU: 0 UID: 0 PID: 6668 Comm: syz.4.261 Not tainted syzkaller #0 PREEMPT(full) [ 101.558106][ T6668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.558115][ T6668] Call Trace: [ 101.558121][ T6668] [ 101.558128][ T6668] dump_stack_lvl+0xe8/0x150 [ 101.558156][ T6668] should_fail_ex+0x40c/0x560 [ 101.558179][ T6668] _copy_from_user+0x2d/0xb0 [ 101.558203][ T6668] ___sys_sendmsg+0x1c6/0x360 [ 101.558229][ T6668] ? __lock_acquire+0x683/0x2cf0 [ 101.558253][ T6668] ? __pfx____sys_sendmsg+0x10/0x10 [ 101.558305][ T6668] ? __fget_files+0x2a/0x420 [ 101.558324][ T6668] ? __fget_files+0x3a2/0x420 [ 101.558352][ T6668] __x64_sys_sendmsg+0x1b1/0x290 [ 101.558374][ T6668] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 101.558410][ T6668] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.558428][ T6668] do_syscall_64+0x174/0x580 [ 101.558448][ T6668] ? trace_irq_disable+0x3b/0x140 [ 101.558467][ T6668] ? clear_bhb_loop+0x70/0xc0 [ 101.558486][ T6668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.558502][ T6668] RIP: 0033:0x7fc76b59e0d9 [ 101.558517][ T6668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.558530][ T6668] RSP: 002b:00007fc76c495028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.558547][ T6668] RAX: ffffffffffffffda RBX: 00007fc76b826090 RCX: 00007fc76b59e0d9 [ 101.558566][ T6668] RDX: 0000000000044000 RSI: 0000200000000100 RDI: 0000000000000004 [ 101.558576][ T6668] RBP: 00007fc76c495090 R08: 0000000000000000 R09: 0000000000000000 [ 101.558585][ T6668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 101.558595][ T6668] R13: 00007fc76b826128 R14: 00007fc76b826090 R15: 00007ffc7861c008 [ 101.558622][ T6668] [ 101.762130][ T6672] warning: `syz.3.263' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 101.911795][ T6679] netlink: 44 bytes leftover after parsing attributes in process `syz.1.266'. [ 101.929740][ T6677] netlink: 'syz.4.264': attribute type 4 has an invalid length. [ 102.003194][ T6684] netlink: 8 bytes leftover after parsing attributes in process `syz.3.268'. [ 102.674894][ T6719] netlink: 'syz.0.280': attribute type 4 has an invalid length. [ 102.982566][ T6725] netlink: 68 bytes leftover after parsing attributes in process `syz.0.282'. [ 103.110957][ T6736] netlink: 'syz.3.285': attribute type 34 has an invalid length. [ 103.601469][ T6760] netlink: 'syz.4.292': attribute type 4 has an invalid length. [ 104.128921][ T6740] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 104.147978][ T6740] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 104.173905][ T6779] netlink: 'syz.2.294': attribute type 1 has an invalid length. [ 104.254225][ T6740] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 104.274645][ T6740] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 104.329412][ T6740] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 104.345455][ T6740] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 104.355181][ T6785] netlink: 6068 bytes leftover after parsing attributes in process `syz.4.296'. [ 104.384732][ T6785] netlink: 6068 bytes leftover after parsing attributes in process `syz.4.296'. [ 104.428784][ T6740] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 104.446071][ T6740] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 104.499430][ T6740] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 104.523289][ T6740] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 105.281335][ T6826] xt_hashlimit: size too large, truncated to 1048576 [ 105.805145][ T6852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.309'. [ 105.944905][ T6858] xt_hashlimit: size too large, truncated to 1048576 [ 106.073633][ T6871] netlink: Unknown conntrack attr (type=16383, max=9) [ 106.089524][ T6873] netlink: 8 bytes leftover after parsing attributes in process `syz.3.310'. [ 106.105842][ T6871] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 106.313444][ T6866] –: renamed from vxcan1 (while UP) [ 106.502776][ T6882] netlink: 64 bytes leftover after parsing attributes in process `syz.1.314'. [ 106.565736][ T6882] syzkaller1: entered promiscuous mode [ 106.583276][ T6882] syzkaller1: entered allmulticast mode [ 106.702919][ T6899] netlink: 4 bytes leftover after parsing attributes in process `syz.4.319'. [ 106.767388][ T6899] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 107.531971][ T6942] xt_hashlimit: size too large, truncated to 1048576 [ 107.555805][ T6942] xt_hashlimit: max too large, truncated to 1048576 [ 107.583870][ T6942] FAULT_INJECTION: forcing a failure. [ 107.583870][ T6942] name failslab, interval 1, probability 0, space 0, times 0 [ 107.618745][ T6942] CPU: 1 UID: 0 PID: 6942 Comm: syz.2.330 Not tainted syzkaller #0 PREEMPT(full) [ 107.618769][ T6942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 107.618777][ T6942] Call Trace: [ 107.618784][ T6942] [ 107.618791][ T6942] dump_stack_lvl+0xe8/0x150 [ 107.618818][ T6942] should_fail_ex+0x40c/0x560 [ 107.618838][ T6942] ? __nf_hook_entries_try_shrink+0x34e/0x720 [ 107.618862][ T6942] should_failslab+0xa8/0x100 [ 107.618883][ T6942] __kvmalloc_node_noprof+0x176/0x860 [ 107.618908][ T6942] ? __nf_hook_entries_try_shrink+0x34e/0x720 [ 107.618935][ T6942] __nf_hook_entries_try_shrink+0x34e/0x720 [ 107.618966][ T6942] __nf_unregister_net_hook+0x4be/0x6d0 [ 107.618994][ T6942] nf_tables_abort+0x6f57/0x9110 [ 107.619010][ T6942] ? __x64_sys_sendmsg+0x1b1/0x290 [ 107.619028][ T6942] ? do_syscall_64+0x174/0x580 [ 107.619047][ T6942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.619084][ T6942] ? __pfx_nf_tables_abort+0x10/0x10 [ 107.619114][ T6942] ? kasan_quarantine_put+0xbb/0x1f0 [ 107.619137][ T6942] ? kfree+0x1c5/0x640 [ 107.619151][ T6942] ? nfnetlink_rcv+0x16fd/0x28c0 [ 107.619174][ T6942] nfnetlink_rcv+0x1f30/0x28c0 [ 107.619225][ T6942] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 107.619256][ T6942] ? ref_tracker_free+0x689/0x830 [ 107.619293][ T6942] ? lockdep_hardirqs_on+0x7a/0x110 [ 107.619315][ T6942] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 107.619334][ T6942] ? rcu_preempt_deferred_qs_irqrestore+0x7b7/0xb90 [ 107.619374][ T6942] netlink_unicast+0x7bb/0x940 [ 107.619401][ T6942] netlink_sendmsg+0x813/0xb40 [ 107.619431][ T6942] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.619454][ T6942] ? aa_sock_msg_perm+0xf1/0x1b0 [ 107.619482][ T6942] ? __pfx_netlink_sendmsg+0x10/0x10 [ 107.619501][ T6942] sock_sendmsg_nosec+0x13a/0x180 [ 107.619527][ T6942] ____sys_sendmsg+0x54e/0x850 [ 107.619558][ T6942] ? __pfx_____sys_sendmsg+0x10/0x10 [ 107.619584][ T6942] ? import_iovec+0x73/0xa0 [ 107.619609][ T6942] ___sys_sendmsg+0x2a5/0x360 [ 107.619627][ T6942] ? __lock_acquire+0x683/0x2cf0 [ 107.619650][ T6942] ? __pfx____sys_sendmsg+0x10/0x10 [ 107.619702][ T6942] ? __fget_files+0x2a/0x420 [ 107.619720][ T6942] ? __fget_files+0x3a2/0x420 [ 107.619747][ T6942] __x64_sys_sendmsg+0x1b1/0x290 [ 107.619767][ T6942] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 107.619801][ T6942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.619817][ T6942] do_syscall_64+0x174/0x580 [ 107.619836][ T6942] ? trace_irq_disable+0x3b/0x140 [ 107.619854][ T6942] ? clear_bhb_loop+0x70/0xc0 [ 107.619872][ T6942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.619886][ T6942] RIP: 0033:0x7ff56239e0d9 [ 107.619902][ T6942] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.619914][ T6942] RSP: 002b:00007ff56326e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 107.619931][ T6942] RAX: ffffffffffffffda RBX: 00007ff562625fa0 RCX: 00007ff56239e0d9 [ 107.619943][ T6942] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 107.619952][ T6942] RBP: 00007ff56326e090 R08: 0000000000000000 R09: 0000000000000000 [ 107.619962][ T6942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 107.619970][ T6942] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 107.619997][ T6942] [ 108.029053][ T6949] netlink: 68 bytes leftover after parsing attributes in process `syz.0.332'. [ 108.159654][ T6954] debugfs: '1ùà^!' already exists in 'ieee80211' [ 108.742781][ T6988] netlink: 44 bytes leftover after parsing attributes in process `syz.2.343'. [ 108.796215][ T6986] xt_CT: No such helper "syz0" [ 109.005514][ T6993] netlink: 68 bytes leftover after parsing attributes in process `syz.0.344'. [ 109.071494][ T6996] netlink: 68 bytes leftover after parsing attributes in process `syz.1.346'. [ 109.155131][ T7009] FAULT_INJECTION: forcing a failure. [ 109.155131][ T7009] name failslab, interval 1, probability 0, space 0, times 0 [ 109.211780][ T7009] CPU: 1 UID: 0 PID: 7009 Comm: syz.3.349 Not tainted syzkaller #0 PREEMPT(full) [ 109.211803][ T7009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 109.211811][ T7009] Call Trace: [ 109.211818][ T7009] [ 109.211825][ T7009] dump_stack_lvl+0xe8/0x150 [ 109.211851][ T7009] should_fail_ex+0x40c/0x560 [ 109.211876][ T7009] should_failslab+0xa8/0x100 [ 109.211900][ T7009] __kmalloc_noprof+0xfe/0x720 [ 109.211921][ T7009] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 109.211938][ T7009] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 109.211959][ T7009] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 109.211984][ T7009] genl_family_rcv_msg_doit+0xda/0x340 [ 109.212006][ T7009] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 109.212031][ T7009] ? apparmor_capable+0x126/0x170 [ 109.212052][ T7009] ? bpf_lsm_capable+0x9/0x20 [ 109.212070][ T7009] ? security_capable+0x7e/0x2c0 [ 109.212099][ T7009] genl_rcv_msg+0x614/0x7a0 [ 109.212122][ T7009] ? __pfx_genl_rcv_msg+0x10/0x10 [ 109.212136][ T7009] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 109.212152][ T7009] ? __pfx_nl80211_set_interface+0x10/0x10 [ 109.212169][ T7009] ? __pfx_nl80211_post_doit+0x10/0x10 [ 109.212185][ T7009] ? __pfx_ref_tracker_free+0x10/0x10 [ 109.212203][ T7009] ? __asan_memcpy+0x40/0x70 [ 109.212219][ T7009] ? __skb_clone+0x5c/0x6c0 [ 109.212242][ T7009] netlink_rcv_skb+0x226/0x4a0 [ 109.212263][ T7009] ? __pfx_genl_rcv_msg+0x10/0x10 [ 109.212280][ T7009] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 109.212314][ T7009] ? down_read+0x2be/0x330 [ 109.212333][ T7009] genl_rcv+0x28/0x40 [ 109.212348][ T7009] netlink_unicast+0x7bb/0x940 [ 109.212386][ T7009] netlink_sendmsg+0x813/0xb40 [ 109.212416][ T7009] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.212441][ T7009] ? aa_sock_msg_perm+0xf1/0x1b0 [ 109.212461][ T7009] ? __pfx_netlink_sendmsg+0x10/0x10 [ 109.212479][ T7009] sock_sendmsg_nosec+0x13a/0x180 [ 109.212504][ T7009] ____sys_sendmsg+0x54e/0x850 [ 109.212528][ T7009] ? __pfx_____sys_sendmsg+0x10/0x10 [ 109.212554][ T7009] ? import_iovec+0x73/0xa0 [ 109.212577][ T7009] ___sys_sendmsg+0x2a5/0x360 [ 109.212595][ T7009] ? __lock_acquire+0x683/0x2cf0 [ 109.212617][ T7009] ? __pfx____sys_sendmsg+0x10/0x10 [ 109.212669][ T7009] ? __fget_files+0x2a/0x420 [ 109.212687][ T7009] ? __fget_files+0x3a2/0x420 [ 109.212713][ T7009] __x64_sys_sendmsg+0x1b1/0x290 [ 109.212735][ T7009] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 109.212770][ T7009] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.212786][ T7009] do_syscall_64+0x174/0x580 [ 109.212809][ T7009] ? trace_irq_disable+0x3b/0x140 [ 109.212827][ T7009] ? clear_bhb_loop+0x70/0xc0 [ 109.212846][ T7009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.212861][ T7009] RIP: 0033:0x7fa37ff9e0d9 [ 109.212876][ T7009] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.212888][ T7009] RSP: 002b:00007fa380ef0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 109.212904][ T7009] RAX: ffffffffffffffda RBX: 00007fa380225fa0 RCX: 00007fa37ff9e0d9 [ 109.212916][ T7009] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 109.212925][ T7009] RBP: 00007fa380ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 109.212934][ T7009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.212943][ T7009] R13: 00007fa380226038 R14: 00007fa380225fa0 R15: 00007ffec6026958 [ 109.212971][ T7009] [ 109.615227][ T7015] hsr0: entered allmulticast mode [ 109.656951][ T7015] hsr_slave_0: entered allmulticast mode [ 109.740385][ T7015] hsr_slave_1: entered allmulticast mode [ 109.834771][ T7021] netlink: 8 bytes leftover after parsing attributes in process `syz.0.350'. [ 109.844949][ T7029] netlink: 64 bytes leftover after parsing attributes in process `syz.4.353'. [ 109.907947][ T7020] veth3: entered promiscuous mode [ 109.921176][ T7029] Cannot find add_set index 0 as target [ 109.954377][ T7029] Cannot find set identified by id 0 to match [ 109.995106][ T7014] hsr0: left allmulticast mode [ 110.007052][ T7014] hsr_slave_0: left allmulticast mode [ 110.013086][ T7014] hsr_slave_1: left allmulticast mode [ 110.177800][ T7042] netlink: 'syz.4.357': attribute type 2 has an invalid length. [ 110.305183][ T7049] syzkaller0: entered promiscuous mode [ 110.326751][ T7049] syzkaller0: entered allmulticast mode [ 110.629129][ T7057] netlink: 68 bytes leftover after parsing attributes in process `syz.4.364'. [ 110.738722][ T7067] netlink: 16 bytes leftover after parsing attributes in process `syz.3.367'. [ 110.778628][ T7066] netlink: 16 bytes leftover after parsing attributes in process `syz.3.367'. [ 110.828702][ T7066] netlink: 28 bytes leftover after parsing attributes in process `syz.3.367'. [ 111.064438][ T7080] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 111.247901][ T7085] syzkaller0: entered promiscuous mode [ 111.269230][ T7085] syzkaller0: entered allmulticast mode [ 111.455735][ T7097] veth0: entered promiscuous mode [ 111.462761][ T7097] vlan2: entered promiscuous mode [ 111.787575][ T7115] netlink: 'syz.2.383': attribute type 4 has an invalid length. [ 111.839754][ T7110] netlink: 'syz.2.383': attribute type 4 has an invalid length. [ 111.878227][ T7118] siw: device registration error -23 [ 111.959022][ T29] lo speed is unknown, defaulting to 1000 [ 112.044727][ T7125] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 112.063575][ T29] lo speed is unknown, defaulting to 1000 [ 112.095543][ T187] lo speed is unknown, defaulting to 1000 [ 112.123966][ T7114] lo speed is unknown, defaulting to 1000 [ 112.161173][ T7128] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 112.264592][ T7130] netlink: 'syz.1.389': attribute type 1 has an invalid length. [ 112.385313][ T7141] netlink: 'syz.1.389': attribute type 3 has an invalid length. [ 112.462607][ T7141] netlink: 'syz.1.389': attribute type 16 has an invalid length. [ 112.688966][ T7138] bond2: (slave geneve2): making interface the new active one [ 112.733441][ T7138] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 112.790577][ T43] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 112.826332][ T43] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 112.878091][ T43] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 112.907112][ T43] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 112.912484][ T7162] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 113.094533][ T7164] __nla_validate_parse: 12 callbacks suppressed [ 113.094550][ T7164] netlink: 68 bytes leftover after parsing attributes in process `syz.0.401'. [ 113.245407][ T7178] netlink: 32 bytes leftover after parsing attributes in process `syz.4.404'. [ 113.665142][ T7192] macvlan2: entered promiscuous mode [ 113.796374][ T7202] netlink: 'syz.0.414': attribute type 4 has an invalid length. [ 113.824082][ T7202] netlink: 'syz.0.414': attribute type 4 has an invalid length. [ 114.025451][ T7210] IPVS: length: 46 != 24 [ 132.709290][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.715629][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 151.638298][ T7226] netlink: 28 bytes leftover after parsing attributes in process `syz.1.421'. [ 151.807487][ T7236] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 151.870109][ T7233] netlink: 16 bytes leftover after parsing attributes in process `syz.4.424'. [ 151.913633][ T7233] netlink: 16 bytes leftover after parsing attributes in process `syz.4.424'. [ 151.922773][ T7234] netlink: 68 bytes leftover after parsing attributes in process `syz.2.422'. [ 151.925545][ T7245] netlink: 'syz.3.423': attribute type 13 has an invalid length. [ 151.950936][ T7236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.421'. [ 152.119066][ T7248] tipc: Started in network mode [ 152.124122][ T7248] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 152.131669][ T7248] tipc: Enabled bearer , priority 0 [ 152.274942][ T7256] netlink: 4 bytes leftover after parsing attributes in process `syz.2.426'. [ 152.325185][ T7260] netlink: 'syz.1.429': attribute type 4 has an invalid length. [ 152.489067][ T7266] lo speed is unknown, defaulting to 1000 [ 152.811073][ T7272] netlink: 68 bytes leftover after parsing attributes in process `syz.3.433'. [ 153.055312][ T7283] netlink: 8 bytes leftover after parsing attributes in process `syz.0.435'. [ 153.169088][ T7288] netlink: 'syz.3.437': attribute type 2 has an invalid length. [ 153.192950][ T7288] xt_hashlimit: size too large, truncated to 1048576 [ 153.199926][ T7288] xt_hashlimit: max too large, truncated to 1048576 [ 153.258765][ T29] tipc: Node number set to 43690 [ 153.287718][ T7291] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 153.287718][ T7291] Please contact the netfilter-devel mailing list or update your nftables rules. [ 153.416414][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031ccf400: rx timeout, send abort [ 153.701971][ T7299] syzkaller0: entered promiscuous mode [ 153.715183][ T7299] syzkaller0: entered allmulticast mode [ 153.916218][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031ccd400: rx timeout, send abort [ 153.926779][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031ccf400: abort rx timeout. Force session deactivation [ 154.113816][ T7301] netlink: 68 bytes leftover after parsing attributes in process `syz.1.441'. [ 154.311181][ T7304] netlink: 68 bytes leftover after parsing attributes in process `syz.0.442'. [ 154.424486][ C1] vcan0: j1939_tp_rxtimer: 0xffff888031ccd400: abort rx timeout. Force session deactivation [ 155.062341][ T7341] netlink: 'syz.3.452': attribute type 4 has an invalid length. [ 155.278067][ T7344] ipvlan0: entered promiscuous mode [ 155.297042][ T7344] bond0: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 155.329471][ T7344] bond0: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 155.344884][ T7344] bond0: (slave ipvlan0): Error -95 calling set_mac_address [ 155.381204][ T7352] netlink: 'syz.3.456': attribute type 1 has an invalid length. [ 155.606581][ T7359] C: renamed from veth1_to_team (while UP) [ 155.663300][ T7359] netlink: 'syz.1.457': attribute type 2 has an invalid length. [ 155.722517][ T7359] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 156.389093][ T7419] Bluetooth: hci3: Opcode 0x0401 failed: -22 [ 157.135824][ T7443] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 157.211037][ T7449] __nla_validate_parse: 6 callbacks suppressed [ 157.211052][ T7449] netlink: 12 bytes leftover after parsing attributes in process `syz.0.475'. [ 157.387489][ T7461] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 157.583056][ T7453] netlink: 68 bytes leftover after parsing attributes in process `syz.3.476'. [ 158.055574][ T7486] syzkaller0: entered promiscuous mode [ 158.071424][ T7486] syzkaller0: entered allmulticast mode [ 158.084187][ T7486] netlink: 8 bytes leftover after parsing attributes in process `syz.3.487'. [ 158.213201][ T7494] netlink: 28 bytes leftover after parsing attributes in process `syz.3.491'. [ 158.325926][ T7502] netlink: 'syz.1.492': attribute type 4 has an invalid length. [ 158.370663][ T7502] netlink: 'syz.1.492': attribute type 4 has an invalid length. [ 158.374547][ T7503] netlink: 4 bytes leftover after parsing attributes in process `syz.3.494'. [ 158.473649][ T7509] FAULT_INJECTION: forcing a failure. [ 158.473649][ T7509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 158.487108][ T7509] CPU: 1 UID: 0 PID: 7509 Comm: syz.0.496 Not tainted syzkaller #0 PREEMPT(full) [ 158.487129][ T7509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 158.487138][ T7509] Call Trace: [ 158.487144][ T7509] [ 158.487151][ T7509] dump_stack_lvl+0xe8/0x150 [ 158.487177][ T7509] should_fail_ex+0x40c/0x560 [ 158.487202][ T7509] _copy_from_user+0x2d/0xb0 [ 158.487225][ T7509] do_sock_getsockopt+0x200/0x7e0 [ 158.487251][ T7509] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 158.487285][ T7509] ? __fget_files+0x3a2/0x420 [ 158.487303][ T7509] ? __fget_files+0x2a/0x420 [ 158.487328][ T7509] __x64_sys_getsockopt+0x1a4/0x240 [ 158.487353][ T7509] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.487370][ T7509] do_syscall_64+0x174/0x580 [ 158.487391][ T7509] ? trace_irq_disable+0x3b/0x140 [ 158.487409][ T7509] ? clear_bhb_loop+0x70/0xc0 [ 158.487428][ T7509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 158.487444][ T7509] RIP: 0033:0x7fd93d79e0d9 [ 158.487459][ T7509] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.487471][ T7509] RSP: 002b:00007fd93e6d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 158.487488][ T7509] RAX: ffffffffffffffda RBX: 00007fd93da25fa0 RCX: 00007fd93d79e0d9 [ 158.487499][ T7509] RDX: 000000000000003d RSI: 0000000000000029 RDI: 0000000000000003 [ 158.487509][ T7509] RBP: 00007fd93e6d4090 R08: 00002000000003c0 R09: 0000000000000000 [ 158.487519][ T7509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 158.487528][ T7509] R13: 00007fd93da26038 R14: 00007fd93da25fa0 R15: 00007ffde1e79a68 [ 158.487555][ T7509] [ 158.801919][ T7517] trusted_key: syz.3.501 sent an empty control message without MSG_MORE. [ 158.835546][ T7519] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 158.869995][ T7522] lo: Caught tx_queue_len zero misconfig [ 158.995794][ T7522] netlink: 12 bytes leftover after parsing attributes in process `syz.3.502'. [ 159.554191][ T7553] netlink: 'syz.1.514': attribute type 1 has an invalid length. [ 159.891363][ T7567] tipc: Enabling of bearer rejected, already enabled [ 160.019579][ T7572] FAULT_INJECTION: forcing a failure. [ 160.019579][ T7572] name failslab, interval 1, probability 0, space 0, times 0 [ 160.071441][ T7572] CPU: 0 UID: 0 PID: 7572 Comm: syz.1.520 Not tainted syzkaller #0 PREEMPT(full) [ 160.071462][ T7572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 160.071471][ T7572] Call Trace: [ 160.071477][ T7572] [ 160.071485][ T7572] dump_stack_lvl+0xe8/0x150 [ 160.071510][ T7572] should_fail_ex+0x40c/0x560 [ 160.071533][ T7572] should_failslab+0xa8/0x100 [ 160.071556][ T7572] __kmalloc_cache_noprof+0xa8/0x660 [ 160.071574][ T7572] ? __pfx___mutex_trylock_common+0x10/0x10 [ 160.071599][ T7572] ? flow_indr_dev_setup_offload+0x252/0x670 [ 160.071616][ T7572] ? flow_indr_dev_setup_offload+0x252/0x670 [ 160.071646][ T7572] flow_indr_dev_setup_offload+0x252/0x670 [ 160.071667][ T7572] ? __pfx_tc_block_indr_cleanup+0x10/0x10 [ 160.071689][ T7572] tcf_block_offload_cmd+0x288/0x3b0 [ 160.071709][ T7572] ? tcf_block_get_ext+0xe87/0x17d0 [ 160.071730][ T7572] ? __pfx_tcf_block_offload_cmd+0x10/0x10 [ 160.071758][ T7572] ? down_write+0x16d/0x200 [ 160.071774][ T7572] ? __pfx_down_write+0x10/0x10 [ 160.071789][ T7572] ? tcf_block_get_ext+0x6e7/0x17d0 [ 160.071813][ T7572] tcf_block_get_ext+0xfe0/0x17d0 [ 160.071839][ T7572] ? __pfx_prio_init+0x10/0x10 [ 160.071857][ T7572] tcf_block_get+0x67/0xa0 [ 160.071874][ T7572] ? __pfx_tcf_chain_head_change_dflt+0x10/0x10 [ 160.071896][ T7572] prio_init+0x36/0x80 [ 160.071914][ T7572] qdisc_create+0x7b5/0xf00 [ 160.071931][ T7572] ? lockdep_rtnl_is_held+0x26/0x40 [ 160.071956][ T7572] tc_modify_qdisc+0x17af/0x2390 [ 160.071986][ T7572] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 160.072002][ T7572] ? __dev_queue_xmit+0x29b/0x3820 [ 160.072047][ T7572] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 160.072062][ T7572] rtnetlink_rcv_msg+0x7b9/0xc00 [ 160.072084][ T7572] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 160.072102][ T7572] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 160.072118][ T7572] ? ref_tracker_free+0x689/0x830 [ 160.072140][ T7572] ? __pfx_ref_tracker_free+0x10/0x10 [ 160.072158][ T7572] ? __asan_memcpy+0x40/0x70 [ 160.072174][ T7572] ? __skb_clone+0x5c/0x6c0 [ 160.072200][ T7572] netlink_rcv_skb+0x226/0x4a0 [ 160.072221][ T7572] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 160.072241][ T7572] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 160.072273][ T7572] ? netlink_deliver_tap+0x2e/0x1b0 [ 160.072293][ T7572] ? netlink_deliver_tap+0x2e/0x1b0 [ 160.072318][ T7572] netlink_unicast+0x7bb/0x940 [ 160.072348][ T7572] netlink_sendmsg+0x813/0xb40 [ 160.072378][ T7572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 160.072402][ T7572] ? aa_sock_msg_perm+0xf1/0x1b0 [ 160.072424][ T7572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 160.072443][ T7572] sock_sendmsg_nosec+0x13a/0x180 [ 160.072469][ T7572] ____sys_sendmsg+0x54e/0x850 [ 160.072494][ T7572] ? __pfx_____sys_sendmsg+0x10/0x10 [ 160.072526][ T7572] ? import_iovec+0x73/0xa0 [ 160.072551][ T7572] ___sys_sendmsg+0x2a5/0x360 [ 160.072570][ T7572] ? __lock_acquire+0x683/0x2cf0 [ 160.072594][ T7572] ? __pfx____sys_sendmsg+0x10/0x10 [ 160.072654][ T7572] ? __fget_files+0x2a/0x420 [ 160.072673][ T7572] ? __fget_files+0x3a2/0x420 [ 160.072702][ T7572] __x64_sys_sendmsg+0x1b1/0x290 [ 160.072725][ T7572] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 160.072763][ T7572] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.072781][ T7572] do_syscall_64+0x174/0x580 [ 160.072801][ T7572] ? trace_irq_disable+0x3b/0x140 [ 160.072820][ T7572] ? clear_bhb_loop+0x70/0xc0 [ 160.072839][ T7572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 160.072855][ T7572] RIP: 0033:0x7f325259e0d9 [ 160.072871][ T7572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 160.072883][ T7572] RSP: 002b:00007f3253443028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 160.072898][ T7572] RAX: ffffffffffffffda RBX: 00007f3252825fa0 RCX: 00007f325259e0d9 [ 160.072910][ T7572] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000003 [ 160.072919][ T7572] RBP: 00007f3253443090 R08: 0000000000000000 R09: 0000000000000000 [ 160.072929][ T7572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 160.072938][ T7572] R13: 00007f3252826038 R14: 00007f3252825fa0 R15: 00007ffea3f12e28 [ 160.072966][ T7572] [ 160.701564][ T7590] netlink: 'syz.1.528': attribute type 4 has an invalid length. [ 161.320023][ T7609] syzkaller0: entered promiscuous mode [ 161.342909][ T7609] syzkaller0: entered allmulticast mode [ 161.629493][ T7630] netlink: 'syz.4.537': attribute type 58 has an invalid length. [ 161.638680][ T7630] netlink: 20 bytes leftover after parsing attributes in process `syz.4.537'. [ 161.837601][ T7635] netlink: 68 bytes leftover after parsing attributes in process `syz.2.536'. [ 162.856295][ T7626] bridge_slave_0: left allmulticast mode [ 162.862013][ T7626] bridge_slave_0: left promiscuous mode [ 162.869216][ T7626] bridge0: port 1(bridge_slave_0) entered disabled state [ 162.879675][ T7626] bridge_slave_1: left allmulticast mode [ 162.885306][ T7626] bridge_slave_1: left promiscuous mode [ 162.891445][ T7626] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.906105][ T7626] bond0: (slave bond_slave_0): Releasing backup interface [ 162.917855][ T7626] bond0: (slave bond_slave_1): Releasing backup interface [ 162.934234][ T7626] team0: Port device team_slave_0 removed [ 162.948748][ T7626] team0: Port device team_slave_1 removed [ 162.964542][ T7626] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 162.972199][ T7644] netlink: 56 bytes leftover after parsing attributes in process `syz.1.540'. [ 162.982957][ T7626] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 162.991475][ T7626] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 162.999157][ T7626] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 163.007681][ T7626] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 163.182661][ T7652] netlink: 4 bytes leftover after parsing attributes in process `syz.4.543'. [ 163.212919][ T7652] netlink: 3 bytes leftover after parsing attributes in process `syz.4.543'. [ 163.232693][ T7652] netlink: 40 bytes leftover after parsing attributes in process `syz.4.543'. [ 163.567690][ T7671] netlink: 'syz.0.548': attribute type 10 has an invalid length. [ 163.609789][ T7671] 8021q: adding VLAN 0 to HW filter on device team0 [ 163.620254][ T7671] bond0: (slave team0): Enslaving as an active interface with an up link [ 164.012487][ T7689] FAULT_INJECTION: forcing a failure. [ 164.012487][ T7689] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 164.072752][ T7689] CPU: 1 UID: 0 PID: 7689 Comm: syz.0.555 Not tainted syzkaller #0 PREEMPT(full) [ 164.072774][ T7689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 164.072783][ T7689] Call Trace: [ 164.072790][ T7689] [ 164.072797][ T7689] dump_stack_lvl+0xe8/0x150 [ 164.072823][ T7689] should_fail_ex+0x40c/0x560 [ 164.072846][ T7689] _copy_from_user+0x2d/0xb0 [ 164.072870][ T7689] ___sys_recvmsg+0x173/0x5a0 [ 164.072896][ T7689] ? __pfx____sys_recvmsg+0x10/0x10 [ 164.072920][ T7689] ? __fget_files+0x2a/0x420 [ 164.072965][ T7689] do_recvmmsg+0x31a/0x7f0 [ 164.072999][ T7689] ? __pfx_do_recvmmsg+0x10/0x10 [ 164.073030][ T7689] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 164.073053][ T7689] ? __fget_files+0x3a2/0x420 [ 164.073085][ T7689] __x64_sys_recvmmsg+0x198/0x250 [ 164.073108][ T7689] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 164.073135][ T7689] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.073152][ T7689] do_syscall_64+0x174/0x580 [ 164.073173][ T7689] ? trace_irq_disable+0x3b/0x140 [ 164.073192][ T7689] ? clear_bhb_loop+0x70/0xc0 [ 164.073211][ T7689] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.073227][ T7689] RIP: 0033:0x7fd93d79e0d9 [ 164.073241][ T7689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.073254][ T7689] RSP: 002b:00007fd93e6b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 164.073278][ T7689] RAX: ffffffffffffffda RBX: 00007fd93da26090 RCX: 00007fd93d79e0d9 [ 164.073290][ T7689] RDX: 000000000291962b RSI: 0000200000000040 RDI: 0000000000000003 [ 164.073300][ T7689] RBP: 00007fd93e6b3090 R08: 0000000000000000 R09: 0000000000000000 [ 164.073310][ T7689] R10: 45833af92e4b39ff R11: 0000000000000246 R12: 0000000000000002 [ 164.073320][ T7689] R13: 00007fd93da26128 R14: 00007fd93da26090 R15: 00007ffde1e79a68 [ 164.073347][ T7689] [ 164.686134][ T7702] netlink: 40 bytes leftover after parsing attributes in process `syz.2.561'. [ 164.779419][ T7696] netlink: 68 bytes leftover after parsing attributes in process `syz.1.558'. [ 165.113249][ T7721] netlink: 28 bytes leftover after parsing attributes in process `syz.0.567'. [ 165.167639][ T7724] veth0: entered promiscuous mode [ 165.172898][ T7724] vlan2: entered promiscuous mode [ 165.274261][ T7728] tipc: Started in network mode [ 165.295751][ T7728] tipc: Node identity a6baf63220be, cluster identity 4711 [ 165.324277][ T7728] tipc: Enabled bearer , priority 1 [ 165.339178][ T7727] tipc: Resetting bearer [ 165.349072][ T7733] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 165.410018][ T7727] tipc: Disabling bearer [ 165.611400][ T7741] tipc: Started in network mode [ 165.617196][ T7741] tipc: Node identity 1639903a3101, cluster identity 4711 [ 165.624787][ T7741] tipc: Enabled bearer , priority 0 [ 165.800607][ T7754] netlink: 'syz.3.580': attribute type 4 has an invalid length. [ 165.803896][ T7747] netlink: 68 bytes leftover after parsing attributes in process `syz.1.577'. [ 165.832964][ T7754] netlink: 'syz.3.580': attribute type 4 has an invalid length. [ 165.940145][ T7767] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 166.212120][ T7783] IPVS: set_ctl: invalid protocol: 255 0.0.0.0:20003 [ 166.234168][ T7771] tipc: Started in network mode [ 166.252461][ T7771] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 166.271520][ T7784] netlink: 16 bytes leftover after parsing attributes in process `syz.4.587'. [ 166.277079][ T7771] tipc: Enabled bearer , priority 10 [ 166.529287][ T7798] netlink: 12 bytes leftover after parsing attributes in process `syz.2.592'. [ 166.545458][ T7797] Bluetooth: hci0: invalid length 0, exp 2 for type 30 [ 166.658870][ T7802] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 166.718109][ T7806] netlink: 'syz.2.598': attribute type 4 has an invalid length. [ 166.757229][ T7806] netlink: 'syz.2.598': attribute type 4 has an invalid length. [ 166.767524][ T2164] tipc: Node number set to 658018362 [ 166.792160][ T5834] lo speed is unknown, defaulting to 1000 [ 166.821022][ T5834] lo speed is unknown, defaulting to 1000 [ 166.827852][ T7808] netlink: 'syz.3.600': attribute type 5 has an invalid length. [ 166.916291][ T5710] lo speed is unknown, defaulting to 1000 [ 166.970073][ T7816] RDS: rds_bind could not find a transport for 0:0:80::ffff:ffff, load rds_tcp or rds_rdma? [ 167.147432][ T7824] FAULT_INJECTION: forcing a failure. [ 167.147432][ T7824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 167.181521][ T7824] CPU: 1 UID: 0 PID: 7824 Comm: syz.4.607 Not tainted syzkaller #0 PREEMPT(full) [ 167.181544][ T7824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 167.181552][ T7824] Call Trace: [ 167.181558][ T7824] [ 167.181565][ T7824] dump_stack_lvl+0xe8/0x150 [ 167.181592][ T7824] should_fail_ex+0x40c/0x560 [ 167.181616][ T7824] _copy_from_iter+0x1d3/0x1660 [ 167.181645][ T7824] ? rcu_is_watching+0x15/0xb0 [ 167.181666][ T7824] ? __pfx__copy_from_iter+0x10/0x10 [ 167.181684][ T7824] ? trace_kmalloc+0x2a/0xf0 [ 167.181704][ T7824] ? __kmalloc_noprof+0x396/0x720 [ 167.181721][ T7824] ? vfs_write+0x22b/0xba0 [ 167.181740][ T7824] ? __kmalloc_noprof+0x1ad/0x720 [ 167.181758][ T7824] ? kernfs_fop_write_iter+0x157/0x540 [ 167.181781][ T7824] kernfs_fop_write_iter+0x19a/0x540 [ 167.181802][ T7824] vfs_write+0x612/0xba0 [ 167.181831][ T7824] ? __pfx_vfs_write+0x10/0x10 [ 167.181862][ T7824] ? __fget_files+0x2a/0x420 [ 167.181889][ T7824] ksys_write+0x150/0x270 [ 167.181912][ T7824] ? __pfx_ksys_write+0x10/0x10 [ 167.181942][ T7824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.181960][ T7824] do_syscall_64+0x174/0x580 [ 167.181980][ T7824] ? trace_irq_disable+0x3b/0x140 [ 167.181998][ T7824] ? clear_bhb_loop+0x70/0xc0 [ 167.182017][ T7824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 167.182032][ T7824] RIP: 0033:0x7fc76b59e0d9 [ 167.182047][ T7824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 167.182060][ T7824] RSP: 002b:00007fc76c4b6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 167.182076][ T7824] RAX: ffffffffffffffda RBX: 00007fc76b825fa0 RCX: 00007fc76b59e0d9 [ 167.182087][ T7824] RDX: 000000000000000a RSI: 0000200000000340 RDI: 0000000000000008 [ 167.182096][ T7824] RBP: 00007fc76c4b6090 R08: 0000000000000000 R09: 0000000000000000 [ 167.182105][ T7824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 167.182113][ T7824] R13: 00007fc76b826038 R14: 00007fc76b825fa0 R15: 00007ffc7861c008 [ 167.182141][ T7824] [ 167.407959][ T187] tipc: Node number set to 10136234 [ 167.408186][ T7833] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 167.495757][ T7837] netlink: 'syz.3.613': attribute type 4 has an invalid length. [ 167.571971][ T7840] netlink: 'syz.3.613': attribute type 4 has an invalid length. [ 167.932900][ T7858] tls_set_device_offload: netdev not found [ 194.150992][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.157391][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 210.112141][ T7867] openvswitch: netlink: nsh attr 1 has unexpected len 335 expected 8 [ 210.124548][ T7867] netlink: 'syz.1.625': attribute type 1 has an invalid length. [ 210.132988][ T7866] __nla_validate_parse: 7 callbacks suppressed [ 210.133003][ T7866] netlink: 8 bytes leftover after parsing attributes in process `syz.4.628'. [ 210.174900][ T7872] veth0: entered promiscuous mode [ 210.181160][ T7872] vlan0: entered promiscuous mode [ 210.404449][ T7883] netlink: 12 bytes leftover after parsing attributes in process `syz.4.631'. [ 210.461387][ T7889] netlink: 4 bytes leftover after parsing attributes in process `syz.1.632'. [ 210.486582][ T7873] netlink: 12 bytes leftover after parsing attributes in process `syz.2.626'. [ 210.514990][ T7883] 8021q: adding VLAN 0 to HW filter on device bond1 [ 210.619148][ T7890] bond1: entered promiscuous mode [ 210.624291][ T7890] bond1: entered allmulticast mode [ 210.879828][ T7897] xt_hashlimit: size too large, truncated to 1048576 [ 210.899593][ T7897] xt_hashlimit: Unknown mode mask B86BCC12, kernel too old? [ 211.220077][ T7910] lo speed is unknown, defaulting to 1000 [ 211.387862][ T7917] netlink: 24 bytes leftover after parsing attributes in process `syz.2.640'. [ 211.615052][ T7916] netlink: 68 bytes leftover after parsing attributes in process `syz.4.642'. [ 211.761411][ T7924] netlink: 68 bytes leftover after parsing attributes in process `syz.0.643'. [ 211.900941][ T7911] siw: device registration error -23 [ 212.368264][ T7948] netlink: 'syz.3.650': attribute type 4 has an invalid length. [ 212.410118][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 212.413743][ T7943] netlink: 'syz.3.650': attribute type 4 has an invalid length. [ 212.550007][ T5605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 212.725785][ T7959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.653'. [ 212.827947][ T7955] netlink: 68 bytes leftover after parsing attributes in process `syz.1.652'. [ 212.886525][ T7961] netlink: 'syz.3.654': attribute type 4 has an invalid length. [ 212.940970][ T7962] netlink: 'syz.3.654': attribute type 4 has an invalid length. [ 213.350934][ T5605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 213.433734][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 213.454314][ T7983] syzkaller0: entered promiscuous mode [ 213.476220][ T7983] syzkaller0: entered allmulticast mode [ 213.665760][ T7987] syzkaller0: entered promiscuous mode [ 213.680928][ T7987] syzkaller0: entered allmulticast mode [ 213.708942][ T7993] netlink: 'syz.3.666': attribute type 2 has an invalid length. [ 214.433511][ T8008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.669'. [ 214.474701][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.175588][ T8010] __nla_validate_parse: 1 callbacks suppressed [ 215.175604][ T8010] netlink: 20 bytes leftover after parsing attributes in process `syz.2.670'. [ 215.198745][ T8012] netlink: 44 bytes leftover after parsing attributes in process `syz.3.671'. [ 215.278335][ T8016] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.306891][ T8016] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.340862][ T8016] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.373444][ T8015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.396449][ T8025] netlink: 'syz.2.676': attribute type 4 has an invalid length. [ 215.405511][ T8015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.453529][ T8027] netlink: 'syz.2.676': attribute type 4 has an invalid length. [ 215.509496][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 215.590840][ T5710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 216.065683][ T5710] lo speed is unknown, defaulting to 1000 [ 216.090599][ T5710] lo speed is unknown, defaulting to 1000 [ 216.116116][ T5605] lo speed is unknown, defaulting to 1000 [ 216.547768][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 216.562087][ T8054] netlink: Conntrack attr has 4 unknown bytes [ 216.840361][ T8066] lo speed is unknown, defaulting to 1000 [ 216.874686][ T8071] syzkaller0: entered promiscuous mode [ 216.893121][ T8071] syzkaller0: entered allmulticast mode [ 217.482581][ T8096] netlink: 4 bytes leftover after parsing attributes in process `syz.0.699'. [ 217.533648][ T8073] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 217.650225][ T8103] netlink: 20 bytes leftover after parsing attributes in process `syz.3.701'. [ 217.675694][ T8104] xt_hashlimit: size too large, truncated to 1048576 [ 217.688449][ T8103] syzkaller0: left promiscuous mode [ 217.689085][ T8104] xt_hashlimit: Unknown mode mask B86BCC12, kernel too old? [ 217.698279][ T8103] syzkaller0: left allmulticast mode [ 217.800825][ T8108] ip6gre1: entered promiscuous mode [ 217.801505][ T8109] Bluetooth: MGMT ver 1.23 [ 217.823667][ T8108] ip6gre1: entered allmulticast mode [ 217.870701][ T8112] netlink: 4 bytes leftover after parsing attributes in process `syz.1.705'. [ 217.906519][ T8112] netlink: 12 bytes leftover after parsing attributes in process `syz.1.705'. [ 217.919379][ T8114] xt_hashlimit: size too large, truncated to 1048576 [ 217.928467][ T8114] xt_hashlimit: max too large, truncated to 1048576 [ 218.468926][ T8131] syzkaller0: entered promiscuous mode [ 218.484626][ T8131] syzkaller0: entered allmulticast mode [ 218.901498][ T8150] netlink: 'syz.0.719': attribute type 4 has an invalid length. [ 218.919921][ T8150] netlink: 'syz.0.719': attribute type 4 has an invalid length. [ 218.938356][ T8152] netlink: 12 bytes leftover after parsing attributes in process `syz.2.718'. [ 218.973771][ T8156] tipc: Enabling of bearer rejected, failed to enable media [ 219.279444][ T8173] x_tables: duplicate underflow at hook 2 [ 219.365392][ T8180] netlink: 16 bytes leftover after parsing attributes in process `syz.3.727'. [ 219.477818][ T8186] netlink: 8 bytes leftover after parsing attributes in process `syz.0.730'. [ 219.525274][ T8189] netlink: 'syz.0.731': attribute type 4 has an invalid length. [ 219.541423][ T8189] netlink: 'syz.0.731': attribute type 4 has an invalid length. [ 219.732029][ T8198] tipc: Enabling of bearer rejected, failed to enable media [ 219.842787][ T8200] netlink: 64 bytes leftover after parsing attributes in process `syz.0.737'. [ 220.132215][ T8214] netlink: 'syz.4.741': attribute type 2 has an invalid length. [ 220.143543][ T8217] netlink: 'syz.3.742': attribute type 4 has an invalid length. [ 220.193443][ T8217] netlink: 'syz.3.742': attribute type 4 has an invalid length. [ 220.319869][ T8221] syzkaller0: entered promiscuous mode [ 220.329899][ T8221] syzkaller0: entered allmulticast mode [ 220.572910][ T8238] pimreg: entered allmulticast mode [ 220.610767][ T8244] macvlan2: entered promiscuous mode [ 220.722488][ T2164] net_ratelimit: 16 callbacks suppressed [ 220.722503][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 220.755917][ T8251] openvswitch: netlink: Flow actions attr not present in new flow. [ 220.755917][ T8252] openvswitch: netlink: Flow actions attr not present in new flow. [ 220.922398][ T8261] __nla_validate_parse: 4 callbacks suppressed [ 220.922413][ T8261] netlink: 16 bytes leftover after parsing attributes in process `syz.3.756'. [ 221.090563][ T8265] netlink: 'syz.4.759': attribute type 4 has an invalid length. [ 221.116838][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.139243][ T8267] netlink: 'syz.1.760': attribute type 1 has an invalid length. [ 221.148883][ T8269] xt_hashlimit: size too large, truncated to 1048576 [ 221.156057][ T8270] netlink: 'syz.4.759': attribute type 4 has an invalid length. [ 221.238259][ T8278] netlink: 4 bytes leftover after parsing attributes in process `syz.2.762'. [ 221.259361][ T8267] 8021q: adding VLAN 0 to HW filter on device bond3 [ 221.336910][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.367647][ T8267] batman_adv: batadv0: Adding interface: vlan0 [ 221.390412][ T8267] batman_adv: batadv0: The MTU of interface vlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 221.448877][ T8267] batman_adv: batadv0: Not using interface vlan0 (retrying later): interface not active [ 221.496825][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.612795][ T8301] netlink: 16 bytes leftover after parsing attributes in process `syz.0.768'. [ 221.630078][ T8303] netlink: 104 bytes leftover after parsing attributes in process `syz.1.767'. [ 221.760144][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.781073][ T8305] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.834012][ T8305] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 221.942149][ T8305] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 222.025151][ T8305] netlink: 4 bytes leftover after parsing attributes in process `syz.4.766'. [ 222.150626][ T8328] netlink: 'syz.1.776': attribute type 4 has an invalid length. [ 222.191193][ T8331] netdevsim netdevsim2: Direct firmware load for á failed with error -2 [ 222.206444][ T8328] netlink: 'syz.1.776': attribute type 4 has an invalid length. [ 222.220723][ T8331] netdevsim netdevsim2: Falling back to sysfs fallback for: á [ 222.372122][ T8338] netlink: 'syz.3.779': attribute type 13 has an invalid length. [ 222.703439][ T8356] IPVS: set_ctl: invalid protocol: 47 172.20.20.187:20004 [ 222.731953][ T8354] netlink: 68 bytes leftover after parsing attributes in process `syz.0.784'. [ 222.780701][ T8354] netlink: 'syz.0.784': attribute type 1 has an invalid length. [ 222.807154][ T8354] netlink: 224 bytes leftover after parsing attributes in process `syz.0.784'. [ 222.845384][ T8360] xt_hashlimit: size too large, truncated to 1048576 [ 222.894437][ T8366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.788'. [ 223.062068][ T8371] tipc: Resetting bearer [ 223.150098][ T8371] tipc: Disabling bearer [ 223.273939][ T8382] netlink: 'syz.4.791': attribute type 4 has an invalid length. [ 223.281978][ T8383] netlink: 16 bytes leftover after parsing attributes in process `syz.2.789'. [ 223.322634][ T8382] netlink: 'syz.4.791': attribute type 4 has an invalid length. [ 223.520529][ T8393] netlink: 16 bytes leftover after parsing attributes in process `syz.0.794'. [ 223.590969][ T8396] Bluetooth: hci0: invalid length 0, exp 2 for type 22 [ 223.681418][ T8401] FAULT_INJECTION: forcing a failure. [ 223.681418][ T8401] name failslab, interval 1, probability 0, space 0, times 0 [ 223.712174][ T8401] CPU: 0 UID: 0 PID: 8401 Comm: syz.0.798 Not tainted syzkaller #0 PREEMPT(full) [ 223.712217][ T8401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 223.712237][ T8401] Call Trace: [ 223.712244][ T8401] [ 223.712258][ T8401] dump_stack_lvl+0xe8/0x150 [ 223.712285][ T8401] should_fail_ex+0x40c/0x560 [ 223.712310][ T8401] should_failslab+0xa8/0x100 [ 223.712334][ T8401] __kmalloc_cache_noprof+0xa8/0x660 [ 223.712352][ T8401] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 223.712372][ T8401] ? __kmalloc_cache_noprof+0x150/0x660 [ 223.712390][ T8401] ? sctp_add_bind_addr+0x8c/0x370 [ 223.712407][ T8401] ? sctp_add_bind_addr+0x8c/0x370 [ 223.712431][ T8401] sctp_add_bind_addr+0x8c/0x370 [ 223.712453][ T8401] sctp_copy_local_addr_list+0x31a/0x4e0 [ 223.712475][ T8401] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 223.712493][ T8401] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 223.712513][ T8401] ? sctp_v6_is_any+0x64/0x80 [ 223.712534][ T8401] ? sctp_copy_one_addr+0x93/0x360 [ 223.712555][ T8401] sctp_bind_addr_copy+0xb3/0x3c0 [ 223.712573][ T8401] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 223.712594][ T8401] sctp_connect_new_asoc+0x2ff/0x6b0 [ 223.712619][ T8401] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 223.712646][ T8401] ? __local_bh_enable_ip+0xd0/0x130 [ 223.712661][ T8401] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 223.712678][ T8401] ? security_sctp_bind_connect+0x7e/0x2c0 [ 223.712698][ T8401] sctp_sendmsg+0x159b/0x2d00 [ 223.712730][ T8401] ? __pfx_sctp_sendmsg+0x10/0x10 [ 223.712756][ T8401] ? aa_sk_perm+0x6d5/0x900 [ 223.712790][ T8401] ? sock_rps_record_flow+0x19/0x350 [ 223.712813][ T8401] ? inet_sendmsg+0x298/0x320 [ 223.712835][ T8401] ? __pfx_inet_sendmsg+0x10/0x10 [ 223.712853][ T8401] sock_sendmsg_nosec+0x10e/0x180 [ 223.712877][ T8401] ____sys_sendmsg+0x54e/0x850 [ 223.712901][ T8401] ? __pfx_____sys_sendmsg+0x10/0x10 [ 223.712929][ T8401] ? import_iovec+0x73/0xa0 [ 223.712954][ T8401] ___sys_sendmsg+0x2a5/0x360 [ 223.712972][ T8401] ? __lock_acquire+0x683/0x2cf0 [ 223.712996][ T8401] ? __pfx____sys_sendmsg+0x10/0x10 [ 223.713048][ T8401] ? __fget_files+0x2a/0x420 [ 223.713067][ T8401] ? __fget_files+0x3a2/0x420 [ 223.713095][ T8401] __x64_sys_sendmsg+0x1b1/0x290 [ 223.713117][ T8401] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 223.713158][ T8401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.713176][ T8401] do_syscall_64+0x174/0x580 [ 223.713196][ T8401] ? trace_irq_disable+0x3b/0x140 [ 223.713215][ T8401] ? clear_bhb_loop+0x70/0xc0 [ 223.713234][ T8401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 223.713256][ T8401] RIP: 0033:0x7fd93d79e0d9 [ 223.713271][ T8401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 223.713283][ T8401] RSP: 002b:00007fd93e6d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 223.713301][ T8401] RAX: ffffffffffffffda RBX: 00007fd93da25fa0 RCX: 00007fd93d79e0d9 [ 223.713312][ T8401] RDX: 0000000024000052 RSI: 00002000000000c0 RDI: 0000000000000005 [ 223.713322][ T8401] RBP: 00007fd93e6d4090 R08: 0000000000000000 R09: 0000000000000000 [ 223.713331][ T8401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 223.713340][ T8401] R13: 00007fd93da26038 R14: 00007fd93da25fa0 R15: 00007ffde1e79a68 [ 223.713367][ T8401] [ 224.312065][ T8416] netlink: 'syz.3.804': attribute type 10 has an invalid length. [ 224.411203][ T8416] 8021q: adding VLAN 0 to HW filter on device team0 [ 224.460009][ T8416] bond0: (slave team0): Enslaving as an active interface with an up link [ 224.774863][ T8443] FAULT_INJECTION: forcing a failure. [ 224.774863][ T8443] name failslab, interval 1, probability 0, space 0, times 0 [ 224.787769][ T8443] CPU: 1 UID: 0 PID: 8443 Comm: syz.3.817 Not tainted syzkaller #0 PREEMPT(full) [ 224.787789][ T8443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 224.787797][ T8443] Call Trace: [ 224.787804][ T8443] [ 224.787809][ T8443] dump_stack_lvl+0xe8/0x150 [ 224.787833][ T8443] should_fail_ex+0x40c/0x560 [ 224.787855][ T8443] should_failslab+0xa8/0x100 [ 224.787876][ T8443] __kmalloc_cache_noprof+0xa8/0x660 [ 224.787896][ T8443] ? rtnl_newlink+0x143/0x1c30 [ 224.787911][ T8443] ? rtnl_newlink+0x143/0x1c30 [ 224.787931][ T8443] rtnl_newlink+0x143/0x1c30 [ 224.787948][ T8443] ? kasan_save_track+0x4f/0x80 [ 224.787965][ T8443] ? kasan_save_track+0x3e/0x80 [ 224.787981][ T8443] ? __kasan_slab_free+0x5c/0x80 [ 224.787997][ T8443] ? kmem_cache_free+0x182/0x650 [ 224.788014][ T8443] ? nlmon_xmit+0xb0/0x100 [ 224.788028][ T8443] ? dev_hard_start_xmit+0x2cd/0x830 [ 224.788046][ T8443] ? __dev_queue_xmit+0x14c0/0x3820 [ 224.788064][ T8443] ? __netlink_deliver_tap+0x5b4/0x860 [ 224.788081][ T8443] ? netlink_deliver_tap+0x19c/0x1b0 [ 224.788099][ T8443] ? netlink_unicast+0x77f/0x940 [ 224.788114][ T8443] ? netlink_sendmsg+0x813/0xb40 [ 224.788133][ T8443] ? __pfx_rtnl_newlink+0x10/0x10 [ 224.788147][ T8443] ? do_syscall_64+0x174/0x580 [ 224.788167][ T8443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.788213][ T8443] ? kasan_quarantine_put+0xbb/0x1f0 [ 224.788231][ T8443] ? lockdep_hardirqs_on+0x7a/0x110 [ 224.788255][ T8443] ? nlmon_xmit+0xb0/0x100 [ 224.788268][ T8443] ? kmem_cache_free+0x182/0x650 [ 224.788295][ T8443] ? __lock_acquire+0x683/0x2cf0 [ 224.788319][ T8443] ? __dev_queue_xmit+0x29b/0x3820 [ 224.788341][ T8443] ? __local_bh_enable_ip+0xd0/0x130 [ 224.788358][ T8443] ? lockdep_hardirqs_on+0x7a/0x110 [ 224.788377][ T8443] ? __dev_queue_xmit+0x29b/0x3820 [ 224.788394][ T8443] ? __local_bh_enable_ip+0xd0/0x130 [ 224.788409][ T8443] ? __dev_queue_xmit+0x29b/0x3820 [ 224.788434][ T8443] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 224.788453][ T8443] ? __pfx_rtnl_newlink+0x10/0x10 [ 224.788481][ T8443] ? __pfx_rtnl_newlink+0x10/0x10 [ 224.788497][ T8443] rtnetlink_rcv_msg+0x802/0xc00 [ 224.788518][ T8443] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 224.788535][ T8443] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 224.788550][ T8443] ? ref_tracker_free+0x689/0x830 [ 224.788571][ T8443] ? __pfx_ref_tracker_free+0x10/0x10 [ 224.788599][ T8443] netlink_rcv_skb+0x226/0x4a0 [ 224.788620][ T8443] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 224.788637][ T8443] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 224.788675][ T8443] ? netlink_deliver_tap+0x2e/0x1b0 [ 224.788694][ T8443] ? netlink_deliver_tap+0x2e/0x1b0 [ 224.788718][ T8443] netlink_unicast+0x7bb/0x940 [ 224.788746][ T8443] netlink_sendmsg+0x813/0xb40 [ 224.788774][ T8443] ? __pfx_netlink_sendmsg+0x10/0x10 [ 224.788798][ T8443] ? aa_sock_msg_perm+0xf1/0x1b0 [ 224.788819][ T8443] ? __pfx_netlink_sendmsg+0x10/0x10 [ 224.788837][ T8443] sock_sendmsg_nosec+0x13a/0x180 [ 224.788863][ T8443] ____sys_sendmsg+0x54e/0x850 [ 224.788887][ T8443] ? __pfx_____sys_sendmsg+0x10/0x10 [ 224.788913][ T8443] ? import_iovec+0x73/0xa0 [ 224.788936][ T8443] ___sys_sendmsg+0x2a5/0x360 [ 224.788953][ T8443] ? __lock_acquire+0x683/0x2cf0 [ 224.788975][ T8443] ? __pfx____sys_sendmsg+0x10/0x10 [ 224.789021][ T8443] ? __fget_files+0x2a/0x420 [ 224.789039][ T8443] ? __fget_files+0x3a2/0x420 [ 224.789067][ T8443] __x64_sys_sendmsg+0x1b1/0x290 [ 224.789088][ T8443] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 224.789123][ T8443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.789140][ T8443] do_syscall_64+0x174/0x580 [ 224.789159][ T8443] ? trace_irq_disable+0x3b/0x140 [ 224.789177][ T8443] ? clear_bhb_loop+0x70/0xc0 [ 224.789195][ T8443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 224.789210][ T8443] RIP: 0033:0x7fa37ff9e0d9 [ 224.789225][ T8443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 224.789238][ T8443] RSP: 002b:00007fa380ef0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 224.789254][ T8443] RAX: ffffffffffffffda RBX: 00007fa380225fa0 RCX: 00007fa37ff9e0d9 [ 224.789264][ T8443] RDX: 0000000004004090 RSI: 0000200000000280 RDI: 0000000000000003 [ 224.789274][ T8443] RBP: 00007fa380ef0090 R08: 0000000000000000 R09: 0000000000000000 [ 224.789283][ T8443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 224.789292][ T8443] R13: 00007fa380226038 R14: 00007fa380225fa0 R15: 00007ffec6026958 [ 224.789317][ T8443] [ 225.528244][ T8460] FAULT_INJECTION: forcing a failure. [ 225.528244][ T8460] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 225.578949][ T8460] CPU: 1 UID: 0 PID: 8460 Comm: syz.2.823 Not tainted syzkaller #0 PREEMPT(full) [ 225.578971][ T8460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 225.578980][ T8460] Call Trace: [ 225.578986][ T8460] [ 225.578993][ T8460] dump_stack_lvl+0xe8/0x150 [ 225.579019][ T8460] should_fail_ex+0x40c/0x560 [ 225.579065][ T8460] _copy_from_user+0x2d/0xb0 [ 225.579088][ T8460] __sys_bpf+0x2e7/0xd90 [ 225.579114][ T8460] ? __pfx___sys_bpf+0x10/0x10 [ 225.579141][ T8460] ? __fget_files+0x2a/0x420 [ 225.579174][ T8460] ? ksys_write+0x242/0x270 [ 225.579197][ T8460] ? __pfx_ksys_write+0x10/0x10 [ 225.579223][ T8460] __x64_sys_bpf+0xba/0xd0 [ 225.579240][ T8460] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.579255][ T8460] do_syscall_64+0x174/0x580 [ 225.579275][ T8460] ? trace_irq_disable+0x3b/0x140 [ 225.579293][ T8460] ? clear_bhb_loop+0x70/0xc0 [ 225.579311][ T8460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 225.579326][ T8460] RIP: 0033:0x7ff56239e0d9 [ 225.579341][ T8460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 225.579352][ T8460] RSP: 002b:00007ff56326e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 225.579368][ T8460] RAX: ffffffffffffffda RBX: 00007ff562625fa0 RCX: 00007ff56239e0d9 [ 225.579379][ T8460] RDX: 0000000000000050 RSI: 0000200000000100 RDI: 000000000000000a [ 225.579389][ T8460] RBP: 00007ff56326e090 R08: 0000000000000000 R09: 0000000000000000 [ 225.579397][ T8460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 225.579405][ T8460] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 225.579430][ T8460] [ 225.754548][ C1] net_ratelimit: 194 callbacks suppressed [ 225.754562][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 225.828266][ T5605] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 225.926706][ T8480] __nla_validate_parse: 8 callbacks suppressed [ 225.926721][ T8480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.830'. [ 226.122367][ T8488] Bluetooth: hci0: invalid length 0, exp 2 for type 18 [ 226.173393][ T8489] tipc: Enabling of bearer rejected, already enabled [ 226.303449][ T8496] vlan0: entered allmulticast mode [ 226.310727][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 226.342388][ T8496] bond0: entered allmulticast mode [ 226.366197][ T8496] bond_slave_0: entered allmulticast mode [ 226.372408][ T8496] bond_slave_1: entered allmulticast mode [ 226.514413][ T8511] FAULT_INJECTION: forcing a failure. [ 226.514413][ T8511] name failslab, interval 1, probability 0, space 0, times 0 [ 226.529829][ T8509] ip6gre1: entered promiscuous mode [ 226.541593][ T8509] ip6gre1: entered allmulticast mode [ 226.576674][ T8511] CPU: 0 UID: 0 PID: 8511 Comm: syz.4.840 Not tainted syzkaller #0 PREEMPT(full) [ 226.576696][ T8511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 226.576704][ T8511] Call Trace: [ 226.576710][ T8511] [ 226.576717][ T8511] dump_stack_lvl+0xe8/0x150 [ 226.576744][ T8511] should_fail_ex+0x40c/0x560 [ 226.576768][ T8511] should_failslab+0xa8/0x100 [ 226.576791][ T8511] __kmalloc_cache_noprof+0xa8/0x660 [ 226.576810][ T8511] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 226.576830][ T8511] ? __kmalloc_cache_noprof+0x150/0x660 [ 226.576848][ T8511] ? sctp_add_bind_addr+0x8c/0x370 [ 226.576865][ T8511] ? sctp_add_bind_addr+0x8c/0x370 [ 226.576890][ T8511] sctp_add_bind_addr+0x8c/0x370 [ 226.576914][ T8511] sctp_copy_local_addr_list+0x31a/0x4e0 [ 226.576936][ T8511] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 226.576956][ T8511] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 226.576977][ T8511] ? sctp_v6_is_any+0x64/0x80 [ 226.576998][ T8511] ? sctp_copy_one_addr+0x93/0x360 [ 226.577021][ T8511] sctp_bind_addr_copy+0xb3/0x3c0 [ 226.577041][ T8511] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 226.577078][ T8511] sctp_connect_new_asoc+0x2ff/0x6b0 [ 226.577103][ T8511] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 226.577132][ T8511] ? __local_bh_enable_ip+0xd0/0x130 [ 226.577148][ T8511] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 226.577165][ T8511] ? security_sctp_bind_connect+0x7e/0x2c0 [ 226.577188][ T8511] sctp_sendmsg+0x159b/0x2d00 [ 226.577222][ T8511] ? __pfx_sctp_sendmsg+0x10/0x10 [ 226.577250][ T8511] ? aa_sk_perm+0x6d5/0x900 [ 226.577278][ T8511] ? __might_fault+0xaf/0x130 [ 226.577300][ T8511] ? sock_rps_record_flow+0x19/0x350 [ 226.577324][ T8511] ? inet_sendmsg+0x298/0x320 [ 226.577347][ T8511] ? __pfx_inet_sendmsg+0x10/0x10 [ 226.577365][ T8511] sock_sendmsg_nosec+0x10e/0x180 [ 226.577392][ T8511] __sys_sendto+0x408/0x5a0 [ 226.577410][ T8511] ? ksys_write+0x1e6/0x270 [ 226.577435][ T8511] ? __pfx___sys_sendto+0x10/0x10 [ 226.577451][ T8511] ? __mutex_unlock_slowpath+0x731/0x900 [ 226.577500][ T8511] ? __pfx_ksys_write+0x10/0x10 [ 226.577526][ T8511] __x64_sys_sendto+0xde/0x100 [ 226.577545][ T8511] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.577561][ T8511] do_syscall_64+0x174/0x580 [ 226.577581][ T8511] ? trace_irq_disable+0x3b/0x140 [ 226.577600][ T8511] ? clear_bhb_loop+0x70/0xc0 [ 226.577618][ T8511] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 226.577632][ T8511] RIP: 0033:0x7fc76b59e0d9 [ 226.577648][ T8511] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 226.577660][ T8511] RSP: 002b:00007fc76c4b6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 226.577677][ T8511] RAX: ffffffffffffffda RBX: 00007fc76b825fa0 RCX: 00007fc76b59e0d9 [ 226.577687][ T8511] RDX: 0000000000034000 RSI: 0000200000847fff RDI: 0000000000000004 [ 226.577697][ T8511] RBP: 00007fc76c4b6090 R08: 000020000005ffe4 R09: 000000000000001c [ 226.577707][ T8511] R10: 00000000000000e0 R11: 0000000000000246 R12: 0000000000000002 [ 226.577716][ T8511] R13: 00007fc76b826038 R14: 00007fc76b825fa0 R15: 00007ffc7861c008 [ 226.577743][ T8511] [ 226.685260][ T8520] ipt_REJECT: TCP_RESET invalid for non-tcp [ 226.748904][ T139] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 226.918782][ T8529] Bluetooth: hci0: invalid length 0, exp 2 for type 13 [ 226.989350][ T187] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 227.030273][ T139] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 227.064484][ T187] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 227.322634][ T8544] validate_nla: 4 callbacks suppressed [ 227.322649][ T8544] netlink: 'syz.1.855': attribute type 2 has an invalid length. [ 227.373142][ T5745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.452591][ T8563] netlink: 'syz.0.858': attribute type 9 has an invalid length. [ 227.507041][ T5605] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 227.677533][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.702812][ T8562] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 227.745754][ T8566] syzkaller0: mtu less than device minimum [ 227.757131][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 227.784740][ T8573] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 227.802106][ T8550] tipc: Resetting bearer [ 227.954542][ T8580] netlink: 'syz.2.864': attribute type 13 has an invalid length. [ 228.110619][ T8584] lo speed is unknown, defaulting to 1000 [ 228.395894][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 228.423795][ T8594] netlink: 44 bytes leftover after parsing attributes in process `syz.4.870'. [ 228.661628][ T8597] netlink: 'syz.1.871': attribute type 21 has an invalid length. [ 228.684326][ T8597] netlink: 128 bytes leftover after parsing attributes in process `syz.1.871'. [ 228.706556][ T8597] netlink: 'syz.1.871': attribute type 5 has an invalid length. [ 228.722160][ T8597] netlink: 3 bytes leftover after parsing attributes in process `syz.1.871'. [ 228.741204][ T8599] netlink: 4 bytes leftover after parsing attributes in process `syz.1.871'. [ 228.769272][ T8587] siw: device registration error -23 [ 228.790215][ T8597] netlink: 12 bytes leftover after parsing attributes in process `syz.1.871'. [ 228.811155][ T8601] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 228.995926][ T8609] netlink: 'syz.2.874': attribute type 4 has an invalid length. [ 229.000586][ T8611] netlink: 'syz.0.875': attribute type 1 has an invalid length. [ 229.056279][ T8616] netlink: 'syz.2.874': attribute type 4 has an invalid length. [ 229.132932][ T8611] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 229.151435][ T8611] bond3 (unregistering): Released all slaves [ 229.409259][ T5605] lo speed is unknown, defaulting to 1000 [ 229.426580][ T8622] tipc: Enabling of bearer rejected, failed to enable media [ 229.445746][ T8637] netlink: 8 bytes leftover after parsing attributes in process `syz.4.882'. [ 229.474060][ T8627] bridge2: entered promiscuous mode [ 229.509405][ T8627] bond2: (slave bridge2): making interface the new active one [ 229.519920][ T8627] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 229.532283][ T8633] veth1_to_team: Caught tx_queue_len zero misconfig [ 229.551391][ T5605] lo speed is unknown, defaulting to 1000 [ 229.581647][ T5745] lo speed is unknown, defaulting to 1000 [ 229.749462][ T8648] netlink: 'syz.1.884': attribute type 5 has an invalid length. [ 229.965732][ T8654] netlink: 8 bytes leftover after parsing attributes in process `syz.3.891'. [ 230.117291][ T8664] netlink: 52 bytes leftover after parsing attributes in process `syz.2.892'. [ 230.352092][ T8673] BUG: Bad page state in process syz.2.895 pfn:748b1 [ 230.358994][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880748b1000 pfn:0x748b1 [ 230.369152][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 230.376318][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 230.384960][ T8673] raw: ffff8880748b1000 0000000000000001 00000000ffffffff 0000000000000000 [ 230.393581][ T8673] page dumped because: page_pool leak [ 230.399024][ T8673] page_owner tracks the page as allocated [ 230.405976][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351983178, free_ts 230107214630 [ 230.422989][ T8673] post_alloc_hook+0x1f9/0x250 [ 230.427791][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 230.433350][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 230.439238][ T8673] __alloc_pages_noprof+0x10/0x100 [ 230.444360][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 230.449873][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 230.455944][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 230.456016][ T8674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.896'. [ 230.460838][ T8673] do_xdp_generic+0x770/0x12d0 [ 230.460869][ T8673] tun_get_user+0x24f8/0x4370 [ 230.460893][ T8673] tun_chr_write_iter+0x113/0x200 [ 230.484151][ T8673] vfs_write+0x612/0xba0 [ 230.488447][ T8673] ksys_write+0x150/0x270 [ 230.492790][ T8673] do_syscall_64+0x174/0x580 [ 230.497428][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.503328][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 230.509701][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 230.514819][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 230.519993][ T8673] rcu_core+0x78b/0x10a0 [ 230.524242][ T8673] handle_softirqs+0x225/0x840 [ 230.529061][ T8673] __irq_exit_rcu+0xca/0x220 [ 230.533651][ T8673] irq_exit_rcu+0x9/0x30 [ 230.537937][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 230.543574][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 230.549606][ T8673] Modules linked in: [ 230.553523][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Not tainted syzkaller #0 PREEMPT(full) [ 230.553543][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 230.553552][ T8673] Call Trace: [ 230.553559][ T8673] [ 230.553567][ T8673] dump_stack_lvl+0xe8/0x150 [ 230.553592][ T8673] bad_page+0x17f/0x1c0 [ 230.553616][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 230.553645][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 230.553688][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 230.553715][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 230.553733][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 230.553782][ T8673] do_xdp_generic+0xac2/0x12d0 [ 230.553805][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 230.553828][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 230.553857][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 230.553893][ T8673] ? tun_get_user+0x23cb/0x4370 [ 230.553931][ T8673] ? tun_get_user+0x23cb/0x4370 [ 230.553954][ T8673] tun_get_user+0x24f8/0x4370 [ 230.553992][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 230.554015][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 230.554031][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 230.554057][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 230.554081][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 230.554101][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 230.554127][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 230.554150][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 230.554172][ T8673] ? tun_get+0x1c/0x2f0 [ 230.554196][ T8673] ? tun_get+0x1c/0x2f0 [ 230.554224][ T8673] ? tun_get+0x1c/0x2f0 [ 230.554247][ T8673] ? tun_get+0x1c/0x2f0 [ 230.554274][ T8673] tun_chr_write_iter+0x113/0x200 [ 230.554300][ T8673] vfs_write+0x612/0xba0 [ 230.554332][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 230.554364][ T8673] ? __fget_files+0x2a/0x420 [ 230.554393][ T8673] ksys_write+0x150/0x270 [ 230.554418][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 230.554448][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.554467][ T8673] do_syscall_64+0x174/0x580 [ 230.554489][ T8673] ? trace_irq_disable+0x3b/0x140 [ 230.554509][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 230.554529][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.554545][ T8673] RIP: 0033:0x7ff56235e90e [ 230.554560][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 230.554575][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 230.554593][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 230.554606][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 230.554623][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 230.554634][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 230.554644][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 230.554673][ T8673] [ 230.554680][ T8673] Disabling lock debugging due to kernel taint [ 230.663622][ T8685] netlink: 'syz.0.899': attribute type 4 has an invalid length. [ 230.664542][ T8673] BUG: Bad page state in process syz.2.895 pfn:35a87 [ 230.664557][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035a878c0 pfn:0x35a87 [ 230.866893][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 230.874008][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 230.876741][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 230.882606][ T8673] raw: ffff888035a878c0 0000000000000001 00000000ffffffff 0000000000000000 [ 230.898640][ T8673] page dumped because: page_pool leak [ 230.903986][ T8673] page_owner tracks the page as allocated [ 230.909706][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351966510, free_ts 230107245994 [ 230.926657][ T8673] post_alloc_hook+0x1f9/0x250 [ 230.931425][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 230.936981][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 230.942784][ T8673] __alloc_pages_noprof+0x10/0x100 [ 230.947903][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 230.953358][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 230.959432][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 230.964279][ T8673] do_xdp_generic+0x770/0x12d0 [ 230.969055][ T8673] tun_get_user+0x24f8/0x4370 [ 230.973734][ T8673] tun_chr_write_iter+0x113/0x200 [ 230.978767][ T8673] vfs_write+0x612/0xba0 [ 230.983008][ T8673] ksys_write+0x150/0x270 [ 230.987355][ T8673] do_syscall_64+0x174/0x580 [ 230.991948][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 230.997852][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 231.004164][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 231.009281][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 231.014389][ T8673] rcu_core+0x78b/0x10a0 [ 231.018642][ T8673] handle_softirqs+0x225/0x840 [ 231.023402][ T8673] __irq_exit_rcu+0xca/0x220 [ 231.028003][ T8673] irq_exit_rcu+0x9/0x30 [ 231.032238][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 231.037882][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 231.043859][ T8673] Modules linked in: [ 231.047775][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 231.047797][ T8673] Tainted: [B]=BAD_PAGE [ 231.047803][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 231.047812][ T8673] Call Trace: [ 231.047818][ T8673] [ 231.047823][ T8673] dump_stack_lvl+0xe8/0x150 [ 231.047846][ T8673] bad_page+0x17f/0x1c0 [ 231.047861][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 231.047882][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 231.047914][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 231.047936][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 231.047952][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 231.047984][ T8673] do_xdp_generic+0xac2/0x12d0 [ 231.048005][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 231.048024][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 231.048048][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 231.048072][ T8673] ? tun_get_user+0x23cb/0x4370 [ 231.048100][ T8673] ? tun_get_user+0x23cb/0x4370 [ 231.048121][ T8673] tun_get_user+0x24f8/0x4370 [ 231.048147][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 231.048165][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 231.048180][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 231.048202][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 231.048222][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 231.048239][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 231.048260][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 231.048280][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 231.048298][ T8673] ? tun_get+0x1c/0x2f0 [ 231.048319][ T8673] ? tun_get+0x1c/0x2f0 [ 231.048342][ T8673] ? tun_get+0x1c/0x2f0 [ 231.048362][ T8673] ? tun_get+0x1c/0x2f0 [ 231.048385][ T8673] tun_chr_write_iter+0x113/0x200 [ 231.048407][ T8673] vfs_write+0x612/0xba0 [ 231.048432][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 231.048456][ T8673] ? __fget_files+0x2a/0x420 [ 231.048479][ T8673] ksys_write+0x150/0x270 [ 231.048501][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 231.048525][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.048541][ T8673] do_syscall_64+0x174/0x580 [ 231.048570][ T8673] ? trace_irq_disable+0x3b/0x140 [ 231.048589][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 231.048606][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.048621][ T8673] RIP: 0033:0x7ff56235e90e [ 231.048635][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 231.048649][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 231.048665][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 231.048677][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 231.048687][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 231.048697][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.048707][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 231.048725][ T8673] [ 231.048733][ T8673] BUG: Bad page state in process syz.2.895 pfn:77400 [ 231.342364][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888077400300 pfn:0x77400 [ 231.352438][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 231.359562][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 231.368159][ T8673] raw: ffff888077400300 0000000000000001 00000000ffffffff 0000000000000000 [ 231.376763][ T8673] page dumped because: page_pool leak [ 231.382116][ T8673] page_owner tracks the page as allocated [ 231.387840][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351949637, free_ts 230107277635 [ 231.404783][ T8673] post_alloc_hook+0x1f9/0x250 [ 231.409562][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 231.415108][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 231.420940][ T8673] __alloc_pages_noprof+0x10/0x100 [ 231.426048][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 231.431516][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 231.437602][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 231.442439][ T8673] do_xdp_generic+0x770/0x12d0 [ 231.447214][ T8673] tun_get_user+0x24f8/0x4370 [ 231.451895][ T8673] tun_chr_write_iter+0x113/0x200 [ 231.456936][ T8673] vfs_write+0x612/0xba0 [ 231.461181][ T8673] ksys_write+0x150/0x270 [ 231.465493][ T8673] do_syscall_64+0x174/0x580 [ 231.470092][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.475980][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 231.482318][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 231.487446][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 231.492538][ T8673] rcu_core+0x78b/0x10a0 [ 231.496799][ T8673] handle_softirqs+0x225/0x840 [ 231.501561][ T8673] __irq_exit_rcu+0xca/0x220 [ 231.506129][ T8673] irq_exit_rcu+0x9/0x30 [ 231.510379][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 231.516012][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 231.522001][ T8673] Modules linked in: [ 231.525894][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 231.525908][ T8673] Tainted: [B]=BAD_PAGE [ 231.525911][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 231.525917][ T8673] Call Trace: [ 231.525921][ T8673] [ 231.525925][ T8673] dump_stack_lvl+0xe8/0x150 [ 231.525940][ T8673] bad_page+0x17f/0x1c0 [ 231.525949][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 231.525961][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 231.525979][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 231.525992][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 231.526000][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 231.526019][ T8673] do_xdp_generic+0xac2/0x12d0 [ 231.526031][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 231.526042][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 231.526056][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 231.526070][ T8673] ? tun_get_user+0x23cb/0x4370 [ 231.526087][ T8673] ? tun_get_user+0x23cb/0x4370 [ 231.526099][ T8673] tun_get_user+0x24f8/0x4370 [ 231.526115][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 231.526125][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 231.526134][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 231.526147][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 231.526159][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 231.526169][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 231.526183][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 231.526195][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 231.526206][ T8673] ? tun_get+0x1c/0x2f0 [ 231.526218][ T8673] ? tun_get+0x1c/0x2f0 [ 231.526232][ T8673] ? tun_get+0x1c/0x2f0 [ 231.526244][ T8673] ? tun_get+0x1c/0x2f0 [ 231.526256][ T8673] tun_chr_write_iter+0x113/0x200 [ 231.526270][ T8673] vfs_write+0x612/0xba0 [ 231.526284][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 231.526298][ T8673] ? __fget_files+0x2a/0x420 [ 231.526311][ T8673] ksys_write+0x150/0x270 [ 231.526323][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 231.526337][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.526347][ T8673] do_syscall_64+0x174/0x580 [ 231.526360][ T8673] ? trace_irq_disable+0x3b/0x140 [ 231.526371][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 231.526380][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.526389][ T8673] RIP: 0033:0x7ff56235e90e [ 231.526398][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 231.526406][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 231.526416][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 231.526423][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 231.526429][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 231.526435][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 231.526441][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 231.526450][ T8673] [ 231.526457][ T8673] BUG: Bad page state in process syz.2.895 pfn:7fa05 [ 231.819970][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807fa05000 pfn:0x7fa05 [ 231.830059][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 231.837182][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 231.845742][ T8673] raw: ffff88807fa05000 0000000000000001 00000000ffffffff 0000000000000000 [ 231.854330][ T8673] page dumped because: page_pool leak [ 231.859708][ T8673] page_owner tracks the page as allocated [ 231.865400][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351934113, free_ts 230107308716 [ 231.882378][ T8673] post_alloc_hook+0x1f9/0x250 [ 231.887160][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 231.892696][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 231.898525][ T8673] __alloc_pages_noprof+0x10/0x100 [ 231.903639][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 231.909119][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 231.915183][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 231.920052][ T8673] do_xdp_generic+0x770/0x12d0 [ 231.924818][ T8673] tun_get_user+0x24f8/0x4370 [ 231.929512][ T8673] tun_chr_write_iter+0x113/0x200 [ 231.934537][ T8673] vfs_write+0x612/0xba0 [ 231.938796][ T8673] ksys_write+0x150/0x270 [ 231.943148][ T8673] do_syscall_64+0x174/0x580 [ 231.947760][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 231.953647][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 231.959986][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 231.965096][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 231.970224][ T8673] rcu_core+0x78b/0x10a0 [ 231.974466][ T8673] handle_softirqs+0x225/0x840 [ 231.979254][ T8673] __irq_exit_rcu+0xca/0x220 [ 231.983839][ T8673] irq_exit_rcu+0x9/0x30 [ 231.988096][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 231.993737][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 231.999739][ T8673] Modules linked in: [ 232.003632][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 232.003646][ T8673] Tainted: [B]=BAD_PAGE [ 232.003650][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.003656][ T8673] Call Trace: [ 232.003660][ T8673] [ 232.003663][ T8673] dump_stack_lvl+0xe8/0x150 [ 232.003678][ T8673] bad_page+0x17f/0x1c0 [ 232.003688][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 232.003700][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 232.003718][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 232.003731][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 232.003740][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 232.003762][ T8673] do_xdp_generic+0xac2/0x12d0 [ 232.003783][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.003803][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 232.003824][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 232.003849][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.003871][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.003883][ T8673] tun_get_user+0x24f8/0x4370 [ 232.003899][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 232.003909][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 232.003918][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 232.003930][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.003942][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 232.003952][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 232.003965][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 232.003977][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 232.003994][ T8673] ? tun_get+0x1c/0x2f0 [ 232.004006][ T8673] ? tun_get+0x1c/0x2f0 [ 232.004019][ T8673] ? tun_get+0x1c/0x2f0 [ 232.004031][ T8673] ? tun_get+0x1c/0x2f0 [ 232.004044][ T8673] tun_chr_write_iter+0x113/0x200 [ 232.004058][ T8673] vfs_write+0x612/0xba0 [ 232.004073][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 232.004087][ T8673] ? __fget_files+0x2a/0x420 [ 232.004100][ T8673] ksys_write+0x150/0x270 [ 232.004113][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 232.004126][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.004136][ T8673] do_syscall_64+0x174/0x580 [ 232.004148][ T8673] ? trace_irq_disable+0x3b/0x140 [ 232.004159][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 232.004169][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.004178][ T8673] RIP: 0033:0x7ff56235e90e [ 232.004187][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 232.004195][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 232.004205][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 232.004212][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 232.004218][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 232.004224][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.004230][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 232.004240][ T8673] [ 232.004246][ T8673] BUG: Bad page state in process syz.2.895 pfn:26087 [ 232.297992][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x26087 [ 232.308062][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 232.315185][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 232.323777][ T8673] raw: ffff888000000000 0000000000000001 00000000ffffffff 0000000000000000 [ 232.332363][ T8673] page dumped because: page_pool leak [ 232.337732][ T8673] page_owner tracks the page as allocated [ 232.343435][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351918475, free_ts 230107339552 [ 232.360392][ T8673] post_alloc_hook+0x1f9/0x250 [ 232.365164][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 232.370717][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 232.376518][ T8673] __alloc_pages_noprof+0x10/0x100 [ 232.381638][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 232.387109][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 232.393155][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 232.398018][ T8673] do_xdp_generic+0x770/0x12d0 [ 232.402781][ T8673] tun_get_user+0x24f8/0x4370 [ 232.407484][ T8673] tun_chr_write_iter+0x113/0x200 [ 232.412505][ T8673] vfs_write+0x612/0xba0 [ 232.416764][ T8673] ksys_write+0x150/0x270 [ 232.421088][ T8673] do_syscall_64+0x174/0x580 [ 232.425657][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.431551][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 232.437878][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 232.442969][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 232.448086][ T8673] rcu_core+0x78b/0x10a0 [ 232.452323][ T8673] handle_softirqs+0x225/0x840 [ 232.457088][ T8673] __irq_exit_rcu+0xca/0x220 [ 232.461673][ T8673] irq_exit_rcu+0x9/0x30 [ 232.465895][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 232.471538][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 232.477528][ T8673] Modules linked in: [ 232.481404][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 232.481419][ T8673] Tainted: [B]=BAD_PAGE [ 232.481422][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.481428][ T8673] Call Trace: [ 232.481437][ T8673] [ 232.481441][ T8673] dump_stack_lvl+0xe8/0x150 [ 232.481455][ T8673] bad_page+0x17f/0x1c0 [ 232.481464][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 232.481477][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 232.481495][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 232.481507][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 232.481516][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 232.481534][ T8673] do_xdp_generic+0xac2/0x12d0 [ 232.481547][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.481559][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 232.481572][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 232.481586][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.481603][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.481615][ T8673] tun_get_user+0x24f8/0x4370 [ 232.481631][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 232.481641][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 232.481650][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 232.481663][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.481674][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 232.481684][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 232.481697][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 232.481709][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 232.481720][ T8673] ? tun_get+0x1c/0x2f0 [ 232.481733][ T8673] ? tun_get+0x1c/0x2f0 [ 232.481746][ T8673] ? tun_get+0x1c/0x2f0 [ 232.481758][ T8673] ? tun_get+0x1c/0x2f0 [ 232.481770][ T8673] tun_chr_write_iter+0x113/0x200 [ 232.481784][ T8673] vfs_write+0x612/0xba0 [ 232.481799][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 232.481813][ T8673] ? __fget_files+0x2a/0x420 [ 232.481826][ T8673] ksys_write+0x150/0x270 [ 232.481838][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 232.481852][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.481861][ T8673] do_syscall_64+0x174/0x580 [ 232.481874][ T8673] ? trace_irq_disable+0x3b/0x140 [ 232.481885][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 232.481894][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.481903][ T8673] RIP: 0033:0x7ff56235e90e [ 232.481913][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 232.481921][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 232.481931][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 232.481937][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 232.481943][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 232.481949][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.481954][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 232.481964][ T8673] [ 232.481970][ T8673] BUG: Bad page state in process syz.2.895 pfn:5626f [ 232.775415][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805626f000 pfn:0x5626f [ 232.785491][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 232.792611][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 232.801197][ T8673] raw: ffff88805626f000 0000000000000001 00000000ffffffff 0000000000000000 [ 232.809781][ T8673] page dumped because: page_pool leak [ 232.815127][ T8673] page_owner tracks the page as allocated [ 232.820859][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351902188, free_ts 230107370797 [ 232.837800][ T8673] post_alloc_hook+0x1f9/0x250 [ 232.842547][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 232.848103][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 232.853908][ T8673] __alloc_pages_noprof+0x10/0x100 [ 232.859028][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 232.864484][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 232.870554][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 232.875401][ T8673] do_xdp_generic+0x770/0x12d0 [ 232.880174][ T8673] tun_get_user+0x24f8/0x4370 [ 232.884866][ T8673] tun_chr_write_iter+0x113/0x200 [ 232.889900][ T8673] vfs_write+0x612/0xba0 [ 232.894142][ T8673] ksys_write+0x150/0x270 [ 232.898477][ T8673] do_syscall_64+0x174/0x580 [ 232.903064][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.908973][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 232.915304][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 232.920443][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 232.925550][ T8673] rcu_core+0x78b/0x10a0 [ 232.929800][ T8673] handle_softirqs+0x225/0x840 [ 232.934555][ T8673] __irq_exit_rcu+0xca/0x220 [ 232.939167][ T8673] irq_exit_rcu+0x9/0x30 [ 232.943408][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 232.949061][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 232.955032][ T8673] Modules linked in: [ 232.958940][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 232.958962][ T8673] Tainted: [B]=BAD_PAGE [ 232.958967][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 232.958976][ T8673] Call Trace: [ 232.958983][ T8673] [ 232.958989][ T8673] dump_stack_lvl+0xe8/0x150 [ 232.959011][ T8673] bad_page+0x17f/0x1c0 [ 232.959028][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 232.959050][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 232.959081][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 232.959102][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 232.959117][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 232.959149][ T8673] do_xdp_generic+0xac2/0x12d0 [ 232.959170][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.959191][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 232.959214][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 232.959240][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.959268][ T8673] ? tun_get_user+0x23cb/0x4370 [ 232.959290][ T8673] tun_get_user+0x24f8/0x4370 [ 232.959318][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 232.959337][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 232.959352][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 232.959374][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 232.959402][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 232.959419][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 232.959440][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 232.959460][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 232.959479][ T8673] ? tun_get+0x1c/0x2f0 [ 232.959500][ T8673] ? tun_get+0x1c/0x2f0 [ 232.959523][ T8673] ? tun_get+0x1c/0x2f0 [ 232.959544][ T8673] ? tun_get+0x1c/0x2f0 [ 232.959566][ T8673] tun_chr_write_iter+0x113/0x200 [ 232.959589][ T8673] vfs_write+0x612/0xba0 [ 232.959614][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 232.959639][ T8673] ? __fget_files+0x2a/0x420 [ 232.959661][ T8673] ksys_write+0x150/0x270 [ 232.959683][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 232.959707][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.959724][ T8673] do_syscall_64+0x174/0x580 [ 232.959746][ T8673] ? trace_irq_disable+0x3b/0x140 [ 232.959764][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 232.959780][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 232.959796][ T8673] RIP: 0033:0x7ff56235e90e [ 232.959810][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 232.959824][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 232.959841][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 232.959852][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 232.959864][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 232.959874][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 232.959884][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 232.959902][ T8673] [ 232.959911][ T8673] BUG: Bad page state in process syz.2.895 pfn:206da [ 233.253466][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880206dae70 pfn:0x206da [ 233.263539][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 233.270661][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 233.279251][ T8673] raw: ffff8880206dae70 0000000000000001 00000000ffffffff 0000000000000000 [ 233.287843][ T8673] page dumped because: page_pool leak [ 233.293197][ T8673] page_owner tracks the page as allocated [ 233.298914][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351886611, free_ts 230107402372 [ 233.315854][ T8673] post_alloc_hook+0x1f9/0x250 [ 233.320637][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 233.326183][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 233.332000][ T8673] __alloc_pages_noprof+0x10/0x100 [ 233.337125][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 233.342570][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 233.348646][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 233.353494][ T8673] do_xdp_generic+0x770/0x12d0 [ 233.358287][ T8673] tun_get_user+0x24f8/0x4370 [ 233.362978][ T8673] tun_chr_write_iter+0x113/0x200 [ 233.368022][ T8673] vfs_write+0x612/0xba0 [ 233.372269][ T8673] ksys_write+0x150/0x270 [ 233.376581][ T8673] do_syscall_64+0x174/0x580 [ 233.381186][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.387087][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 233.393387][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 233.398512][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 233.403621][ T8673] rcu_core+0x78b/0x10a0 [ 233.407885][ T8673] handle_softirqs+0x225/0x840 [ 233.412642][ T8673] __irq_exit_rcu+0xca/0x220 [ 233.417240][ T8673] irq_exit_rcu+0x9/0x30 [ 233.421474][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 233.427117][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 233.433097][ T8673] Modules linked in: [ 233.437019][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 233.437042][ T8673] Tainted: [B]=BAD_PAGE [ 233.437047][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 233.437056][ T8673] Call Trace: [ 233.437063][ T8673] [ 233.437068][ T8673] dump_stack_lvl+0xe8/0x150 [ 233.437091][ T8673] bad_page+0x17f/0x1c0 [ 233.437106][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 233.437128][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 233.437160][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 233.437182][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 233.437197][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 233.437229][ T8673] do_xdp_generic+0xac2/0x12d0 [ 233.437249][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 233.437268][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 233.437292][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 233.437316][ T8673] ? tun_get_user+0x23cb/0x4370 [ 233.437353][ T8673] ? tun_get_user+0x23cb/0x4370 [ 233.437374][ T8673] tun_get_user+0x24f8/0x4370 [ 233.437401][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 233.437419][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 233.437434][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 233.437456][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 233.437477][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 233.437494][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 233.437515][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 233.437535][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 233.437555][ T8673] ? tun_get+0x1c/0x2f0 [ 233.437575][ T8673] ? tun_get+0x1c/0x2f0 [ 233.437598][ T8673] ? tun_get+0x1c/0x2f0 [ 233.437618][ T8673] ? tun_get+0x1c/0x2f0 [ 233.437640][ T8673] tun_chr_write_iter+0x113/0x200 [ 233.437663][ T8673] vfs_write+0x612/0xba0 [ 233.437688][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 233.437713][ T8673] ? __fget_files+0x2a/0x420 [ 233.437736][ T8673] ksys_write+0x150/0x270 [ 233.437758][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 233.437780][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.437797][ T8673] do_syscall_64+0x174/0x580 [ 233.437818][ T8673] ? trace_irq_disable+0x3b/0x140 [ 233.437838][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 233.437855][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.437872][ T8673] RIP: 0033:0x7ff56235e90e [ 233.437887][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 233.437901][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 233.437919][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 233.437932][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 233.437942][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 233.437952][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 233.437962][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 233.437980][ T8673] [ 233.437989][ T8673] BUG: Bad page state in process syz.2.895 pfn:66a4e [ 233.731474][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888066a4e300 pfn:0x66a4e [ 233.741545][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 233.748670][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 233.757260][ T8673] raw: ffff888066a4e300 0000000000000001 00000000ffffffff 0000000000000000 [ 233.765827][ T8673] page dumped because: page_pool leak [ 233.771198][ T8673] page_owner tracks the page as allocated [ 233.776917][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351870840, free_ts 230107430274 [ 233.793865][ T8673] post_alloc_hook+0x1f9/0x250 [ 233.798641][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 233.804171][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 233.809986][ T8673] __alloc_pages_noprof+0x10/0x100 [ 233.815091][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 233.820554][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 233.826633][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 233.831474][ T8673] do_xdp_generic+0x770/0x12d0 [ 233.836213][ T8673] tun_get_user+0x24f8/0x4370 [ 233.840894][ T8673] tun_chr_write_iter+0x113/0x200 [ 233.845915][ T8673] vfs_write+0x612/0xba0 [ 233.850166][ T8673] ksys_write+0x150/0x270 [ 233.854491][ T8673] do_syscall_64+0x174/0x580 [ 233.859088][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.864976][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 233.871298][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 233.876408][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 233.881523][ T8673] rcu_core+0x78b/0x10a0 [ 233.885761][ T8673] handle_softirqs+0x225/0x840 [ 233.890526][ T8673] __irq_exit_rcu+0xca/0x220 [ 233.895109][ T8673] irq_exit_rcu+0x9/0x30 [ 233.899355][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 233.904983][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 233.910968][ T8673] Modules linked in: [ 233.914859][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 233.914873][ T8673] Tainted: [B]=BAD_PAGE [ 233.914877][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 233.914882][ T8673] Call Trace: [ 233.914886][ T8673] [ 233.914890][ T8673] dump_stack_lvl+0xe8/0x150 [ 233.914904][ T8673] bad_page+0x17f/0x1c0 [ 233.914914][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 233.914926][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 233.914944][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 233.914957][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 233.914966][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 233.914985][ T8673] do_xdp_generic+0xac2/0x12d0 [ 233.914997][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 233.915009][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 233.915022][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 233.915037][ T8673] ? tun_get_user+0x23cb/0x4370 [ 233.915053][ T8673] ? tun_get_user+0x23cb/0x4370 [ 233.915066][ T8673] tun_get_user+0x24f8/0x4370 [ 233.915081][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 233.915092][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 233.915100][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 233.915113][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 233.915125][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 233.915135][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 233.915148][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 233.915161][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 233.915171][ T8673] ? tun_get+0x1c/0x2f0 [ 233.915184][ T8673] ? tun_get+0x1c/0x2f0 [ 233.915197][ T8673] ? tun_get+0x1c/0x2f0 [ 233.915209][ T8673] ? tun_get+0x1c/0x2f0 [ 233.915222][ T8673] tun_chr_write_iter+0x113/0x200 [ 233.915235][ T8673] vfs_write+0x612/0xba0 [ 233.915250][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 233.915264][ T8673] ? __fget_files+0x2a/0x420 [ 233.915276][ T8673] ksys_write+0x150/0x270 [ 233.915289][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 233.915307][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.915317][ T8673] do_syscall_64+0x174/0x580 [ 233.915330][ T8673] ? trace_irq_disable+0x3b/0x140 [ 233.915341][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 233.915351][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 233.915359][ T8673] RIP: 0033:0x7ff56235e90e [ 233.915368][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 233.915376][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 233.915387][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 233.915393][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 233.915399][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 233.915405][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 233.915410][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 233.915420][ T8673] [ 233.915427][ T8673] BUG: Bad page state in process syz.2.895 pfn:35087 [ 234.208694][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888035087700 pfn:0x35087 [ 234.218760][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 234.225867][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 234.234454][ T8673] raw: ffff888035087700 0000000000000001 00000000ffffffff 0000000000000000 [ 234.243041][ T8673] page dumped because: page_pool leak [ 234.248411][ T8673] page_owner tracks the page as allocated [ 234.254110][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351854095, free_ts 230107461585 [ 234.271040][ T8673] post_alloc_hook+0x1f9/0x250 [ 234.275804][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 234.281357][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 234.287172][ T8673] __alloc_pages_noprof+0x10/0x100 [ 234.292261][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 234.297731][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 234.303790][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 234.308645][ T8673] do_xdp_generic+0x770/0x12d0 [ 234.313406][ T8673] tun_get_user+0x24f8/0x4370 [ 234.318093][ T8673] tun_chr_write_iter+0x113/0x200 [ 234.323112][ T8673] vfs_write+0x612/0xba0 [ 234.327365][ T8673] ksys_write+0x150/0x270 [ 234.331690][ T8673] do_syscall_64+0x174/0x580 [ 234.336274][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.342168][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 234.348498][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 234.353610][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 234.358722][ T8673] rcu_core+0x78b/0x10a0 [ 234.362960][ T8673] handle_softirqs+0x225/0x840 [ 234.367726][ T8673] __irq_exit_rcu+0xca/0x220 [ 234.372306][ T8673] irq_exit_rcu+0x9/0x30 [ 234.376526][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 234.382171][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 234.388166][ T8673] Modules linked in: [ 234.392041][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 234.392056][ T8673] Tainted: [B]=BAD_PAGE [ 234.392059][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.392065][ T8673] Call Trace: [ 234.392070][ T8673] [ 234.392074][ T8673] dump_stack_lvl+0xe8/0x150 [ 234.392088][ T8673] bad_page+0x17f/0x1c0 [ 234.392098][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 234.392110][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 234.392128][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 234.392140][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 234.392149][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 234.392168][ T8673] do_xdp_generic+0xac2/0x12d0 [ 234.392180][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 234.392192][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 234.392205][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 234.392220][ T8673] ? tun_get_user+0x23cb/0x4370 [ 234.392237][ T8673] ? tun_get_user+0x23cb/0x4370 [ 234.392249][ T8673] tun_get_user+0x24f8/0x4370 [ 234.392270][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 234.392280][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 234.392289][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 234.392302][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 234.392313][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 234.392324][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 234.392337][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 234.392349][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 234.392360][ T8673] ? tun_get+0x1c/0x2f0 [ 234.392372][ T8673] ? tun_get+0x1c/0x2f0 [ 234.392386][ T8673] ? tun_get+0x1c/0x2f0 [ 234.392398][ T8673] ? tun_get+0x1c/0x2f0 [ 234.392411][ T8673] tun_chr_write_iter+0x113/0x200 [ 234.392424][ T8673] vfs_write+0x612/0xba0 [ 234.392439][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 234.392453][ T8673] ? __fget_files+0x2a/0x420 [ 234.392466][ T8673] ksys_write+0x150/0x270 [ 234.392479][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 234.392492][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.392502][ T8673] do_syscall_64+0x174/0x580 [ 234.392515][ T8673] ? trace_irq_disable+0x3b/0x140 [ 234.392526][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 234.392536][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.392545][ T8673] RIP: 0033:0x7ff56235e90e [ 234.392554][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 234.392562][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 234.392571][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 234.392578][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 234.392584][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 234.392590][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 234.392596][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 234.392605][ T8673] [ 234.392612][ T8673] BUG: Bad page state in process syz.2.895 pfn:31af4 [ 234.685868][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888031af4100 pfn:0x31af4 [ 234.695930][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 234.703047][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 234.711636][ T8673] raw: ffff888031af4100 0000000000000001 00000000ffffffff 0000000000000000 [ 234.720220][ T8673] page dumped because: page_pool leak [ 234.725568][ T8673] page_owner tracks the page as allocated [ 234.731277][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351812554, free_ts 230107492472 [ 234.748213][ T8673] post_alloc_hook+0x1f9/0x250 [ 234.752966][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 234.758513][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 234.764312][ T8673] __alloc_pages_noprof+0x10/0x100 [ 234.769432][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 234.774884][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 234.780954][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 234.785800][ T8673] do_xdp_generic+0x770/0x12d0 [ 234.790593][ T8673] tun_get_user+0x24f8/0x4370 [ 234.795265][ T8673] tun_chr_write_iter+0x113/0x200 [ 234.800297][ T8673] vfs_write+0x612/0xba0 [ 234.804536][ T8673] ksys_write+0x150/0x270 [ 234.808894][ T8673] do_syscall_64+0x174/0x580 [ 234.813481][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.819377][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 234.825690][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 234.830810][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 234.835913][ T8673] rcu_core+0x78b/0x10a0 [ 234.840163][ T8673] handle_softirqs+0x225/0x840 [ 234.844924][ T8673] __irq_exit_rcu+0xca/0x220 [ 234.849518][ T8673] irq_exit_rcu+0x9/0x30 [ 234.853749][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 234.859389][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 234.865362][ T8673] Modules linked in: [ 234.869265][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 234.869287][ T8673] Tainted: [B]=BAD_PAGE [ 234.869292][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 234.869302][ T8673] Call Trace: [ 234.869307][ T8673] [ 234.869314][ T8673] dump_stack_lvl+0xe8/0x150 [ 234.869336][ T8673] bad_page+0x17f/0x1c0 [ 234.869353][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 234.869376][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 234.869406][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 234.869427][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 234.869442][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 234.869474][ T8673] do_xdp_generic+0xac2/0x12d0 [ 234.869495][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 234.869515][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 234.869539][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 234.869564][ T8673] ? tun_get_user+0x23cb/0x4370 [ 234.869590][ T8673] ? tun_get_user+0x23cb/0x4370 [ 234.869611][ T8673] tun_get_user+0x24f8/0x4370 [ 234.869639][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 234.869658][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 234.869674][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 234.869697][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 234.869716][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 234.869733][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 234.869756][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 234.869776][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 234.869794][ T8673] ? tun_get+0x1c/0x2f0 [ 234.869815][ T8673] ? tun_get+0x1c/0x2f0 [ 234.869836][ T8673] ? tun_get+0x1c/0x2f0 [ 234.869857][ T8673] ? tun_get+0x1c/0x2f0 [ 234.869879][ T8673] tun_chr_write_iter+0x113/0x200 [ 234.869902][ T8673] vfs_write+0x612/0xba0 [ 234.869927][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 234.869958][ T8673] ? __fget_files+0x2a/0x420 [ 234.869982][ T8673] ksys_write+0x150/0x270 [ 234.870004][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 234.870028][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.870044][ T8673] do_syscall_64+0x174/0x580 [ 234.870065][ T8673] ? trace_irq_disable+0x3b/0x140 [ 234.870083][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 234.870100][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 234.870117][ T8673] RIP: 0033:0x7ff56235e90e [ 234.870131][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 234.870145][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 234.870162][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 234.870173][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 234.870184][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 234.870194][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 234.870203][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 234.870229][ T8673] [ 234.870238][ T8673] BUG: Bad page state in process syz.2.895 pfn:7fa8f [ 235.163676][ T8673] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88807fa8f300 pfn:0x7fa8f [ 235.173738][ T8673] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 235.180860][ T8673] raw: 00fff00000000000 dead000000000040 ffff88801b10f000 0000000000000000 [ 235.189446][ T8673] raw: ffff88807fa8f300 0000000000000001 00000000ffffffff 0000000000000000 [ 235.198033][ T8673] page dumped because: page_pool leak [ 235.203376][ T8673] page_owner tracks the page as allocated [ 235.209109][ T8673] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2820(GFP_ATOMIC|__GFP_NOWARN), pid 8673, tgid 8672 (syz.2.895), ts 230351796233, free_ts 230107529232 [ 235.226046][ T8673] post_alloc_hook+0x1f9/0x250 [ 235.230815][ T8673] get_page_from_freelist+0x21fa/0x2270 [ 235.236355][ T8673] __alloc_frozen_pages_noprof+0x18d/0x380 [ 235.242167][ T8673] __alloc_pages_noprof+0x10/0x100 [ 235.247293][ T8673] alloc_pages_bulk_noprof+0x5f5/0x7b0 [ 235.252727][ T8673] __page_pool_alloc_netmems_slow+0x14f/0x720 [ 235.258792][ T8673] skb_pp_cow_data+0xc08/0x18e0 [ 235.263637][ T8673] do_xdp_generic+0x770/0x12d0 [ 235.268409][ T8673] tun_get_user+0x24f8/0x4370 [ 235.273084][ T8673] tun_chr_write_iter+0x113/0x200 [ 235.278134][ T8673] vfs_write+0x612/0xba0 [ 235.282394][ T8673] ksys_write+0x150/0x270 [ 235.286734][ T8673] do_syscall_64+0x174/0x580 [ 235.291320][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.297213][ T8673] page last free pid 6387 tgid 6387 stack trace: [ 235.303524][ T8673] __free_frozen_pages+0xc1e/0xd10 [ 235.308638][ T8673] tlb_remove_table_rcu+0x85/0x100 [ 235.313766][ T8673] rcu_core+0x78b/0x10a0 [ 235.318013][ T8673] handle_softirqs+0x225/0x840 [ 235.322767][ T8673] __irq_exit_rcu+0xca/0x220 [ 235.327377][ T8673] irq_exit_rcu+0x9/0x30 [ 235.331610][ T8673] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 235.337247][ T8673] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 235.343221][ T8673] Modules linked in: [ 235.347124][ T8673] CPU: 0 UID: 0 PID: 8673 Comm: syz.2.895 Tainted: G B syzkaller #0 PREEMPT(full) [ 235.347147][ T8673] Tainted: [B]=BAD_PAGE [ 235.347152][ T8673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 235.347160][ T8673] Call Trace: [ 235.347172][ T8673] [ 235.347179][ T8673] dump_stack_lvl+0xe8/0x150 [ 235.347201][ T8673] bad_page+0x17f/0x1c0 [ 235.347217][ T8673] __free_frozen_pages+0xcc2/0xd10 [ 235.347239][ T8673] bpf_xdp_frags_shrink_tail+0x4ed/0x800 [ 235.347270][ T8673] bpf_xdp_adjust_tail+0x1ce/0x210 [ 235.347291][ T8673] bpf_prog_5d7dc57dfd7f985a+0x1e/0x24 [ 235.347307][ T8673] bpf_prog_run_generic_xdp+0x612/0x1560 [ 235.347338][ T8673] do_xdp_generic+0xac2/0x12d0 [ 235.347360][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 235.347381][ T8673] ? do_xdp_generic+0x6ba/0x12d0 [ 235.347405][ T8673] ? __pfx_do_xdp_generic+0x10/0x10 [ 235.347431][ T8673] ? tun_get_user+0x23cb/0x4370 [ 235.347458][ T8673] ? tun_get_user+0x23cb/0x4370 [ 235.347481][ T8673] tun_get_user+0x24f8/0x4370 [ 235.347509][ T8673] ? aa_file_perm+0x18b/0x15f0 [ 235.347528][ T8673] ? aa_file_perm+0x4ed/0x15f0 [ 235.347543][ T8673] ? __pfx_tun_get_user+0x10/0x10 [ 235.347565][ T8673] ? __lock_acquire+0x683/0x2cf0 [ 235.347586][ T8673] ? preempt_schedule_thunk+0x16/0x40 [ 235.347602][ T8673] ? preempt_schedule_common+0x82/0xd0 [ 235.347623][ T8673] ? ref_tracker_alloc+0x341/0x4b0 [ 235.347643][ T8673] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 235.347661][ T8673] ? tun_get+0x1c/0x2f0 [ 235.347681][ T8673] ? tun_get+0x1c/0x2f0 [ 235.347703][ T8673] ? tun_get+0x1c/0x2f0 [ 235.347724][ T8673] ? tun_get+0x1c/0x2f0 [ 235.347746][ T8673] tun_chr_write_iter+0x113/0x200 [ 235.347769][ T8673] vfs_write+0x612/0xba0 [ 235.347794][ T8673] ? __pfx_vfs_write+0x10/0x10 [ 235.347819][ T8673] ? __fget_files+0x2a/0x420 [ 235.347841][ T8673] ksys_write+0x150/0x270 [ 235.347864][ T8673] ? __pfx_ksys_write+0x10/0x10 [ 235.347887][ T8673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.347904][ T8673] do_syscall_64+0x174/0x580 [ 235.347924][ T8673] ? trace_irq_disable+0x3b/0x140 [ 235.347942][ T8673] ? clear_bhb_loop+0x70/0xc0 [ 235.347960][ T8673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 235.347975][ T8673] RIP: 0033:0x7ff56235e90e [ 235.347989][ T8673] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 235.348003][ T8673] RSP: 002b:00007ff56326dfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 235.348020][ T8673] RAX: ffffffffffffffda RBX: 00007ff56326e6c0 RCX: 00007ff56235e90e [ 235.348032][ T8673] RDX: 0000000000011dc0 RSI: 00002000000004c0 RDI: 00000000000000c8 [ 235.348042][ T8673] RBP: 00007ff562435024 R08: 0000000000000000 R09: 0000000000000000 [ 235.348052][ T8673] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 235.348062][ T8673] R13: 00007ff562626038 R14: 00007ff562625fa0 R15: 00007ffeb04c8ae8 [ 235.348081][ T8673] [ 235.351738][ T5745] net_ratelimit: 8 callbacks suppressed [ 235.351749][ T5745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 235.651769][ T5745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 235.659863][ T6387] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 236.397062][ T2164] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 237.427301][ T5717] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 238.387051][ T5710] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 238.477485][ T5745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 238.946747][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 239.507082][ T5745] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog