last executing test programs: 11.644079169s ago: executing program 3 (id=3167): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="00000000000000001842000006fff9000000000000000000b703000000000000b70400000000000085000000a4000000b7000000000000009500000000000000b7000000fffffff29500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) 11.267884012s ago: executing program 3 (id=3173): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000050c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) 11.105203246s ago: executing program 3 (id=3175): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b24fc60", 0x8c0}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f00000030c0)={0x0, 0x0, &(0x7f0000002e80)=[{&(0x7f0000000d40)=""/204, 0xcc}], 0x1}, 0x0) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r1}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c00)=ANY=[@ANYBLOB="64010000100001000400000000000000fc010000000000000000000000000000000000000000000000000000000000000000ecdf000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1414190000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000a000100cd00000000000000480002006362632873657270656e7429000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020001700010000002abd7000000000002bbd7000000000000b000000080000000c001c00", @ANYRES32=r3], 0x164}}, 0x0) 7.728189167s ago: executing program 3 (id=3179): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="30000000190001000000000000000000021800000000ff000000000008"], 0x30}}, 0x20) 7.611529493s ago: executing program 3 (id=3180): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r1, 0x321, 0x70bd27, 0x25dfdbfc}, 0x14}}, 0x4000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r3 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r3, &(0x7f0000000180)={&(0x7f00000006c0)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f00000019c0)=[{&(0x7f0000000600)="9745010000004000012c8cc5ff", 0xd}, {&(0x7f0000000340)="82f750e625d3c8d9d65198c3bd00", 0xe}], 0x2, &(0x7f00000008c0)}, 0x400c804) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r4, 0x0, 0x800) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, 0x0, 0x0) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, 0x0, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, 0x0, 0x0) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0) r6 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x23) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x12, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000f00)={r2, 0xe0, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000c40)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, &(0x7f0000000c80)=[0x0, 0x0], &(0x7f0000000cc0)=[0x0, 0x0, 0x0], 0x0, 0xf7, &(0x7f0000000d00)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000d40), &(0x7f0000000d80), 0x8, 0x2c, 0x8, 0x8, &(0x7f0000000dc0)}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001240)={r2, 0xe0, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000f80)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3, &(0x7f0000000fc0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001000)=[0x0, 0x0, 0x0], 0x0, 0x92, &(0x7f0000001040)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000001080), &(0x7f00000010c0), 0x8, 0x19, 0x8, 0x8, &(0x7f0000001100)}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f00000012c0)={'erspan0\x00', &(0x7f0000001280)={'gre0\x00', 0x0, 0x8000, 0x8000, 0x8, 0x7ff, {{0x6, 0x4, 0x2, 0x4, 0x18, 0x67, 0x0, 0xf2, 0x2f, 0x0, @multicast2, @rand_addr=0x64010100, {[@noop]}}}}}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000002240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002200)={&(0x7f0000001a00)=ANY=[@ANYBLOB="cc070000", @ANYRES16=0x0, @ANYBLOB="000125bd7000fbdbdf250100000008000100", @ANYRES32=0x0, @ANYBLOB="44000280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000000020008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="4400028040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040081000000080007000000000008000100", @ANYRES32=0x0, @ANYBLOB="f00002803800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000000003808000600", @ANYRES32=0x0, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000008000100", @ANYRES32=0x0, @ANYBLOB="dc0102803c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000005000300050000000900040068617368000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400080000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="08000700000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="3c00028038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="3c00028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400ffffff7f08000100", @ANYRES32=0x0, @ANYBLOB="d40102803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c656400000000000000000000000000050003000600000004000400080006", @ANYRES32=0x0, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000001000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000470003000e000000080004000080000008000600", @ANYRES32=0x0, @ANYBLOB="64000100240001006270665f686173685f66756e6300000000000000000000000000000000000000050003000b0000003400040006000807fdffffff0200090906000000920a040209000000010030040200000006000580ee3e0000910002020300000008000100", @ANYRES32=0x0, @ANYBLOB="d80102803800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004006100000040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000000000008000600", @ANYRES32=r7, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400858e000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000f0a00003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r8, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r9, @ANYBLOB], 0x7cc}, 0x1, 0x0, 0x0, 0x40081}, 0x80) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 7.037908993s ago: executing program 3 (id=3185): mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x800005, 0x32, 0xffffffffffffffff, 0x852ac000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000201ff003e851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdffffff000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) 6.069839749s ago: executing program 1 (id=3191): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000008400000007000000ac1414aa0000001120"], 0x38, 0x4855}, 0x24000052) 5.822396084s ago: executing program 1 (id=3193): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) unshare(0x400) write$cgroup_int(r6, &(0x7f0000000080)=0x4, 0xfffffe7d) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x1d, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000cc0)=@newtfilter={0x90, 0x2c, 0xd27, 0x70bd2a, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x57f}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x4e3, 0xca0b, 0x2, 0x3}, 0x2}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x40800}, 0x44000) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1, 0x0, 0x0, 0x86dd}, 0x4) r12 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r13, {0xc, 0x10}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) setsockopt$inet_mreq(r3, 0x0, 0x20, &(0x7f00000001c0)={@multicast2, @rand_addr=0x64010100}, 0x8) 4.945772317s ago: executing program 0 (id=3197): bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0200000004000000060000000500000000100000", @ANYRES32, @ANYBLOB="0200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000000000000000000547a54b116568fa93262609496deec83f7974837626159669bb8000000ecbe7bc4b3cc1fa2bea1c11bb6e3950d1172e25f446a505b"], 0x50) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0xffffffffffffff2d, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newtfilter={0x90, 0x2c, 0xf3f, 0x30bd29, 0x25dfd3f5, {0x0, 0x0, 0x0, r1, {0x1, 0x3}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_flower={{0xb}, {0x60, 0x2, [@TCA_FLOWER_ACT={0x5c, 0x3, [@m_sample={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xb75}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x9}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x8, 0x0, 0x20000000, 0x3, 0x403}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x20005891}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000680)={'team0\x00', 0x0}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth1_to_team\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x10}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0xfffffe63, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000980)={0xffffffffffffffff, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x4b, &(0x7f0000000780)=[{}], 0x8, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0x8, 0xaf, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r9) getsockname$packet(r9, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r10, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001300)=@newtfilter={0x44, 0x28, 0x575ac7824d421509, 0x70bd29, 0x4, {0x0, 0x0, 0x0, r10, {0x9}, {0xf9d690b100bbf911}, {0x10, 0x5}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xfff3, 0xfff2}}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}]}, 0x44}, 0x1, 0x0, 0x0, 0x11}, 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000a40)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000a80)={'batadv_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000ac0)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000b00)={'geneve0\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000b80)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(0xffffffffffffffff, &(0x7f0000002000)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001580)=ANY=[@ANYBLOB="140a0000", @ANYBLOB="000225bd7000fcdbdf250200000008000100", @ANYRES32=0x0, @ANYBLOB="500002804c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000019000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=0x0, @ANYBLOB="700102803c00b81eb1643f42a8f78784010024000100757365725f6c696e6b75705f656e61626c656400000000000000000000000000050003000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400810000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e00000008000400bba2000008000600", @ANYRES32=0x0, @ANYBLOB="3c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000009000400686173680000000008000100", @ANYRES32=0x0, @ANYBLOB="2802028040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="080007000000000044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000110004006163746976656261636b75700000000038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000900000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400020000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000300000008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400ffffffff3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="a401028038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000800000038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b000000080004000300000008000700000000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000005000300050000000900040068617368000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000500030003000000080004000600000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b0000000800040000000000080007000000000008000100", @ANYRES32=r2, @ANYBLOB="2801028038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000a00000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000050003000300000008000400ffff00003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000050003000b000000080004007c29ffff08000700000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="b40002803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000050003000300000008000400000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="e401028038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000100000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000800000008000600", @ANYRES32=r11, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=0x0, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004007b000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004005f08000008000600", @ANYRES32=r13, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b00000008000400f9fcffff08000600", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r14, @ANYBLOB="7400028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400090000003800010024000100616374697665706f727400000000000000000000000000000000000000000000050003000300000008000400", @ANYRES32=r15, @ANYBLOB], 0xa14}, 0x1, 0x0, 0x0, 0x10008004}, 0x20000040) r16 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r17 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r17, 0x107, 0xb, &(0x7f0000000000), &(0x7f0000001540)=0x4) r18 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1e, 0xc, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x300}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r16}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8000}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xc6}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, r18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.8453528s ago: executing program 2 (id=3198): r0 = socket$inet_udp(0x2, 0x2, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=@newqdisc={0x58, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x5, 0x6}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x24, 0x2, [@TCA_FQ_CODEL_INTERVAL={0x8, 0x3, 0xffffffff}, @TCA_FQ_CODEL_MEMORY_LIMIT={0x8, 0x9, 0x2}, @TCA_FQ_CODEL_DROP_BATCH_SIZE={0x8, 0x8, 0x100}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x200001d4}, 0x8840) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000007c0)={'tunl0\x00', &(0x7f0000000700)={'tunl0\x00', 0x0, 0x7800, 0x1, 0x3ff, 0x2, {{0x7, 0x4, 0x1, 0x3e, 0x1c, 0x65, 0x0, 0x57, 0x0, 0x0, @remote, @private=0xa010100, {[@cipso={0x86, 0x6}]}}}}}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x4}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007000000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000c500000095"], &(0x7f0000000640)='syzkaller\x00', 0x8, 0x8d, &(0x7f0000000680)=""/141}, 0x94) 4.531192612s ago: executing program 1 (id=3199): syz_init_net_socket$llc(0x1a, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000380000003800000003000000010000000000000100000000000000000000000000000001050000001000000000000000000000030000000001"], 0x0, 0x53, 0x0, 0x1}, 0x28) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, r2}, 0x14) setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000040)={@remote, r2}, 0x14) r3 = socket$inet_tcp(0x2, 0x1, 0x0) shutdown(r3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0xfee7, &(0x7f0000000140)=[{&(0x7f00000001c0)="d80000001c0081064e81f782db44b9040a1d08040000000000000aa1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef5d2defd5ccae8d3fb7c27a1059ae31c60e2234d732", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x400c0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), r0) sendmsg$TIPC_NL_KEY_FLUSH(r0, &(0x7f00000007c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000780)={&(0x7f00000004c0)={0x2b4, r5, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0xc, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffff998}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x86}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}]}, @TIPC_NLA_NODE={0xc, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_PUBL={0x4c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xffff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_SOCK={0x18, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}]}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_NODE={0x138, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1000}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x48, 0x4, {'gcm(aes)\x00', 0x20, "e4e05eddf918b2d8e2760704f5c197206ccdfc7f5f237f3b1cd84aacb78d92a5"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x5}, @TIPC_NLA_NODE_ID={0xd5, 0x3, "66d71d56cb3b03cf33af9239cf6ae0928114da3365db97745267bd6603b98e4ecf044beec74a570b0a7b63db4c68a3ac360d2d91d8e97c1d9922ac569ec5d705db4c77cd14639798c93b51e8244b5c91bf8172e3b7d5d70bcb4b07589589f2596fc4a815ccb40b6605b86171f6300aaea698d52cd697264fd3cb43d62f97cf0f9a74f244da0432e7e1c81cb9d38388ae852f690957b6427f812e4728085b7ed6ccd38b6c436f442e8012eb54afbd42c168e130faee22083243d1853530f84cfacb829d8ca6452c8c98251b6a5990dfc10f"}]}]}, 0x2b4}, 0x1, 0x0, 0x0, 0x800}, 0x8000) connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) 4.393444038s ago: executing program 2 (id=3200): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000280)={0x0, 0x8d5, 0x18}, 0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000340)={r3, 0x58, &(0x7f00000002c0)}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000380)) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f00000001c0)='geneve\x00', 0x7) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_DF={0x5, 0xd, 0x2}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4.335633177s ago: executing program 0 (id=3201): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f00000025c0)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0x40, @multicast1}}}], 0x20}, 0x804) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) sendmsg$inet(r0, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x16}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0x3, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r1, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) r4 = socket$inet6(0xa, 0x2, 0x9) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast2, 0x2}, 0x1c) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x2000}, 0x50) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0xd, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000fcffffff000000008000000085000000a800000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000203000000000000a60000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) r10 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r10, &(0x7f0000001240)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001200)={&(0x7f00000014c0)=ANY=[@ANYBLOB="5c0000c9960d715c3f9f3300fcdbdf2508000100020000000b004500736d635f696200000800010000000000080003000100000009004500756d61640000000008000100000000000c00450072646d615f636d181d9584f1f1ec69e7b25490030008000300010000005cfd93c65f545688b85c14609d0418fede352f44d8b3a6bb13574fa14f997de4f7c6827fef08e4a95bad1c58a32a04c988"], 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000804) r11 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettfilter={0x2c, 0x2e, 0x1, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x1, 0xe}, {0x0, 0xfff1}, {0x0, 0x2}}, [{0x8, 0xb, 0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4041080) r12 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x101842, 0x0) ioctl$PPPIOCNEWUNIT(r12, 0xc004743e, &(0x7f0000000040)) readv(r12, &(0x7f0000000280)=[{&(0x7f0000000240)=""/49, 0x3d}], 0x26) bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$AUDIT_SIGNAL_INFO(r9, &(0x7f00000010c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001080)={&(0x7f0000001340)={0x10, 0x3f2, 0x400, 0x70bd27, 0x25dfdbfb, "", ["", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x4804}, 0x804) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001380)=ANY=[@ANYBLOB="3c00000010000108fdffffff0000000800000000", @ANYRES32=0x0, @ANYBLOB="00000000002040000a00010c002d80050008003e0000000000000000000000000000000015460f1daaa82b7cd0812c1a9cbbf36d"], 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) socket$nl_netfilter(0x10, 0x3, 0xc) 4.333619311s ago: executing program 4 (id=3202): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="d8000000180081054e81f783db4cb9040a1d080006007c09e8fc55a10a0015000600142603600e1208000f00fff00401a80008000800104004080000055c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb71b14d6d930dfe144ecc44121d9d322fe7c008775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3940fad9e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd4e1ffffffffc1c9b6278754ca397c388b0dd6e4edef3d9300fc0d150000000000000000", 0xd8}], 0x1}, 0x4040000) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000040)={r0, 0x1, 0x5, 0x1}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r5, @ANYBLOB="01002cbd7000fddbdf250b00000008000300", @ANYRES32=r6, @ANYBLOB="5000508011000100ec3bd87b59ecb393bce7f9ac6700000009000100c8803781500000000400060007000400478d000005000900020000000c000880"], 0xa8}, 0x1, 0x0, 0x0, 0x20080000}, 0x40000) r7 = socket$unix(0x1, 0x5, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a45546388c95045bc22fe88c43b82a0a5d3eb61c238a5159ea98db9c00aeef644ae98a8cb8dffff3b7ba14d7971910b559623af8295", 0x13c}], 0x2}, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, 0x0, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00', 0x0}) r12 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r9, r11, 0x25, 0x4, @void}, 0x10) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r12, r9, 0x4, r9}, 0x10) ioctl$sock_SIOCSIFBR(r7, 0x8941, &(0x7f00000004c0)=@add_del={0x2, &(0x7f0000000400)='geneve0\x00'}) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r13, 0x8b18, &(0x7f0000000000)={'wlan1\x00'}) r14 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010000000000000000003900000008000300", @ANYRES32=r15, @ANYBLOB="24005a8020000180140003000000000000000000000000000100000004000200040001"], 0x40}}, 0x0) r16 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r16, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x4a}, 0x8) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="04010000", @ANYRES16=r5, @ANYBLOB="00022dbd7000fcdbdf256700000008000300", @ANYRES32=r15, @ANYBLOB="1700c5008a37b79c7136518e0c65d1357a19dcf110b19e00c500c50067f039d513ea990d01a0856b8210e8fa76ff16b8c8824dde54a925f0e0176731aa7a05d1ae6e074bb8a0d86151bbc04195e812ddf320434673ded4683ea9a66470bb5312a4e03bfd8e35498f2ccf4c9cac8b1b06e9c800000000d0c7b79149becb4b566833fa79b6c33ebf8b47dc405d6725a987bd750d4f1611494236c8844bf2da469948ff0f000000000000e97868f20a351337fd3c684b27dd36b64535f259249b7ff324efea6ae9d5979e162ead557d804f47be08ebae912407d3d2fb45d70000000800c30060790000"], 0x104}, 0x1, 0x0, 0x0, 0x8000}, 0x4000800) 3.916955291s ago: executing program 2 (id=3203): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="24007000fbdbdf250400000045edee2c9d5ec175f292fc91af995ddabaced3e224ec50d41a21a9acc0bb5f4097bd2c533fb38fafd731c69ac121f585177689e4d362d6b9937d8ea773aa5e89cde83373"], 0x24}, 0x1, 0x0, 0x0, 0x42914}, 0x20044014) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa33"], 0xfdef) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="12000000e8000000080000000200000000000000", @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000000962b670de0465f19e1f44213a87f22e40a2e541d140b3af8601dde9b677b94d2316f860ab0b679a1d953bf3af0a0d2ace5411e8031ce1510e51ff335cd3fd11c4e828e1f5e83431a55a38469a00000000b1eacb321218afdf7c3f1a07785679c6000000000000000026ad08e3df68ba9e952244e24fc933ff958297e98fea67cf37d836c22992f6", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000780)={r1, &(0x7f0000000380), 0x0}, 0x20) (async) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0xf5ffffff, &(0x7f0000000000)='%', 0x0, 0xd01, 0xbe02, 0x0, 0x0, 0x0, 0x0, 0x2, 0x31}, 0x48) (async) socket(0x2, 0x80805, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000580)) (async) ioctl$XFS_IOC_GETBMAP(0xffffffffffffffff, 0xc0205826, &(0x7f0000000400)={0x9, 0x3, 0x3, 0x2, 0x9}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)=@newlink={0x48, 0x10, 0xffffff1f, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x4412c}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_BR_GROUP_ADDR={0xa, 0x14, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, @IFLA_BR_AGEING_TIME={0x8, 0x9}]}}}]}, 0x48}}, 0x4040) (async, rerun: 64) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000040)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x30}}, 0x20000000) (rerun: 64) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000000900010073797a300000000064000000030a01030000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140003006e657464657673696d300000000000000800000000000000140000001100"], 0xac}, 0x1, 0x0, 0x0, 0x4008855}, 0x0) (async) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) (async, rerun: 32) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async, rerun: 32) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) (async) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r8 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000080)=r7, 0x4) bpf$LINK_DETACH(0x22, &(0x7f0000000340)=r8, 0x4) (async) r9 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r7, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r9, r6, 0x0, r5}, 0x10) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$ARPT_SO_GET_REVISION_TARGET(r10, 0x0, 0x63, &(0x7f0000000080)={'icmp\x00'}, &(0x7f0000000440)=0x1e) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, &(0x7f0000000180)) 3.384611652s ago: executing program 1 (id=3204): unshare(0x28000600) r0 = socket$key(0xf, 0x3, 0x2) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) close(0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="120000000400000008000ec1be6a2b992af5de7869326d487743351d"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=r3, @ANYRESHEX=r2, @ANYRES16=r2, @ANYRES64=r2], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r3, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r1}, 0x20) recvmmsg(r0, &(0x7f0000000440), 0x6f5, 0x2000000022, &(0x7f0000000480)={0x77359400}) sendmsg$key(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x19}}, 0x58) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000740)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000d7dbdf253a000000080003003da136eeac4fe4d982369a9e93a248a3a24e7a68e96f56d9bbad9a846d73d91c3aee0d084957ba43d028b8370f01c244b6fa2cbc3dc47bcbc0b348a35cb42d99", @ANYRES32=r6, @ANYBLOB="04005b000600650004000000"], 0x28}, 0x1, 0x0, 0x0, 0x24000850}, 0x20044004) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r7, 0x400448c9, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000c80)=@deltaction={0x270, 0x31, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x21, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xdc72}}, {0xc, 0x1b, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x800}}, {0x10, 0x12, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffe98f}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @TCA_ACT_TAB={0x8c, 0x1, [{0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x10, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8000}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xbe4d}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xff}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}]}, @TCA_ACT_TAB={0x5c, 0x1, [{0x10, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0x14, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @TCA_ACT_TAB={0x34, 0x1, [{0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x36}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9}}, {0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x9c31}}]}, @TCA_ACT_TAB={0x2c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3ff}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @TCA_ACT_TAB={0x78, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xda}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb0}}, {0x10, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'skbmod\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}]}]}, 0x270}, 0x1, 0x0, 0x0, 0x2400c061}, 0x4890) setsockopt$netlink_NETLINK_NO_ENOBUFS(r8, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000680)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x94}, 0x40045) r9 = socket(0x10, 0x3, 0x0) write(r9, &(0x7f00000009c0)="14000041f22f01d7b2eec37ee2ce2fa4ff0f000000efa43417919d3556ec01fb56683dcae8e23f6b7e4242fce28fad7e3a4bb8a95b4a22ad3e3baa7bf758439c0e98385571fa938fe5ce4c86c4d02ed028cb8c5cdde40172596359980449186f7c0479d14e4e7e4dac06db736ad4c50b00986bb8b0ebc04bbd8ce0f957633d2127fda31075e1022467719827b45dd2b9256f660800369a2750b77825a3d2659cc5f99ecd5fabe7427d567697c1909be3c0bd4c6f7cebca0db63cbe85d7854a1abcd14a788a28f577d01bbb72f0285d4e2de8673973493d064bac38d5c908a6024a3c4c39fb3e098bbc8bc58af4f830e5064728ecea975b2ac55138b29674ad0f8109b9c3c9d22498cc2733d9991dd9d6", 0x110) recvmmsg(r9, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080000900010073797a30000000002c000000030a01010000000000000000010000090900010073797a30000000000900030073797a320000000058000000060a010400000000000000000100000008000b4000000000300004802c0001800b0001007470726f787900001c0002800800014000000001080002710000000008000340000000150900010073797a300000"], 0xcc}}, 0x0) r11 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000500)=ANY=[@ANYBLOB="140100002f00010000000000fcdbdf250101f2800c00180008ac0f00040000001400010000000000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0a3000000000000001d5e8d3fb22a1b5046778bdafefc46b0449a0068bf84b36ec72dd71265fc2e882348c26c9f772061086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26f2d5f02b6ffb36e20c34e21b190297f9ebe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c0400e90000000024defbe7def7a492fe6b5705f7fba8d1128a626e59317c7a94d32b2d1f65b9ed164824c560eba5d8736c9f7604f7d5009b40e53138ead6ef88a9a1b428436fa57be38aefb81c61da6e06445a76dcbd7b65ef2abcd9f47d77fc0da089"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 3.277891861s ago: executing program 4 (id=3205): bpf$LINK_DETACH(0x22, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1100000004000000040000000900000000000000", @ANYRES32, @ANYBLOB="040000000000000000f08300000030b100000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000380)={r0, 0x0, 0x0}, 0x20) ioctl$XFS_IOC_GETBMAPX(0xffffffffffffffff, 0xc0205838, &(0x7f00000000c0)={0x5, 0x6b, 0x7, 0x5, 0x4, 0x2, 0x4}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000003880)=@newtfilter={0x49c, 0x2c, 0xc3f, 0x30bd21, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xb, 0x3}, {}, {0xc, 0x300}}, [@filter_kind_options=@f_fw={{0x7}, {0x470, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x80000001}, @TCA_FW_CLASSID={0x8, 0x1, {0xffe4, 0xc}}, @TCA_FW_ACT={0x45c, 0x4, [@m_police={0x458, 0x16, 0x0, 0x0, {{0xb}, {0x42c, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xfffffeffffff1427}, @TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}], [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0xa759}, @TCA_POLICE_RATE={0x404, 0x2, [0x23000, 0xffffffff, 0x10, 0x1, 0x8, 0x3ff, 0x0, 0x0, 0xf, 0xa, 0x100, 0x2, 0x75, 0x9, 0x0, 0x9, 0xffffffba, 0xa, 0x4, 0x59, 0x4, 0x3, 0x7, 0x3, 0xffffffff, 0x1, 0x3, 0x0, 0x5, 0xb254, 0x9, 0x6, 0x80, 0xb, 0x5, 0x2, 0x3, 0x3, 0x2, 0x6, 0xb63e, 0x1, 0xb, 0x8, 0x7238, 0x8, 0xf, 0x4, 0x8001, 0xffff, 0x7f, 0x3, 0xd, 0x7, 0x100, 0x8, 0xe701, 0x3, 0x2, 0x5ff1a96a, 0x1, 0xff, 0x4, 0x401, 0x0, 0x7, 0x3c84, 0x200, 0x5650a7a5, 0xca, 0x3, 0x8, 0x4, 0x10000, 0x6, 0xb843, 0xdd, 0x21a, 0x59a4, 0x40, 0x2, 0x8, 0x4, 0x1000, 0x6, 0x1000000, 0x9, 0x9, 0x2, 0x1ff, 0x24b368a2, 0x0, 0x8, 0x94b, 0xfffffff8, 0x7fff, 0xb3, 0xfffffff9, 0xb, 0xb8, 0x8000, 0x4, 0xe7a, 0x1, 0xa, 0x2, 0x8, 0x7, 0x7, 0x7, 0x9, 0x400000, 0x1, 0x5, 0x7ff, 0x3, 0x8, 0x1, 0x0, 0x8000, 0xffffffff, 0xe, 0x6, 0x5, 0x10001, 0x2, 0x7, 0x80, 0x8, 0x18e5, 0x6, 0x3, 0x6, 0x9, 0x7ff, 0x7, 0x7fff, 0xeb, 0x0, 0x9, 0x6322dc7b, 0x10, 0x78000000, 0xfff, 0xc000000, 0xc15, 0x9, 0x20, 0x400, 0x9b, 0x6e4, 0x7, 0x81, 0x0, 0x4, 0x0, 0xfffffffd, 0x1, 0x9, 0x7, 0x8, 0x2, 0x8000, 0xb2, 0x2, 0xd, 0x80000000, 0x40, 0x38e6, 0x400, 0x0, 0x0, 0x7b9, 0x9, 0x1000, 0x5, 0x3, 0xaa6, 0x6d, 0x2, 0x101, 0x7, 0x4b0, 0x2, 0x3, 0x8, 0x6, 0xffffffff, 0x0, 0x0, 0xffffff8c, 0x9, 0x1000, 0x9, 0x3, 0x8, 0x9, 0x4, 0xd851, 0x0, 0x7fffffff, 0x8, 0x8, 0xb, 0x9, 0x8000, 0x4, 0x9bcc, 0x7, 0x4, 0xb5, 0xea, 0x8000, 0x7f, 0x1, 0x1, 0x1, 0x7, 0x4, 0x4, 0xc8f, 0x1, 0x4, 0x0, 0x6, 0xfffffffb, 0x9f84, 0x1ff, 0xffffffff, 0x2, 0x8, 0x4, 0x1, 0x0, 0x2, 0x8, 0x3, 0x5, 0xb, 0x4, 0x80, 0x5, 0x3d110ccc, 0x7, 0x1, 0x0, 0x0, 0xe, 0x7ff, 0x3, 0x2, 0x0, 0x2, 0x7, 0x7, 0x1]}], []]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x49c}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x7, 0x7, 0x7, 0x5, 0x6, 0x7, 0x1, 0xb}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4c000) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000b0}, 0x48d0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56561, 0x70bd2f, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x0, 0x8}, {0xc, 0xffff}}}, 0x24}}, 0x4048090) r7 = socket$kcm(0x2, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ff"], 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="2000000016000d002cbd7000bedbdf25237c00000c00018008000100", @ANYRES32=r10], 0x20}, 0x1, 0x0, 0x0, 0x20048891}, 0x8010) write$tun(0xffffffffffffffff, &(0x7f0000003d00)=ANY=[@ANYBLOB="080000f5060006"], 0xfcf) 3.117224879s ago: executing program 0 (id=3206): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="18080000d0ff0000000000003e000000180000fe", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180100002020782500000000002020207b1bf0ff00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff00000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) 2.940766961s ago: executing program 2 (id=3207): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, 0x3, 0x2, 0x3, 0x0, 0x0, {0x0, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) accept4(r1, 0x0, &(0x7f0000000440), 0x800) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_LOOPBACK(r5, 0x65, 0x3, &(0x7f0000000040), 0x4) shutdown(r4, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0) setsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={r7, 0x81}, 0x8) recvmsg$unix(r3, &(0x7f0000000b00)={&(0x7f00000002c0), 0x6e, &(0x7f0000000980)=[{&(0x7f00000009c0)=""/173, 0xad}, {&(0x7f0000000800)=""/160, 0xa0}, {&(0x7f00000008c0)=""/106, 0x6a}, {&(0x7f0000000940)}], 0x4}, 0x20) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)=ANY=[@ANYBLOB="440000001000ff7401007115bddebb25000000009ea0d6c3856dc8a5ef0fb713982085b46b1c67eeecdc48b5c23437dce7c2d3ea07d7049297eb84941018cdecceeb28afbb84bec3f9df5732bb6402f010ace4ef08abd2b4fe1a06e4e314f14e7168eb589325c98279f24c4f89927e6c2f30cf28f192337b2ef401b21640035bf668d88106590ec41078f20f044f080efa1734496226c4aa0f44830cab558814fe9b46acf5b2c4e2a8553b22e29f82cd512b57454b5eda0a70f34254", @ANYRES32=0x0, @ANYBLOB="1720000021200000240012800c0001006d6163766c616e0014000280100005800a000400ffffffffffff0000"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) sendmsg$NFT_BATCH(r1, 0x0, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000400)=@getspdinfo={0x14, 0x25, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x4000000) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000000)='nicvf0\x00', 0x10) r10 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x1403, 0x1, 0x1070bd27, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000580), 0xffffffffffffffff) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000480)={0x5, 0x9705, 0x4, 0xff, 0x1}, 0x14) socket$nl_route(0x10, 0x3, 0x0) 2.855397705s ago: executing program 0 (id=3208): r0 = socket$packet(0x11, 0x3, 0x300) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa000000000000791008000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000bf03000000000000850000000c000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x2e, 0x501, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x0, 0xffff}, {0x0, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r1) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000600)={0x24, r7, 0x60b, 0x70bd2d, 0x0, {}, [@IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x24}}, 0x20080000) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x20, 0x2, 0x81, 0xfffff030}, {0x6, 0x0, 0x0, 0xfffffffe}]}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 2.452400221s ago: executing program 1 (id=3209): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x14, &(0x7f00000009c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x80}, [@printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc0adcb}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20000002}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0xa6}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11}, 0x94) pipe(&(0x7f0000000340)) socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x1a}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x5}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x850}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'veth0_to_team\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r6], 0x68}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x0, 0x14000086) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@local, @mcast2, [0x0, 0x26a9e3a96bccb3de], [0x0, 0xffffffff, 0xff], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x0, 0x0, 0x2}, 0x0, 0xa8, 0xd0}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0x0, 0xffff00, 0xff000000], [0xff, 0xffffff00, 0xff000000], 'syzkaller0\x00', 'wlan1\x00', {0xff}, {}, 0x73, 0x1, 0x5, 0x2}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x2, 0x6}, {0x4, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d0) r8 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r8, &(0x7f0000000200)={0xa, 0x3, 0x400, @remote, 0x9}, 0x1c) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x3c1, 0x3, 0x318, 0x168, 0x6c, 0x0, 0x0, 0x0, 0x248, 0x258, 0x258, 0x248, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00], [0x0, 0x0, 0xff], 'ipvlan0\x00', 'ip6gre0\x00', {0xff}, {}, 0x11, 0x6}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x3, 0x0, 0x5}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0xfffffffd, 'netbios-ns\x00', 'syz1\x00'}}}, {{@ipv6={@loopback, @empty, [], [0xff, 0xff], 'netdevsim0\x00', 'lo\x00', {}, {}, 0x0, 0x0, 0x0, 0x14}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x0, 0x2}, {}, 0x0, 0x7}}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0x378) sendmsg(r8, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2b10", 0xffbd}], 0x1, 0x0, 0x0, 0x2c}, 0x4) 2.05261166s ago: executing program 4 (id=3210): r0 = socket(0x1, 0xa, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001800dd8d0000000000000000020000000000000600000a0006001500010000001800168014000100800000000000000000001000000011"], 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x85}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000000)=0x100002b3, 0x4) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000080)='ip6_vti0\x00', 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, 0x0, 0x0) write$bt_hci(r6, 0x0, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f00000001c0)=ANY=[@ANYRESDEC, @ANYRES64=r6, @ANYRES8=r5, @ANYRES32=r4, @ANYRESHEX=0x0, @ANYRES8=r1, @ANYRES16=r2, @ANYRES32=r3], 0x0, 0xffffffff, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000001}, 0x94) 2.01863347s ago: executing program 0 (id=3211): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) (async) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) (async) setsockopt$inet6_int(r0, 0x29, 0x46, 0x0, 0x0) (async) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000000)={0x9, 0x0, 0x1000006, 0x692}, 0x10) (async) sendto$inet6(r2, &(0x7f0000000040)="78d6", 0x2, 0x0, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x4}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x6, 0xf001}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000140)={r3, 0x926}, &(0x7f0000000180)=0x8) (async) socket$inet_smc(0x2b, 0x1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c80000002000000ffff000005"], 0x48) (async) socket(0x10, 0x3, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x9102}) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40480, 0x0) close(r6) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0x0, 0x8397cfd36601e9d7}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x7fffffff, 0x635d, 0x5, 0xffffffff, 0x407}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd, 0x101}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40c8844}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) 647.781222ms ago: executing program 4 (id=3212): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c00000010003b15000000009100000004000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000006aff028008001cc3", @ANYRES32=r1], 0x3c}}, 0x0) 496.004327ms ago: executing program 0 (id=3213): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) sendfile(r1, r0, 0x0, 0x10000) r2 = socket(0x28, 0x5, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) setsockopt$CAN_RAW_FD_FRAMES(r3, 0x65, 0x5, &(0x7f0000000240)=0x1, 0x4) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x0) accept4$unix(r2, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0xac, 0x9, 0x6, 0x401, 0x0, 0x0, {0x0, 0x0, 0x4}, [@IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0xffff}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x21}, @IPSET_ATTR_IP_TO={0x18, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @loopback}}]}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x3}, @IPSET_ATTR_CIDR2={0x5, 0x15, 0x10}]}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffffffb}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0xfffffff7}, @IPSET_ATTR_ADT={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x20, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_NAMEREF={0x9, 0x13, 'syz1\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x8001}}]}, @IPSET_ATTR_ADT={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x7f}}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x20000095}, 0x40040) 449.790966ms ago: executing program 2 (id=3214): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000bc0)={0x1f, 0x9, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40f00, 0x11}, 0x94) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300020000000000fb070025fc0000000000000000000000000000000000000000000000000000000000000800000504000100000a006080", @ANYRES32=0x0, @ANYBLOB], 0xb8}}, 0x50) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9"], 0xb8}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000040)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x71, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[], 0x134}}, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000000000000000000ac1e000100000000000000000000000007000000000000000a0040"], 0xb8}}, 0x0) 366.192343ms ago: executing program 4 (id=3215): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010090000000000000000100000a20000000000a01080000000000000000020000000900010073797a3000000000e4000000090a010400000000000000001000000008000a40000000010900020073797a31000000000900010073797a300000000008000540000000080800034000000084200009801c0002800c00018008000140000000030c00018008000140000000040900010073797a300000000071000d"], 0x18c}}, 0x0) 354.912251ms ago: executing program 1 (id=3216): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0200000004000000080000000100040018000000", @ANYRES32=0x0, @ANYBLOB="00001300"/20, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="010000000300000000"], 0x50) 70.12746ms ago: executing program 4 (id=3217): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000b0ffffff00000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x1009, &(0x7f0000002500)=""/4105, 0x0, 0x68}, 0x94) 0s ago: executing program 2 (id=3218): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0xffffffffffffffff, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="010000000000000000000020fde8857f3354e4459ba2f7bf40e4da150000005fa6"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r6], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r9, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r10 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r10, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r10, &(0x7f0000000040)=ANY=[], 0x101d0) sendmsg$kcm(r10, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x4e20, @remote}, 0x2, 0x3, 0x1, 0x3}}, 0x80, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYRES8=r4, @ANYRESOCT=r7, @ANYRES8=r4, @ANYRESOCT=r5, @ANYRES32=r9], 0x1458}, 0x20048811) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008666dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r11 = socket$netlink(0x10, 0x3, 0x0) r12 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r12, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xd9}]}, &(0x7f0000000c40)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) getsockname$packet(r12, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x3c}}, 0x0) sendmsg$nl_route(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010001fff00000000010000", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r13], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r14) sendmsg$NLBL_CIPSOV4_C_ADD(r14, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYRESDEC=r12, @ANYRES16=r15, @ANYBLOB="0100000000000000000001000000080001000000000004000480080002000100000010000c7d0c000b8008000a00b4ed000004000880c8000c8024000900f36aad4208000a156878badf10076800d5441e0f080009002bd49f3b0c00008008000a00697100002c000b800800"], 0x250}, 0x1, 0x0, 0x0, 0x10}, 0x2000c000) kernel console output (not intermixed with test programs): try_SYSCALL_64_after_hwframe+0x77/0x7f [ 360.981818][T13613] RIP: 0033:0x7fc757f5e98e [ 360.981835][T13613] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 360.981851][T13613] RSP: 002b:00007fc758ee7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 360.981871][T13613] RAX: ffffffffffffffda RBX: 00007fc758ee86c0 RCX: 00007fc757f5e98e [ 360.981885][T13613] RDX: 000000000000000f RSI: 00007fc758ee80a0 RDI: 0000000000000004 [ 360.981896][T13613] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 360.981907][T13613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 360.981918][T13613] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 360.981957][T13613] [ 361.300698][T13623] netlink: 284 bytes leftover after parsing attributes in process `syz.2.2510'. [ 361.836372][T13638] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2515'. [ 361.954010][T13638] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2515'. [ 362.382923][T13657] batman_adv: batadv0: Adding interface: dummy0 [ 362.382963][T13657] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 362.382987][T13657] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 363.351330][T13703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2532'. [ 363.943826][T13729] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2538'. [ 363.964126][T13729] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2538'. [ 365.326783][ T59] net_ratelimit: 115 callbacks suppressed [ 365.339015][ T59] bond3: (slave dummy0): failed to get link speed/duplex [ 365.349650][ T59] bond1: (slave dummy0): failed to get link speed/duplex [ 365.349701][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 365.449613][ T59] bond3: (slave dummy0): failed to get link speed/duplex [ 365.463312][ T7247] bond1: (slave dummy0): failed to get link speed/duplex [ 365.471992][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 365.574749][ T59] bond3: (slave dummy0): failed to get link speed/duplex [ 365.581986][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 365.590962][ T59] bond1: (slave dummy0): failed to get link speed/duplex [ 365.679633][ T118] bond3: (slave dummy0): failed to get link speed/duplex [ 366.011772][T13690] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 366.263760][T13819] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2549'. [ 366.301718][T13820] FAULT_INJECTION: forcing a failure. [ 366.301718][T13820] name failslab, interval 1, probability 0, space 0, times 0 [ 366.301771][T13820] CPU: 0 UID: 0 PID: 13820 Comm: syz.3.2548 Not tainted syzkaller #0 PREEMPT(full) [ 366.301790][T13820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 366.301798][T13820] Call Trace: [ 366.301804][T13820] [ 366.301810][T13820] dump_stack_lvl+0xe8/0x150 [ 366.301837][T13820] should_fail_ex+0x410/0x560 [ 366.301866][T13820] ? __alloc_skb+0x1db/0x7a0 [ 366.301892][T13820] should_failslab+0xa8/0x100 [ 366.301953][T13820] ? __alloc_skb+0x1db/0x7a0 [ 366.301977][T13820] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 366.302005][T13820] ? __alloc_skb+0x18d/0x7a0 [ 366.302030][T13820] ? __alloc_skb+0x1db/0x7a0 [ 366.302056][T13820] __alloc_skb+0x1db/0x7a0 [ 366.302080][T13820] create_monitor_event+0x1ab/0x8a0 [ 366.302191][T13820] send_monitor_replay+0x6f/0x610 [ 366.302217][T13820] hci_sock_bind+0x7e8/0x1090 [ 366.302237][T13820] ? __pfx_aa_sk_perm+0x10/0x10 [ 366.302255][T13820] ? tomoyo_socket_bind_permission+0x14f/0x290 [ 366.302313][T13820] ? __pfx_hci_sock_bind+0x10/0x10 [ 366.302337][T13820] ? bpf_lsm_socket_bind+0x9/0x20 [ 366.302372][T13820] __sys_bind+0x2e3/0x410 [ 366.302429][T13820] ? __pfx___sys_bind+0x10/0x10 [ 366.302466][T13820] ? __pfx_ksys_write+0x10/0x10 [ 366.302498][T13820] __x64_sys_bind+0x7a/0x90 [ 366.302539][T13820] do_syscall_64+0x166/0x520 [ 366.302564][T13820] ? trace_irq_disable+0x3b/0x140 [ 366.302581][T13820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.302599][T13820] ? clear_bhb_loop+0x70/0xc0 [ 366.302621][T13820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.302638][T13820] RIP: 0033:0x7f0c49b9e159 [ 366.302655][T13820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 366.302670][T13820] RSP: 002b:00007f0c4aaa2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 366.302689][T13820] RAX: ffffffffffffffda RBX: 00007f0c49e26090 RCX: 00007f0c49b9e159 [ 366.302702][T13820] RDX: 0000000000000006 RSI: 0000200000000080 RDI: 0000000000000004 [ 366.302713][T13820] RBP: 00007f0c4aaa2090 R08: 0000000000000000 R09: 0000000000000000 [ 366.302724][T13820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.302734][T13820] R13: 00007f0c49e26128 R14: 00007f0c49e26090 R15: 00007ffd5e265ba8 [ 366.302779][T13820] [ 366.307918][T13819] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2549'. [ 366.561820][T13828] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2552'. [ 367.060133][T13816] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 367.255604][T13849] netlink: 'syz.3.2560': attribute type 21 has an invalid length. [ 367.313865][T13854] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2563'. [ 367.331794][T13855] netlink: 'syz.4.2562': attribute type 21 has an invalid length. [ 367.347950][T13854] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2563'. [ 367.641264][T13871] syzkaller0: entered promiscuous mode [ 367.641307][T13871] syzkaller0: entered allmulticast mode [ 367.697645][T13878] FAULT_INJECTION: forcing a failure. [ 367.697645][T13878] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 367.697697][T13878] CPU: 0 UID: 0 PID: 13878 Comm: syz.2.2571 Not tainted syzkaller #0 PREEMPT(full) [ 367.697717][T13878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 367.697725][T13878] Call Trace: [ 367.697731][T13878] [ 367.697737][T13878] dump_stack_lvl+0xe8/0x150 [ 367.697765][T13878] should_fail_ex+0x410/0x560 [ 367.697795][T13878] _copy_from_user+0x2d/0xb0 [ 367.697816][T13878] __sys_bpf+0x2e7/0xd90 [ 367.697872][T13878] ? __pfx___sys_bpf+0x10/0x10 [ 367.697902][T13878] ? __fget_files+0x2a/0x420 [ 367.697948][T13878] ? ksys_write+0x242/0x270 [ 367.697975][T13878] ? __pfx_ksys_write+0x10/0x10 [ 367.698004][T13878] __x64_sys_bpf+0xba/0xd0 [ 367.698025][T13878] do_syscall_64+0x166/0x520 [ 367.698050][T13878] ? trace_irq_disable+0x3b/0x140 [ 367.698066][T13878] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.698084][T13878] ? clear_bhb_loop+0x70/0xc0 [ 367.698105][T13878] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 367.698123][T13878] RIP: 0033:0x7fc757f9e159 [ 367.698140][T13878] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.698155][T13878] RSP: 002b:00007fc758ee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 367.698174][T13878] RAX: ffffffffffffffda RBX: 00007fc758225fa0 RCX: 00007fc757f9e159 [ 367.698187][T13878] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 367.698199][T13878] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 367.698210][T13878] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.698220][T13878] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 367.698248][T13878] [ 367.884037][T13879] syzkaller0: entered promiscuous mode [ 367.884058][T13879] syzkaller0: entered allmulticast mode [ 368.498403][T13903] FAULT_INJECTION: forcing a failure. [ 368.498403][T13903] name failslab, interval 1, probability 0, space 0, times 0 [ 368.498459][T13903] CPU: 0 UID: 0 PID: 13903 Comm: syz.4.2582 Not tainted syzkaller #0 PREEMPT(full) [ 368.498481][T13903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 368.498492][T13903] Call Trace: [ 368.498499][T13903] [ 368.498507][T13903] dump_stack_lvl+0xe8/0x150 [ 368.498538][T13903] should_fail_ex+0x410/0x560 [ 368.498571][T13903] should_failslab+0xa8/0x100 [ 368.498594][T13903] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 368.498623][T13903] ? check_stack_access_within_bounds+0x7db/0xb60 [ 368.498651][T13903] ? bpf_push_jmp_history+0x26c/0x6d0 [ 368.498696][T13903] ? bpf_push_jmp_history+0x26c/0x6d0 [ 368.498717][T13903] ? bpf_push_jmp_history+0x26c/0x6d0 [ 368.498737][T13903] krealloc_node_align_noprof+0x19a/0x390 [ 368.498762][T13903] bpf_push_jmp_history+0x26c/0x6d0 [ 368.498790][T13903] check_mem_access+0xf9e/0x2620 [ 368.498824][T13903] ? __pfx_check_mem_access+0x10/0x10 [ 368.498850][T13903] ? is_bpf_text_address+0x292/0x2b0 [ 368.498871][T13903] ? is_bpf_text_address+0x26/0x2b0 [ 368.498902][T13903] ? kernel_text_address+0xa5/0xe0 [ 368.498934][T13903] ? __kernel_text_address+0xd/0x30 [ 368.498957][T13903] check_store_reg+0x664/0xe20 [ 368.498993][T13903] do_check_insn+0x919/0x17d70 [ 368.499018][T13903] ? stack_depot_save_flags+0x33/0x7f0 [ 368.499051][T13903] ? kasan_save_track+0x4f/0x80 [ 368.499067][T13903] ? kasan_save_track+0x3e/0x80 [ 368.499084][T13903] ? __kasan_kmalloc+0x93/0xb0 [ 368.499101][T13903] ? __kmalloc_cache_noprof+0x321/0x600 [ 368.499127][T13903] ? do_check_common+0x352/0x5d30 [ 368.499147][T13903] ? bpf_check+0x2639/0x2e10 [ 368.499164][T13903] ? bpf_prog_load+0x14d6/0x1c20 [ 368.499182][T13903] ? __sys_bpf+0xd0d/0xd90 [ 368.499199][T13903] ? __x64_sys_bpf+0xba/0xd0 [ 368.499213][T13903] ? do_syscall_64+0x166/0x520 [ 368.499238][T13903] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.499264][T13903] ? __pfx_do_check_insn+0x10/0x10 [ 368.499316][T13903] ? rcu_is_watching+0x16/0xb0 [ 368.499346][T13903] ? __kasan_kmalloc+0x93/0xb0 [ 368.499369][T13903] ? __asan_memset+0x22/0x50 [ 368.499392][T13903] ? cnum32_from_urange+0xf/0x30 [ 368.499417][T13903] do_check_common+0x3c19/0x5d30 [ 368.499468][T13903] ? __pfx_do_check_common+0x10/0x10 [ 368.499499][T13903] bpf_check+0x2639/0x2e10 [ 368.499525][T13903] ? ktime_get_with_offset+0x93/0x2d0 [ 368.499553][T13903] ? __pfx_bpf_check+0x10/0x10 [ 368.499571][T13903] ? bpf_obj_name_cpy+0x194/0x1e0 [ 368.499596][T13903] bpf_prog_load+0x14d6/0x1c20 [ 368.499627][T13903] ? __pfx_bpf_prog_load+0x10/0x10 [ 368.499670][T13903] __sys_bpf+0xd0d/0xd90 [ 368.499696][T13903] ? __pfx___sys_bpf+0x10/0x10 [ 368.499722][T13903] ? __fget_files+0x2a/0x420 [ 368.499757][T13903] ? ksys_write+0x242/0x270 [ 368.499783][T13903] ? __pfx_ksys_write+0x10/0x10 [ 368.499813][T13903] __x64_sys_bpf+0xba/0xd0 [ 368.499831][T13903] do_syscall_64+0x166/0x520 [ 368.499853][T13903] ? trace_irq_disable+0x3b/0x140 [ 368.499868][T13903] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.499892][T13903] ? clear_bhb_loop+0x70/0xc0 [ 368.499914][T13903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 368.499930][T13903] RIP: 0033:0x7f60a799e159 [ 368.499947][T13903] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 368.499962][T13903] RSP: 002b:00007f60a88cb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 368.499981][T13903] RAX: ffffffffffffffda RBX: 00007f60a7c25fa0 RCX: 00007f60a799e159 [ 368.499994][T13903] RDX: 0000000000000094 RSI: 00002000000004c0 RDI: 0000000000000005 [ 368.500004][T13903] RBP: 00007f60a88cb090 R08: 0000000000000000 R09: 0000000000000000 [ 368.500012][T13903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 368.500020][T13903] R13: 00007f60a7c26038 R14: 00007f60a7c25fa0 R15: 00007ffc0415bd18 [ 368.500045][T13903] [ 368.985707][T13914] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2587'. [ 369.099356][T13924] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 369.477793][T13945] netlink: 564 bytes leftover after parsing attributes in process `syz.0.2597'. [ 369.553906][T13945] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input8 [ 370.330771][ T59] net_ratelimit: 114 callbacks suppressed [ 370.330827][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 370.330881][ T59] bond1: (slave dummy0): failed to get link speed/duplex [ 370.337367][ T12] bond3: (slave dummy0): failed to get link speed/duplex [ 370.439555][ T59] bond3: (slave dummy0): failed to get link speed/duplex [ 370.439651][ T59] bond1: (slave dummy0): failed to get link speed/duplex [ 370.439681][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 370.527156][T13984] A link change request failed with some changes committed already. Interface teql0 may have been left with an inconsistent configuration, please check. [ 370.642167][T13989] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2615'. [ 371.129203][T14000] netlink: 'syz.3.2617': attribute type 4 has an invalid length. [ 371.207560][T14001] netlink: 'syz.3.2617': attribute type 4 has an invalid length. [ 371.290120][ T12] bond3: (slave bridge5): failed to get link speed/duplex [ 371.290927][ T12] bond3: (slave dummy0): failed to get link speed/duplex [ 371.290964][ T12] bond1: (slave dummy0): failed to get link speed/duplex [ 371.385091][ T25] lo speed is unknown, defaulting to 1000 [ 371.385102][ T9811] lo speed is unknown, defaulting to 1000 [ 371.458624][T14015] FAULT_INJECTION: forcing a failure. [ 371.458624][T14015] name failslab, interval 1, probability 0, space 0, times 0 [ 371.458687][T14015] CPU: 1 UID: 0 PID: 14015 Comm: syz.2.2621 Not tainted syzkaller #0 PREEMPT(full) [ 371.458707][T14015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 371.458717][T14015] Call Trace: [ 371.458722][T14015] [ 371.458728][T14015] dump_stack_lvl+0xe8/0x150 [ 371.458755][T14015] should_fail_ex+0x410/0x560 [ 371.458787][T14015] should_failslab+0xa8/0x100 [ 371.458810][T14015] __kmalloc_cache_noprof+0xa3/0x600 [ 371.458837][T14015] ? alloc_pipe_info+0xe8/0x4c0 [ 371.458854][T14015] ? alloc_pipe_info+0xe8/0x4c0 [ 371.458875][T14015] alloc_pipe_info+0xe8/0x4c0 [ 371.458895][T14015] splice_direct_to_actor+0xa41/0xcb0 [ 371.458930][T14015] ? lock_acquire+0x115/0x350 [ 371.458948][T14015] ? __pfx_aa_file_perm+0x10/0x10 [ 371.458971][T14015] ? __pfx_direct_splice_actor+0x10/0x10 [ 371.458995][T14015] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 371.459028][T14015] do_splice_direct+0x195/0x290 [ 371.459054][T14015] ? __pfx_do_splice_direct+0x10/0x10 [ 371.459079][T14015] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 371.459106][T14015] ? bpf_lsm_file_permission+0x9/0x20 [ 371.459129][T14015] ? security_file_permission+0x75/0x260 [ 371.459267][T14015] ? rw_verify_area+0x203/0x4c0 [ 371.459294][T14015] do_sendfile+0x52e/0x7c0 [ 371.459322][T14015] ? __pfx_do_sendfile+0x10/0x10 [ 371.459342][T14015] ? __fget_files+0x3a2/0x420 [ 371.459373][T14015] __se_sys_sendfile64+0x144/0x1a0 [ 371.459394][T14015] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 371.459423][T14015] do_syscall_64+0x166/0x520 [ 371.459448][T14015] ? trace_irq_disable+0x3b/0x140 [ 371.459465][T14015] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.459482][T14015] ? clear_bhb_loop+0x70/0xc0 [ 371.459503][T14015] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 371.459521][T14015] RIP: 0033:0x7fc757f9e159 [ 371.459538][T14015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.459554][T14015] RSP: 002b:00007fc758ee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 371.459573][T14015] RAX: ffffffffffffffda RBX: 00007fc758225fa0 RCX: 00007fc757f9e159 [ 371.459586][T14015] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 371.459596][T14015] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 371.459607][T14015] R10: 00000000f03a0005 R11: 0000000000000246 R12: 0000000000000001 [ 371.459619][T14015] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 371.459654][T14015] [ 371.673974][T14023] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2624'. [ 371.674253][T14022] netlink: 'syz.4.2623': attribute type 1 has an invalid length. [ 371.734534][T14027] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2623'. [ 371.782346][T14022] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2623'. [ 371.783585][T14022] 8021q: adding VLAN 0 to HW filter on device bond9 [ 371.819238][T14022] bridge14: entered promiscuous mode [ 371.846083][T14022] bond9: (slave bridge14): making interface the new active one [ 371.857820][T14022] bond9: (slave bridge14): Enslaving as an active interface with an up link [ 371.867688][T14029] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 372.060509][T14033] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2626'. [ 372.485393][T14044] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2629'. [ 372.772869][T14062] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2634'. [ 372.794708][T14062] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2634'. [ 375.379613][ T118] net_ratelimit: 94 callbacks suppressed [ 375.380931][ T118] bond3: (slave bridge5): failed to get link speed/duplex [ 375.380980][ T118] bond3: (slave dummy0): failed to get link speed/duplex [ 375.429671][ T12] bond1: (slave dummy0): failed to get link speed/duplex [ 375.489789][ T118] bond3: (slave dummy0): failed to get link speed/duplex [ 375.509715][ T12] bond3: (slave bridge5): failed to get link speed/duplex [ 375.539714][ T118] bond1: (slave dummy0): failed to get link speed/duplex [ 375.560194][T14047] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 375.601477][ T12] bond3: (slave dummy0): failed to get link speed/duplex [ 375.637952][ T59] bond3: (slave bridge5): failed to get link speed/duplex [ 375.650331][ T12] bond1: (slave dummy0): failed to get link speed/duplex [ 375.710209][ T12] bond3: (slave dummy0): failed to get link speed/duplex [ 376.026204][T14120] netlink: 'syz.4.2651': attribute type 13 has an invalid length. [ 376.951372][T14167] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2668'. [ 376.951425][T14167] netlink: 'syz.2.2668': attribute type 7 has an invalid length. [ 376.951464][T14167] netlink: 'syz.2.2668': attribute type 8 has an invalid length. [ 376.951478][T14167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2668'. [ 377.039097][T14177] netlink: 'syz.2.2668': attribute type 1 has an invalid length. [ 377.039143][T14177] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2668'. [ 377.278640][T14184] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2672'. [ 377.477145][T14183] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2673'. [ 377.684200][T14248] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 377.684326][T14248] syzkaller1: linktype set to 823 [ 377.686163][T14248] Bluetooth: hci0: unsupported parameter 5135 [ 377.686181][T14248] Bluetooth: hci0: unsupported parameter 8192 [ 377.686206][T14248] Bluetooth: hci0: unsupported parameter 5135 [ 377.686217][T14248] Bluetooth: hci0: unsupported parameter 8192 [ 377.810778][T14252] bridge0: port 4(veth0) entered blocking state [ 377.810949][T14252] bridge0: port 4(veth0) entered forwarding state [ 377.811313][T14252] bridge0: port 3(vlan2) entered blocking state [ 377.811436][T14252] bridge0: port 3(vlan2) entered forwarding state [ 377.811669][T14252] bridge0: port 2(bridge_slave_1) entered blocking state [ 377.811806][T14252] bridge0: port 2(bridge_slave_1) entered forwarding state [ 377.812048][T14252] bridge0: port 1(bridge_slave_0) entered blocking state [ 377.812201][T14252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 377.921332][T14258] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2682'. [ 378.048592][T14264] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2685'. [ 378.232258][T14270] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2691'. [ 378.242453][T14270] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2691'. [ 378.251863][T14270] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2691'. [ 378.251921][T14270] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2691'. [ 378.436823][T14278] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2692'. [ 378.436872][T14278] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2692'. [ 378.616385][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.771000][T14299] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2702'. [ 378.857681][T14302] FAULT_INJECTION: forcing a failure. [ 378.857681][T14302] name failslab, interval 1, probability 0, space 0, times 0 [ 378.870755][T14302] CPU: 0 UID: 0 PID: 14302 Comm: syz.2.2705 Not tainted syzkaller #0 PREEMPT(full) [ 378.870781][T14302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 378.870792][T14302] Call Trace: [ 378.870799][T14302] [ 378.870807][T14302] dump_stack_lvl+0xe8/0x150 [ 378.870839][T14302] should_fail_ex+0x410/0x560 [ 378.870871][T14302] ? alloc_vmap_area+0x21c/0x1420 [ 378.870916][T14302] should_failslab+0xa8/0x100 [ 378.870939][T14302] ? alloc_vmap_area+0x21c/0x1420 [ 378.870960][T14302] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 378.870990][T14302] ? alloc_vmap_area+0x21c/0x1420 [ 378.871019][T14302] alloc_vmap_area+0x21c/0x1420 [ 378.871057][T14302] ? __pfx_alloc_vmap_area+0x10/0x10 [ 378.871078][T14302] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 378.871106][T14302] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 378.871133][T14302] ? __get_vm_area_node+0x155/0x2f0 [ 378.871161][T14302] __get_vm_area_node+0x200/0x2f0 [ 378.871192][T14302] __vmalloc_node_range_noprof+0x343/0x1540 [ 378.871226][T14302] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 378.871248][T14302] ? __lock_acquire+0x6df/0x2e50 [ 378.871291][T14302] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 378.871325][T14302] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 378.871344][T14302] __vmalloc_noprof+0xd2/0x120 [ 378.871369][T14302] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 378.871393][T14302] bpf_prog_alloc_no_stats+0x47/0x560 [ 378.871412][T14302] ? bpf_prog_alloc+0x2a/0x1a0 [ 378.871435][T14302] bpf_prog_alloc+0x3c/0x1a0 [ 378.871457][T14302] bpf_prog_load+0x7f8/0x1c20 [ 378.871490][T14302] ? __pfx_bpf_prog_load+0x10/0x10 [ 378.871535][T14302] __sys_bpf+0xd0d/0xd90 [ 378.871563][T14302] ? __pfx___sys_bpf+0x10/0x10 [ 378.871593][T14302] ? __fget_files+0x2a/0x420 [ 378.871634][T14302] ? ksys_write+0x242/0x270 [ 378.871662][T14302] ? __pfx_ksys_write+0x10/0x10 [ 378.871692][T14302] __x64_sys_bpf+0xba/0xd0 [ 378.871712][T14302] do_syscall_64+0x166/0x520 [ 378.871737][T14302] ? trace_irq_disable+0x3b/0x140 [ 378.871755][T14302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.871773][T14302] ? clear_bhb_loop+0x70/0xc0 [ 378.871795][T14302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 378.871814][T14302] RIP: 0033:0x7fc757f9e159 [ 378.871833][T14302] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 378.871849][T14302] RSP: 002b:00007fc758ee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 378.871869][T14302] RAX: ffffffffffffffda RBX: 00007fc758225fa0 RCX: 00007fc757f9e159 [ 378.871883][T14302] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 378.871894][T14302] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 378.871905][T14302] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 378.871919][T14302] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 378.871949][T14302] [ 379.029254][T14302] warn_alloc: 1 callbacks suppressed [ 379.029269][T14302] syz.2.2705: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 379.029328][T14302] CPU: 1 UID: 0 PID: 14302 Comm: syz.2.2705 Not tainted syzkaller #0 PREEMPT(full) [ 379.029348][T14302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 379.029358][T14302] Call Trace: [ 379.029365][T14302] [ 379.029373][T14302] dump_stack_lvl+0xe8/0x150 [ 379.029404][T14302] warn_alloc+0x24d/0x270 [ 379.029431][T14302] ? lockdep_hardirqs_on+0x7b/0x110 [ 379.029460][T14302] ? __pfx_warn_alloc+0x10/0x10 [ 379.029484][T14302] ? kfree+0x1c5/0x650 [ 379.029513][T14302] ? __get_vm_area_node+0x219/0x2f0 [ 379.029545][T14302] __vmalloc_node_range_noprof+0x36b/0x1540 [ 379.029568][T14302] ? __lock_acquire+0x6df/0x2e50 [ 379.029608][T14302] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 379.029642][T14302] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 379.029660][T14302] __vmalloc_noprof+0xd2/0x120 [ 379.029684][T14302] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 379.029714][T14302] bpf_prog_alloc_no_stats+0x47/0x560 [ 379.029733][T14302] ? bpf_prog_alloc+0x2a/0x1a0 [ 379.029754][T14302] bpf_prog_alloc+0x3c/0x1a0 [ 379.029775][T14302] bpf_prog_load+0x7f8/0x1c20 [ 379.029806][T14302] ? __pfx_bpf_prog_load+0x10/0x10 [ 379.029848][T14302] __sys_bpf+0xd0d/0xd90 [ 379.029875][T14302] ? __pfx___sys_bpf+0x10/0x10 [ 379.029905][T14302] ? __fget_files+0x2a/0x420 [ 379.029942][T14302] ? ksys_write+0x242/0x270 [ 379.029969][T14302] ? __pfx_ksys_write+0x10/0x10 [ 379.029998][T14302] __x64_sys_bpf+0xba/0xd0 [ 379.030017][T14302] do_syscall_64+0x166/0x520 [ 379.030041][T14302] ? trace_irq_disable+0x3b/0x140 [ 379.030058][T14302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.030076][T14302] ? clear_bhb_loop+0x70/0xc0 [ 379.030097][T14302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.030115][T14302] RIP: 0033:0x7fc757f9e159 [ 379.030131][T14302] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.030147][T14302] RSP: 002b:00007fc758ee8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 379.030165][T14302] RAX: ffffffffffffffda RBX: 00007fc758225fa0 RCX: 00007fc757f9e159 [ 379.030179][T14302] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 379.030190][T14302] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 379.030201][T14302] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.030212][T14302] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 379.030240][T14302] [ 379.044622][T14302] Mem-Info: [ 379.044636][T14302] active_anon:7870 inactive_anon:0 isolated_anon:0 [ 379.044636][T14302] active_file:0 inactive_file:43630 isolated_file:0 [ 379.044636][T14302] unevictable:0 dirty:120 writeback:0 [ 379.044636][T14302] slab_reclaimable:10736 slab_unreclaimable:139357 [ 379.044636][T14302] mapped:29706 shmem:520 pagetables:1239 [ 379.044636][T14302] sec_pagetables:0 bounce:0 [ 379.044636][T14302] kernel_misc_reclaimable:0 [ 379.044636][T14302] free:1242020 free_pcp:10840 free_cma:0 [ 379.044683][T14302] Node 0 active_anon:31480kB inactive_anon:0kB active_file:0kB inactive_file:174328kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118824kB dirty:480kB writeback:0kB shmem:2080kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15096kB pagetables:4820kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 379.059079][T14302] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 379.059131][T14302] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 379.059183][T14302] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 379.059215][T14302] Node 0 DMA32 free:1011804kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:31480kB inactive_anon:0kB active_file:0kB inactive_file:174328kB unevictable:0kB writepending:480kB zspages:0kB present:3129332kB managed:2546712kB mlocked:0kB bounce:0kB free_pcp:43148kB local_pcp:24076kB free_cma:0kB [ 379.059267][T14302] lowmem_reserve[]: 0 0 0 0 0 [ 379.059297][T14302] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 379.059345][T14302] lowmem_reserve[]: 0 0 0 0 0 [ 379.059374][T14302] Node 1 Normal free:3940916kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 379.059506][T14302] lowmem_reserve[]: 0 0 0 0 0 [ 379.059535][T14302] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 379.059636][T14302] Node 0 DMA32: 1225*4kB (UM) 427*8kB (UM) 293*16kB (UM) 422*32kB (UME) 315*64kB (UME) 188*128kB (UME) 68*256kB (UM) 16*512kB (UME) 10*1024kB (UM) 2*2048kB (U) 220*4096kB (UM) = 1011788kB [ 379.059801][T14302] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 379.059887][T14302] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 4*16kB (UM) 6*32kB (UM) 6*64kB (UM) 7*128kB (UM) 4*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3940916kB [ 379.060020][T14302] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 379.060035][T14302] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 379.060049][T14302] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 379.060063][T14302] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 379.060076][T14302] 44146 total pagecache pages [ 379.060083][T14302] 0 pages in swap cache [ 379.060089][T14302] Free swap = 124996kB [ 379.060095][T14302] Total swap = 124996kB [ 379.060102][T14302] 2097051 pages RAM [ 379.060108][T14302] 0 pages HighMem/MovableOnly [ 379.060115][T14302] 428757 pages reserved [ 379.060121][T14302] 0 pages cma reserved [ 379.432960][T14317] FAULT_INJECTION: forcing a failure. [ 379.432960][T14317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 379.432991][T14317] CPU: 1 UID: 0 PID: 14317 Comm: syz.4.2708 Not tainted syzkaller #0 PREEMPT(full) [ 379.433013][T14317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 379.433024][T14317] Call Trace: [ 379.433031][T14317] [ 379.433038][T14317] dump_stack_lvl+0xe8/0x150 [ 379.433069][T14317] should_fail_ex+0x410/0x560 [ 379.433111][T14317] _copy_from_iter+0x1d3/0x1660 [ 379.433139][T14317] ? __alloc_skb+0x27a/0x7a0 [ 379.433168][T14317] ? __alloc_skb+0x27a/0x7a0 [ 379.433196][T14317] ? __alloc_skb+0x27a/0x7a0 [ 379.433223][T14317] ? __pfx__copy_from_iter+0x10/0x10 [ 379.433247][T14317] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 379.433273][T14317] ? __alloc_skb+0x27a/0x7a0 [ 379.433297][T14317] ? __alloc_skb+0x27a/0x7a0 [ 379.433328][T14317] ? netlink_sendmsg+0x650/0xb40 [ 379.433350][T14317] ? skb_put+0x112/0x210 [ 379.433370][T14317] netlink_sendmsg+0x6c0/0xb40 [ 379.433400][T14317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 379.433430][T14317] ? apparmor_socket_sendmsg+0x98/0x360 [ 379.433458][T14317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 379.433479][T14317] sock_sendmsg_nosec+0x13a/0x180 [ 379.433508][T14317] ____sys_sendmsg+0x54e/0x850 [ 379.433532][T14317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 379.433560][T14317] ? import_iovec+0x73/0xa0 [ 379.433582][T14317] ___sys_sendmsg+0x2a5/0x360 [ 379.433600][T14317] ? __lock_acquire+0x6df/0x2e50 [ 379.433622][T14317] ? __pfx____sys_sendmsg+0x10/0x10 [ 379.433672][T14317] ? __fget_files+0x2a/0x420 [ 379.433694][T14317] ? __fget_files+0x3a2/0x420 [ 379.433725][T14317] __x64_sys_sendmsg+0x1b1/0x290 [ 379.433747][T14317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 379.433785][T14317] do_syscall_64+0x166/0x520 [ 379.433811][T14317] ? trace_irq_disable+0x3b/0x140 [ 379.433828][T14317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.433846][T14317] ? clear_bhb_loop+0x70/0xc0 [ 379.433868][T14317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.433886][T14317] RIP: 0033:0x7f60a799e159 [ 379.433902][T14317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.433918][T14317] RSP: 002b:00007f60a88cb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 379.433938][T14317] RAX: ffffffffffffffda RBX: 00007f60a7c25fa0 RCX: 00007f60a799e159 [ 379.433951][T14317] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 379.433963][T14317] RBP: 00007f60a88cb090 R08: 0000000000000000 R09: 0000000000000000 [ 379.433974][T14317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 379.433985][T14317] R13: 00007f60a7c26038 R14: 00007f60a7c25fa0 R15: 00007ffc0415bd18 [ 379.434014][T14317] [ 379.605472][T14320] netlink: 564 bytes leftover after parsing attributes in process `syz.3.2711'. [ 379.735694][T14320] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input9 [ 380.333098][T14352] ip6t_rpfilter: unknown options [ 380.458403][T14210] net_ratelimit: 96 callbacks suppressed [ 380.458453][T14210] bond3: (slave dummy0): failed to get link speed/duplex [ 380.458488][T14210] bond1: (slave dummy0): failed to get link speed/duplex [ 380.458513][T14210] bond3: (slave bridge5): failed to get link speed/duplex [ 380.569706][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 380.569767][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 380.569811][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 380.679844][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 380.679912][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 380.679956][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 380.769853][T14369] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input10 [ 380.790025][T14210] bond3: (slave bridge5): failed to get link speed/duplex [ 381.398917][T14389] xt_esp: unknown flags DD [ 381.595920][T14397] lo: entered allmulticast mode [ 381.691992][T14398] lo: left allmulticast mode [ 382.932491][T14210] IPVS: starting estimator thread 0... [ 383.022152][T14447] IPVS: using max 31 ests per chain, 74400 per kthread [ 383.148492][T14455] __nla_validate_parse: 10 callbacks suppressed [ 383.156615][T14455] netlink: 564 bytes leftover after parsing attributes in process `syz.0.2758'. [ 383.275212][T14455] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input11 [ 383.396228][T14462] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2762'. [ 383.424270][T14462] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2762'. [ 384.250977][T14488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2772'. [ 384.262321][T14488] tipc: Bearer : already 2 bearers with priority 10 [ 384.272612][T14488] tipc: Bearer : trying with adjusted priority [ 384.280930][T14488] tipc: Invalid UDP bearer configuration [ 384.281029][T14488] tipc: Enabling of bearer rejected, failed to enable media [ 384.333097][T14492] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2774'. [ 384.365437][T14492] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2774'. [ 384.392140][T14494] FAULT_INJECTION: forcing a failure. [ 384.392140][T14494] name failslab, interval 1, probability 0, space 0, times 0 [ 384.392195][T14494] CPU: 0 UID: 0 PID: 14494 Comm: syz.3.2775 Not tainted syzkaller #0 PREEMPT(full) [ 384.392217][T14494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 384.392227][T14494] Call Trace: [ 384.392234][T14494] [ 384.392241][T14494] dump_stack_lvl+0xe8/0x150 [ 384.392266][T14494] should_fail_ex+0x410/0x560 [ 384.392294][T14494] should_failslab+0xa8/0x100 [ 384.392316][T14494] __kmalloc_cache_noprof+0xa3/0x600 [ 384.392344][T14494] ? ip_setup_cork+0x231/0x8f0 [ 384.392466][T14494] ? ip_setup_cork+0x231/0x8f0 [ 384.392488][T14494] ? ipv4_mtu+0x561/0x670 [ 384.392540][T14494] ip_setup_cork+0x231/0x8f0 [ 384.392567][T14494] ip_make_skb+0x156/0x440 [ 384.392591][T14494] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 384.392616][T14494] ? __pfx_ip_make_skb+0x10/0x10 [ 384.392654][T14494] udp_sendmsg+0x1937/0x2140 [ 384.392768][T14494] ? __pfx_udp_sendmsg+0x10/0x10 [ 384.392804][T14494] ? ip4_datagram_release_cb+0x976/0xbe0 [ 384.392830][T14494] ? reacquire_held_locks+0x117/0x1a0 [ 384.392851][T14494] ? release_sock+0x2f/0x260 [ 384.392886][T14494] ? __local_bh_enable_ip+0xd6/0x140 [ 384.392916][T14494] ? lockdep_hardirqs_on+0x7b/0x110 [ 384.392941][T14494] ? inet_sendmsg+0x10d/0x320 [ 384.392990][T14494] ? inet_sendmsg+0x23e/0x320 [ 384.393014][T14494] ? __pfx_inet_sendmsg+0x10/0x10 [ 384.393035][T14494] sock_sendmsg_nosec+0x10e/0x180 [ 384.393061][T14494] ____sys_sendmsg+0x54e/0x850 [ 384.393084][T14494] ? __pfx_____sys_sendmsg+0x10/0x10 [ 384.393111][T14494] ? import_iovec+0x73/0xa0 [ 384.393135][T14494] ___sys_sendmsg+0x2a5/0x360 [ 384.393152][T14494] ? __lock_acquire+0x6df/0x2e50 [ 384.393174][T14494] ? __pfx____sys_sendmsg+0x10/0x10 [ 384.393223][T14494] ? __fget_files+0x2a/0x420 [ 384.393244][T14494] ? __fget_files+0x3a2/0x420 [ 384.393275][T14494] __x64_sys_sendmsg+0x1b1/0x290 [ 384.393296][T14494] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 384.393334][T14494] do_syscall_64+0x166/0x520 [ 384.393358][T14494] ? trace_irq_disable+0x3b/0x140 [ 384.393375][T14494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.393394][T14494] ? clear_bhb_loop+0x70/0xc0 [ 384.393415][T14494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 384.393433][T14494] RIP: 0033:0x7f0c49b9e159 [ 384.393449][T14494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 384.393464][T14494] RSP: 002b:00007f0c4aac3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 384.393483][T14494] RAX: ffffffffffffffda RBX: 00007f0c49e25fa0 RCX: 00007f0c49b9e159 [ 384.393496][T14494] RDX: 0000000000000000 RSI: 0000200000007940 RDI: 0000000000000005 [ 384.393507][T14494] RBP: 00007f0c4aac3090 R08: 0000000000000000 R09: 0000000000000000 [ 384.393518][T14494] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 384.393528][T14494] R13: 00007f0c49e26038 R14: 00007f0c49e25fa0 R15: 00007ffd5e265ba8 [ 384.393556][T14494] [ 384.703344][T14497] bond10: Removing last arp target with arp_interval on [ 384.835187][T14510] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2779'. [ 385.519602][T14206] net_ratelimit: 101 callbacks suppressed [ 385.519670][T14206] bond1: (slave dummy0): failed to get link speed/duplex [ 385.519756][T14206] bond3: (slave dummy0): failed to get link speed/duplex [ 385.519804][T14206] bond3: (slave bridge5): failed to get link speed/duplex [ 385.543238][T14536] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2787'. [ 385.544555][T14537] netlink: 564 bytes leftover after parsing attributes in process `syz.2.2786'. [ 385.629914][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 385.629973][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 385.630021][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 385.634870][T14537] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input12 [ 385.742048][T14206] bond1: (slave dummy0): failed to get link speed/duplex [ 385.742113][T14206] bond3: (slave dummy0): failed to get link speed/duplex [ 385.742157][T14206] bond3: (slave bridge5): failed to get link speed/duplex [ 385.844786][T14547] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2791'. [ 386.020982][T14188] bond3: (slave bridge5): failed to get link speed/duplex [ 387.145542][T14596] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 387.278993][T14601] syzkaller0: entered promiscuous mode [ 387.285037][T14601] syzkaller0: entered allmulticast mode [ 387.294732][T14601] tipc: Started in network mode [ 387.300143][T14601] tipc: Node identity 3a70ff60ac72, cluster identity 7 [ 387.307512][T14601] tipc: Enabled bearer , priority 0 [ 387.326605][T14600] tipc: Resetting bearer [ 387.397133][T14600] tipc: Disabling bearer [ 387.876767][T14619] pim6reg: entered allmulticast mode [ 387.885384][T14619] pim6reg: left allmulticast mode [ 388.140000][T14623] bond0 (unregistering): Released all slaves [ 388.223011][T14627] __nla_validate_parse: 7 callbacks suppressed [ 388.223082][T14627] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2818'. [ 388.255706][T14627] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2818'. [ 389.545210][T14648] FAULT_INJECTION: forcing a failure. [ 389.545210][T14648] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 389.559541][T14648] CPU: 0 UID: 0 PID: 14648 Comm: syz.0.2826 Not tainted syzkaller #0 PREEMPT(full) [ 389.559568][T14648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 389.559579][T14648] Call Trace: [ 389.559587][T14648] [ 389.559595][T14648] dump_stack_lvl+0xe8/0x150 [ 389.559639][T14648] should_fail_ex+0x410/0x560 [ 389.559672][T14648] prepare_alloc_pages+0x223/0x600 [ 389.559698][T14648] __alloc_frozen_pages_noprof+0x185/0x5a0 [ 389.559722][T14648] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 389.559740][T14648] ? __alloc_frozen_pages_noprof+0x29e/0x5a0 [ 389.559762][T14648] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 389.559785][T14648] ? __pfx_policy_nodemask+0x10/0x10 [ 389.559805][T14648] ? __get_vm_area_node+0x155/0x2f0 [ 389.559828][T14648] ? __vmalloc_node_range_noprof+0x343/0x1540 [ 389.559852][T14648] ? __vmalloc_noprof+0xd2/0x120 [ 389.559879][T14648] __alloc_pages_noprof+0x10/0x100 [ 389.559898][T14648] alloc_pages_bulk_noprof+0x5fa/0x7c0 [ 389.559925][T14648] ? alloc_pages_noprof+0x140/0x2b0 [ 389.559951][T14648] __kasan_populate_vmalloc+0xb7/0x1c0 [ 389.559985][T14648] alloc_vmap_area+0xd1a/0x1420 [ 389.560022][T14648] ? __pfx_alloc_vmap_area+0x10/0x10 [ 389.560044][T14648] ? __kmalloc_cache_node_noprof+0x3d1/0x620 [ 389.560073][T14648] ? __kmalloc_cache_node_noprof+0x1f7/0x620 [ 389.560100][T14648] ? __get_vm_area_node+0x155/0x2f0 [ 389.560128][T14648] __get_vm_area_node+0x200/0x2f0 [ 389.560158][T14648] __vmalloc_node_range_noprof+0x343/0x1540 [ 389.560184][T14648] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 389.560207][T14648] ? __lock_acquire+0x6df/0x2e50 [ 389.560249][T14648] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 389.560284][T14648] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 389.560303][T14648] __vmalloc_noprof+0xd2/0x120 [ 389.560327][T14648] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 389.560350][T14648] bpf_prog_alloc_no_stats+0x47/0x560 [ 389.560369][T14648] ? bpf_prog_alloc+0x2a/0x1a0 [ 389.560391][T14648] bpf_prog_alloc+0x3c/0x1a0 [ 389.560413][T14648] bpf_prog_load+0x7f8/0x1c20 [ 389.560445][T14648] ? __pfx_bpf_prog_load+0x10/0x10 [ 389.560489][T14648] __sys_bpf+0xd0d/0xd90 [ 389.560517][T14648] ? __pfx___sys_bpf+0x10/0x10 [ 389.560548][T14648] ? __fget_files+0x2a/0x420 [ 389.560589][T14648] ? ksys_write+0x242/0x270 [ 389.560616][T14648] ? __pfx_ksys_write+0x10/0x10 [ 389.560653][T14648] __x64_sys_bpf+0xba/0xd0 [ 389.560674][T14648] do_syscall_64+0x166/0x520 [ 389.560702][T14648] ? trace_irq_disable+0x3b/0x140 [ 389.560719][T14648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.560739][T14648] ? clear_bhb_loop+0x70/0xc0 [ 389.560761][T14648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.560779][T14648] RIP: 0033:0x7f253db9e159 [ 389.560797][T14648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 389.560812][T14648] RSP: 002b:00007f253eb00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 389.560833][T14648] RAX: ffffffffffffffda RBX: 00007f253de25fa0 RCX: 00007f253db9e159 [ 389.560847][T14648] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 389.560859][T14648] RBP: 00007f253eb00090 R08: 0000000000000000 R09: 0000000000000000 [ 389.560871][T14648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 389.560882][T14648] R13: 00007f253de26038 R14: 00007f253de25fa0 R15: 00007fffa20aeab8 [ 389.560912][T14648] [ 389.669760][T14648] syz.0.2826: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 389.669872][T14648] CPU: 1 UID: 0 PID: 14648 Comm: syz.0.2826 Not tainted syzkaller #0 PREEMPT(full) [ 389.669892][T14648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 389.669902][T14648] Call Trace: [ 389.669909][T14648] [ 389.669924][T14648] dump_stack_lvl+0xe8/0x150 [ 389.669955][T14648] warn_alloc+0x24d/0x270 [ 389.669984][T14648] ? lockdep_hardirqs_on+0x7b/0x110 [ 389.670012][T14648] ? __pfx_warn_alloc+0x10/0x10 [ 389.670036][T14648] ? kfree+0x1c5/0x650 [ 389.670065][T14648] ? __get_vm_area_node+0x219/0x2f0 [ 389.670096][T14648] __vmalloc_node_range_noprof+0x36b/0x1540 [ 389.670120][T14648] ? __lock_acquire+0x6df/0x2e50 [ 389.670161][T14648] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 389.670194][T14648] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 389.670212][T14648] __vmalloc_noprof+0xd2/0x120 [ 389.670236][T14648] ? bpf_prog_alloc_no_stats+0x47/0x560 [ 389.670257][T14648] bpf_prog_alloc_no_stats+0x47/0x560 [ 389.670275][T14648] ? bpf_prog_alloc+0x2a/0x1a0 [ 389.670296][T14648] bpf_prog_alloc+0x3c/0x1a0 [ 389.670316][T14648] bpf_prog_load+0x7f8/0x1c20 [ 389.670347][T14648] ? __pfx_bpf_prog_load+0x10/0x10 [ 389.670389][T14648] __sys_bpf+0xd0d/0xd90 [ 389.670414][T14648] ? __pfx___sys_bpf+0x10/0x10 [ 389.670443][T14648] ? __fget_files+0x2a/0x420 [ 389.670481][T14648] ? ksys_write+0x242/0x270 [ 389.670507][T14648] ? __pfx_ksys_write+0x10/0x10 [ 389.670535][T14648] __x64_sys_bpf+0xba/0xd0 [ 389.670554][T14648] do_syscall_64+0x166/0x520 [ 389.670578][T14648] ? trace_irq_disable+0x3b/0x140 [ 389.670595][T14648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.670612][T14648] ? clear_bhb_loop+0x70/0xc0 [ 389.670633][T14648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 389.670650][T14648] RIP: 0033:0x7f253db9e159 [ 389.670667][T14648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 389.670682][T14648] RSP: 002b:00007f253eb00028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 389.670700][T14648] RAX: ffffffffffffffda RBX: 00007f253de25fa0 RCX: 00007f253db9e159 [ 389.670713][T14648] RDX: 0000000000000094 RSI: 0000200000000880 RDI: 0000000000000005 [ 389.670725][T14648] RBP: 00007f253eb00090 R08: 0000000000000000 R09: 0000000000000000 [ 389.670734][T14648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 389.670744][T14648] R13: 00007f253de26038 R14: 00007f253de25fa0 R15: 00007fffa20aeab8 [ 389.670770][T14648] [ 389.675292][T14648] Mem-Info: [ 389.675307][T14648] active_anon:10731 inactive_anon:0 isolated_anon:0 [ 389.675307][T14648] active_file:0 inactive_file:43634 isolated_file:0 [ 389.675307][T14648] unevictable:0 dirty:263 writeback:0 [ 389.675307][T14648] slab_reclaimable:10754 slab_unreclaimable:142075 [ 389.675307][T14648] mapped:29744 shmem:3392 pagetables:1231 [ 389.675307][T14648] sec_pagetables:0 bounce:0 [ 389.675307][T14648] kernel_misc_reclaimable:0 [ 389.675307][T14648] free:1236130 free_pcp:11380 free_cma:0 [ 389.675372][T14648] Node 0 active_anon:42924kB inactive_anon:0kB active_file:0kB inactive_file:174344kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118976kB dirty:1052kB writeback:0kB shmem:13568kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15224kB pagetables:4788kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 389.675453][T14648] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 389.675519][T14648] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 389.675589][T14648] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 389.675652][T14648] Node 0 DMA32 free:988244kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:42924kB inactive_anon:0kB active_file:0kB inactive_file:174344kB unevictable:0kB writepending:1052kB zspages:0kB present:3129332kB managed:2546712kB mlocked:0kB bounce:0kB free_pcp:45520kB local_pcp:25916kB free_cma:0kB [ 389.677884][T14648] lowmem_reserve[]: 0 0 0 0 0 [ 389.677957][T14648] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 389.678042][T14648] lowmem_reserve[]: 0 0 0 0 0 [ 389.678089][T14648] Node 1 Normal free:3940916kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:192kB unevictable:0kB writepending:0kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 389.678176][T14648] lowmem_reserve[]: 0 0 0 0 0 [ 389.678222][T14648] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 389.678705][T14648] Node 0 DMA32: 735*4kB (UM) 639*8kB (UME) 11*16kB (UME) 44*32kB (UME) 225*64kB (UME) 185*128kB (UME) 72*256kB (UME) 15*512kB (UM) 9*1024kB (UM) 2*2048kB (U) 220*4096kB (UM) = 988260kB [ 389.678976][T14648] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 389.679157][T14648] Node 1 Normal: 3*4kB (UM) 5*8kB (UM) 4*16kB (UM) 6*32kB (UM) 6*64kB (UM) 7*128kB (UM) 4*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3940916kB [ 389.684971][T14648] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 389.685003][T14648] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 389.685033][T14648] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 389.685063][T14648] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 389.685093][T14648] 47022 total pagecache pages [ 389.685100][T14648] 0 pages in swap cache [ 389.685122][T14648] Free swap = 124996kB [ 389.685128][T14648] Total swap = 124996kB [ 389.685136][T14648] 2097051 pages RAM [ 389.685157][T14648] 0 pages HighMem/MovableOnly [ 389.685164][T14648] 428757 pages reserved [ 389.685170][T14648] 0 pages cma reserved [ 390.212019][T14658] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2827'. [ 390.616367][T14652] syzkaller0: entered promiscuous mode [ 390.622131][T14652] syzkaller0: entered allmulticast mode [ 390.695929][T14664] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2829'. [ 390.707113][T14199] net_ratelimit: 96 callbacks suppressed [ 390.715018][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 390.715548][T14210] bond3: (slave dummy0): failed to get link speed/duplex [ 390.719619][T14210] bond1: (slave dummy0): failed to get link speed/duplex [ 390.777535][T14666] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2830'. [ 392.942792][T14672] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2829'. [ 392.944232][T14188] bond3: (slave bridge5): failed to get link speed/duplex [ 392.944332][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 392.944432][ T118] bond1: (slave dummy0): failed to get link speed/duplex [ 393.190888][T14201] bond1: (slave dummy0): failed to get link speed/duplex [ 393.190943][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 393.190987][T14201] bond3: (slave bridge5): failed to get link speed/duplex [ 393.221797][T14687] openvswitch: netlink: Unknown key attributes 1 [ 393.277036][T14687] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2834'. [ 393.373863][T14687] netlink: 176 bytes leftover after parsing attributes in process `syz.2.2834'. [ 393.600731][T14698] syzkaller0: entered promiscuous mode [ 393.600826][T14698] syzkaller0: entered allmulticast mode [ 393.754971][T14707] netlink: 156 bytes leftover after parsing attributes in process `syz.3.2842'. [ 394.107899][T14690] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 394.165921][T14712] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2844'. [ 394.813382][T14719] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2847'. [ 394.933853][T14723] netlink: 4912 bytes leftover after parsing attributes in process `syz.3.2845'. [ 395.616250][T14741] FAULT_INJECTION: forcing a failure. [ 395.616250][T14741] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 395.629721][T14741] CPU: 0 UID: 0 PID: 14741 Comm: syz.1.2857 Not tainted syzkaller #0 PREEMPT(full) [ 395.629749][T14741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 395.629759][T14741] Call Trace: [ 395.629767][T14741] [ 395.629775][T14741] dump_stack_lvl+0xe8/0x150 [ 395.629806][T14741] should_fail_ex+0x410/0x560 [ 395.629837][T14741] _copy_to_user+0x31/0xb0 [ 395.629861][T14741] simple_read_from_buffer+0xe1/0x170 [ 395.629890][T14741] proc_fail_nth_read+0x1bb/0x230 [ 395.629917][T14741] ? common_file_perm+0x20e/0x2b0 [ 395.629944][T14741] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 395.629973][T14741] ? rw_verify_area+0x24a/0x4c0 [ 395.630000][T14741] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 395.630025][T14741] vfs_read+0x213/0xa80 [ 395.630057][T14741] ? __pfx_vfs_read+0x10/0x10 [ 395.630088][T14741] ? __get_user_nocheck_8+0x20/0x20 [ 395.630117][T14741] ? ppp_ioctl+0x166f/0x1c00 [ 395.630280][T14741] ksys_read+0x150/0x270 [ 395.630308][T14741] ? __pfx_ksys_read+0x10/0x10 [ 395.630342][T14741] do_syscall_64+0x166/0x520 [ 395.630368][T14741] ? trace_irq_disable+0x3b/0x140 [ 395.630386][T14741] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.630405][T14741] ? clear_bhb_loop+0x70/0xc0 [ 395.630427][T14741] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.630445][T14741] RIP: 0033:0x7fdac3d5e98e [ 395.630463][T14741] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 395.630478][T14741] RSP: 002b:00007fdac4d0dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 395.630498][T14741] RAX: ffffffffffffffda RBX: 00007fdac4d0e6c0 RCX: 00007fdac3d5e98e [ 395.630512][T14741] RDX: 000000000000000f RSI: 00007fdac4d0e0a0 RDI: 0000000000000006 [ 395.630523][T14741] RBP: 00007fdac4d0e090 R08: 0000000000000000 R09: 0000000000000000 [ 395.630534][T14741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 395.630545][T14741] R13: 00007fdac4026038 R14: 00007fdac4025fa0 R15: 00007ffcc539f2c8 [ 395.630574][T14741] [ 395.712623][T14199] net_ratelimit: 44 callbacks suppressed [ 395.712658][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 395.740441][T14201] bond3: (slave bridge5): failed to get link speed/duplex [ 395.742049][T14201] bond1: (slave dummy0): failed to get link speed/duplex [ 395.821067][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 395.849901][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 395.851497][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 395.931918][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 395.959704][T14210] bond3: (slave bridge5): failed to get link speed/duplex [ 395.961447][T14210] bond1: (slave dummy0): failed to get link speed/duplex [ 396.042319][ T118] bond3: (slave dummy0): failed to get link speed/duplex [ 396.177120][ T5619] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 396.184661][ T5619] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 396.191999][ T5619] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 396.201181][ T5619] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 396.209210][ T5619] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 396.404205][T14759] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2863'. [ 396.828665][T14747] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 396.878798][T14748] syzkaller0: Number of in use tx queues changed invalidating tc mappings. Priority traffic classification disabled! [ 397.120147][T14753] lo speed is unknown, defaulting to 1000 [ 397.413371][T14787] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2870'. [ 397.503722][T14791] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2869'. [ 398.290329][ T4931] Bluetooth: hci5: command tx timeout [ 398.324067][T14805] lo speed is unknown, defaulting to 1000 [ 398.470674][T14817] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2881'. [ 399.069947][T14753] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.070067][T14753] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.070241][T14753] bridge_slave_0: entered allmulticast mode [ 399.082650][T14842] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2886'. [ 399.112866][T14753] bridge_slave_0: entered promiscuous mode [ 399.150418][T14753] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.150692][T14753] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.150991][T14753] bridge_slave_1: entered allmulticast mode [ 399.169041][T14753] bridge_slave_1: entered promiscuous mode [ 399.183281][T14842] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2886'. [ 399.207160][T14842] netlink: 76 bytes leftover after parsing attributes in process `syz.4.2886'. [ 399.217692][T14842] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2886'. [ 399.392615][T14753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.406943][T14753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.501899][T14753] team0: Port device team_slave_0 added [ 399.517807][T14753] team0: Port device team_slave_1 added [ 399.702482][T14753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.702550][T14753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.702585][T14753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.746492][T14858] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2891'. [ 399.811623][T14753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.811644][T14753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.811695][T14753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 400.006146][T14856] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2893'. [ 400.039353][T14864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2894'. [ 400.117601][T14753] hsr_slave_0: entered promiscuous mode [ 400.128179][T14753] hsr_slave_1: entered promiscuous mode [ 400.138269][T14753] debugfs: 'hsr0' already exists in 'hsr' [ 400.138317][T14753] Cannot create hsr debugfs directory [ 400.374938][ T4931] Bluetooth: hci5: command tx timeout [ 400.510826][T14881] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2899'. [ 400.729578][T14206] net_ratelimit: 50 callbacks suppressed [ 400.729626][T14206] bond1: (slave dummy0): failed to get link speed/duplex [ 400.771047][T14210] bond3: (slave dummy0): failed to get link speed/duplex [ 400.771527][T14206] bond3: (slave bridge5): failed to get link speed/duplex [ 400.872122][T14893] netlink: 'syz.3.2907': attribute type 21 has an invalid length. [ 401.379531][T14201] bond3: (slave bridge5): failed to get link speed/duplex [ 401.379592][T14201] bond1: (slave dummy0): failed to get link speed/duplex [ 401.379651][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 401.760526][T14206] bond3: (slave dummy0): failed to get link speed/duplex [ 401.767743][T14206] bond1: (slave dummy0): failed to get link speed/duplex [ 401.775224][T14206] bond3: (slave bridge5): failed to get link speed/duplex [ 401.890180][T14210] bond3: (slave dummy0): failed to get link speed/duplex [ 401.982436][T14753] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 402.026729][T14922] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2920'. [ 402.037184][T14753] team0: Port device netdevsim1 removed [ 402.450950][ T4931] Bluetooth: hci5: command tx timeout [ 402.548048][T14942] FAULT_INJECTION: forcing a failure. [ 402.548048][T14942] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 402.564723][T14942] CPU: 0 UID: 0 PID: 14942 Comm: syz.2.2926 Not tainted syzkaller #0 PREEMPT(full) [ 402.564749][T14942] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 402.564761][T14942] Call Trace: [ 402.564769][T14942] [ 402.564777][T14942] dump_stack_lvl+0xe8/0x150 [ 402.564809][T14942] should_fail_ex+0x410/0x560 [ 402.564842][T14942] _copy_to_user+0x31/0xb0 [ 402.564864][T14942] simple_read_from_buffer+0xe1/0x170 [ 402.564894][T14942] proc_fail_nth_read+0x1bb/0x230 [ 402.564920][T14942] ? common_file_perm+0x20e/0x2b0 [ 402.564942][T14942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 402.564972][T14942] ? rw_verify_area+0x24a/0x4c0 [ 402.564997][T14942] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 402.565032][T14942] vfs_read+0x213/0xa80 [ 402.565056][T14942] ? __pfx_aa_sk_perm+0x10/0x10 [ 402.565076][T14942] ? __pfx_hci_sock_bind+0x10/0x10 [ 402.565100][T14942] ? __pfx_vfs_read+0x10/0x10 [ 402.565125][T14942] ? bpf_lsm_socket_bind+0x9/0x20 [ 402.565150][T14942] ? __sys_bind+0x306/0x410 [ 402.565179][T14942] ? __pfx___sys_bind+0x10/0x10 [ 402.565210][T14942] ksys_read+0x150/0x270 [ 402.565237][T14942] ? __pfx_ksys_read+0x10/0x10 [ 402.565272][T14942] do_syscall_64+0x166/0x520 [ 402.565299][T14942] ? trace_irq_disable+0x3b/0x140 [ 402.565316][T14942] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.565334][T14942] ? clear_bhb_loop+0x70/0xc0 [ 402.565356][T14942] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 402.565375][T14942] RIP: 0033:0x7fc757f5e98e [ 402.565392][T14942] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 402.565407][T14942] RSP: 002b:00007fc758ee7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 402.565427][T14942] RAX: ffffffffffffffda RBX: 00007fc758ee86c0 RCX: 00007fc757f5e98e [ 402.565440][T14942] RDX: 000000000000000f RSI: 00007fc758ee80a0 RDI: 0000000000000003 [ 402.565451][T14942] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 402.565462][T14942] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 402.565473][T14942] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 402.565502][T14942] [ 402.620166][T14943] netlink: 'syz.4.2925': attribute type 1 has an invalid length. [ 402.984912][T14753] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 403.283736][T14753] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 403.321520][T14753] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 403.408421][T14753] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 403.454669][T14753] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 403.507356][T14753] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 403.632411][T14967] __nla_validate_parse: 3 callbacks suppressed [ 403.634825][T14967] netlink: 564 bytes leftover after parsing attributes in process `syz.0.2931'. [ 403.635093][T14753] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 403.682964][T14753] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 403.810096][T14967] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input13 [ 403.844284][T14958] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2930'. [ 404.061200][T14981] ip6t_rpfilter: unknown options [ 404.418331][T14753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 404.513264][T14753] 8021q: adding VLAN 0 to HW filter on device team0 [ 404.547811][ T4931] Bluetooth: hci5: command tx timeout [ 404.569696][T14206] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.569813][T14206] bridge0: port 1(bridge_slave_0) entered forwarding state [ 404.625229][T14206] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.625351][T14206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 405.770319][ T13] net_ratelimit: 37 callbacks suppressed [ 405.770388][ T13] bond3: (slave dummy0): failed to get link speed/duplex [ 405.770484][ T13] bond1: (slave dummy0): failed to get link speed/duplex [ 405.770551][ T13] bond3: (slave bridge5): failed to get link speed/duplex [ 405.881336][ T13] bond3: (slave bridge5): failed to get link speed/duplex [ 405.881471][ T13] bond1: (slave dummy0): failed to get link speed/duplex [ 405.882191][ T13] bond3: (slave dummy0): failed to get link speed/duplex [ 405.924568][T15013] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2948'. [ 405.990380][ T985] bond3: (slave bridge5): failed to get link speed/duplex [ 405.990471][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 406.010157][ T13] bond1: (slave dummy0): failed to get link speed/duplex [ 406.099673][T14201] bond3: (slave bridge5): failed to get link speed/duplex [ 406.162180][T15019] netlink: 564 bytes leftover after parsing attributes in process `syz.3.2949'. [ 406.172178][T15021] bond0: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 406.191614][T15021] bond0 (unregistering): Released all slaves [ 406.205014][T15023] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2951'. [ 406.349197][T15019] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input14 [ 406.396535][T15023] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2951'. [ 406.418959][T15027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2952'. [ 407.621761][T14753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 407.786145][T14753] veth0_vlan: entered promiscuous mode [ 407.828413][T14753] veth1_vlan: entered promiscuous mode [ 408.012301][T15079] ipvlan2: entered promiscuous mode [ 408.031509][T15079] team0: Device ipvlan2 failed to register rx_handler [ 408.100474][T14753] veth0_macvtap: entered promiscuous mode [ 408.115277][T14753] veth1_macvtap: entered promiscuous mode [ 408.127043][T15073] raw_sendmsg: syz.4.2967 forgot to set AF_INET. Fix it! [ 408.165077][T14753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 408.213665][T14753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 408.275587][ T118] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.275656][ T118] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.275688][ T118] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.301562][ T985] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.506086][T15090] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2972'. [ 408.517078][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 408.517113][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 408.658712][T15092] FAULT_INJECTION: forcing a failure. [ 408.658712][T15092] name failslab, interval 1, probability 0, space 0, times 0 [ 408.658780][T15092] CPU: 0 UID: 0 PID: 15092 Comm: syz.3.2973 Not tainted syzkaller #0 PREEMPT(full) [ 408.658802][T15092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 408.658813][T15092] Call Trace: [ 408.658820][T15092] [ 408.658827][T15092] dump_stack_lvl+0xe8/0x150 [ 408.658858][T15092] should_fail_ex+0x410/0x560 [ 408.658883][T15092] should_failslab+0xa8/0x100 [ 408.658903][T15092] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 408.658932][T15092] ? bpf_push_jmp_history+0x26c/0x6d0 [ 408.658949][T15092] ? bpf_push_jmp_history+0x26c/0x6d0 [ 408.658970][T15092] ? bpf_push_jmp_history+0x26c/0x6d0 [ 408.658987][T15092] krealloc_node_align_noprof+0x19a/0x390 [ 408.659006][T15092] ? __kasan_kmalloc+0x93/0xb0 [ 408.659027][T15092] bpf_push_jmp_history+0x26c/0x6d0 [ 408.659052][T15092] do_check_common+0x2a0a/0x5d30 [ 408.659105][T15092] ? __pfx_do_check_common+0x10/0x10 [ 408.659138][T15092] bpf_check+0x2639/0x2e10 [ 408.659166][T15092] ? ktime_get_with_offset+0x93/0x2d0 [ 408.659188][T15092] ? __pfx_bpf_check+0x10/0x10 [ 408.659209][T15092] ? bpf_obj_name_cpy+0x194/0x1e0 [ 408.659236][T15092] bpf_prog_load+0x14d6/0x1c20 [ 408.659267][T15092] ? __pfx_bpf_prog_load+0x10/0x10 [ 408.659308][T15092] __sys_bpf+0xd0d/0xd90 [ 408.659334][T15092] ? __pfx___sys_bpf+0x10/0x10 [ 408.659362][T15092] ? __fget_files+0x2a/0x420 [ 408.659400][T15092] ? ksys_write+0x242/0x270 [ 408.659425][T15092] ? __pfx_ksys_write+0x10/0x10 [ 408.659454][T15092] __x64_sys_bpf+0xba/0xd0 [ 408.659473][T15092] do_syscall_64+0x166/0x520 [ 408.659498][T15092] ? trace_irq_disable+0x3b/0x140 [ 408.659514][T15092] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.659532][T15092] ? clear_bhb_loop+0x70/0xc0 [ 408.659553][T15092] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 408.659578][T15092] RIP: 0033:0x7f0c49b9e159 [ 408.659596][T15092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 408.659611][T15092] RSP: 002b:00007f0c4aac3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 408.659631][T15092] RAX: ffffffffffffffda RBX: 00007f0c49e25fa0 RCX: 00007f0c49b9e159 [ 408.659644][T15092] RDX: 0000000000000094 RSI: 00002000000004c0 RDI: 0000000000000005 [ 408.659656][T15092] RBP: 00007f0c4aac3090 R08: 0000000000000000 R09: 0000000000000000 [ 408.659667][T15092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 408.659677][T15092] R13: 00007f0c49e26038 R14: 00007f0c49e25fa0 R15: 00007ffd5e265ba8 [ 408.659706][T15092] [ 408.938848][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 408.938886][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.115884][T15102] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2976'. [ 409.132403][T15104] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2862'. [ 409.170206][T15104] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2862'. [ 409.265952][T15108] xt_connbytes: Forcing CT accounting to be enabled [ 409.851696][T15125] sctp: [Deprecated]: syz.1.2985 (pid 15125) Use of struct sctp_assoc_value in delayed_ack socket option. [ 409.851696][T15125] Use struct sctp_sack_info instead [ 410.096145][ T5619] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 410.107671][ T5619] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 410.115583][ T5619] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 410.128014][ T5619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 410.136659][ T5619] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 410.781485][T15141] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2990'. [ 410.795256][T15141] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2990'. [ 410.819725][ T118] net_ratelimit: 83 callbacks suppressed [ 410.819769][ T118] bond3: (slave bridge5): failed to get link speed/duplex [ 410.819814][ T118] bond1: (slave dummy0): failed to get link speed/duplex [ 410.842284][ T985] bond3: (slave dummy0): failed to get link speed/duplex [ 410.930581][T14199] bond3: (slave bridge5): failed to get link speed/duplex [ 410.937847][ T985] bond1: (slave dummy0): failed to get link speed/duplex [ 410.960810][ T985] bond3: (slave dummy0): failed to get link speed/duplex [ 411.040728][ T118] bond3: (slave bridge5): failed to get link speed/duplex [ 411.050839][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 411.073419][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 411.155816][T14206] bond3: (slave bridge5): failed to get link speed/duplex [ 411.204693][T15126] lo speed is unknown, defaulting to 1000 [ 411.590450][T15168] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2994'. [ 411.702038][T15156] netlink: 'syz.1.2992': attribute type 21 has an invalid length. [ 412.209857][ T4931] Bluetooth: hci0: command tx timeout [ 412.214875][T15181] netlink: 564 bytes leftover after parsing attributes in process `syz.3.2999'. [ 412.350080][T15186] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3000'. [ 412.353127][T15181] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input15 [ 412.373483][T15186] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3000'. [ 412.407861][T15188] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3000'. [ 412.451270][T14199] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 412.453978][T14206] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 412.454082][T14206] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 412.454153][T14206] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 412.960889][T15126] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.968803][T15126] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.969286][T15126] bridge_slave_0: entered allmulticast mode [ 412.987320][T15126] bridge_slave_0: entered promiscuous mode [ 413.001604][T15126] bridge0: port 2(bridge_slave_1) entered blocking state [ 413.009697][T15126] bridge0: port 2(bridge_slave_1) entered disabled state [ 413.017032][T15126] bridge_slave_1: entered allmulticast mode [ 413.027828][T15126] bridge_slave_1: entered promiscuous mode [ 413.083079][T15126] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 413.096644][T15126] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 413.137139][T15126] team0: Port device team_slave_0 added [ 413.146148][T15126] team0: Port device team_slave_1 added [ 413.185948][T15126] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 413.193374][T15126] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.219685][T15126] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 413.232889][T15126] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 413.240036][T15126] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.266490][T15126] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 413.392513][T15126] hsr_slave_0: entered promiscuous mode [ 413.394477][T15126] hsr_slave_1: entered promiscuous mode [ 413.395697][T15126] debugfs: 'hsr0' already exists in 'hsr' [ 413.395731][T15126] Cannot create hsr debugfs directory [ 414.289894][ T4931] Bluetooth: hci0: command tx timeout [ 414.504428][T15211] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 415.322448][T15189] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 415.351063][T15126] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 415.398086][T15126] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 415.407613][T15126] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 415.443358][T15126] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 415.451481][T15126] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 415.527709][T15126] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 415.538403][T15126] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 415.567362][T15126] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 415.635000][T15224] __nla_validate_parse: 3 callbacks suppressed [ 415.635054][T15224] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3008'. [ 415.829256][T15232] dvmrp8: entered allmulticast mode [ 415.932130][T14206] net_ratelimit: 71 callbacks suppressed [ 415.932195][T14206] bond1: (slave dummy0): failed to get link speed/duplex [ 415.935684][T14210] bond3: (slave bridge5): failed to get link speed/duplex [ 415.967401][T15238] syzkaller1: entered allmulticast mode [ 416.081025][T14201] bond3: (slave dummy0): failed to get link speed/duplex [ 416.081155][T14201] bond1: (slave dummy0): failed to get link speed/duplex [ 416.081845][T14201] bond3: (slave bridge5): failed to get link speed/duplex [ 416.190934][ T118] bond3: (slave bridge5): failed to get link speed/duplex [ 416.199001][T14199] bond1: (slave dummy0): failed to get link speed/duplex [ 416.229737][T14199] bond3: (slave dummy0): failed to get link speed/duplex [ 416.280692][T15126] 8021q: adding VLAN 0 to HW filter on device bond0 [ 416.318477][T15251] xt_NFQUEUE: number of total queues is 0 [ 416.350452][ T118] bond1: (slave dummy0): failed to get link speed/duplex [ 416.370005][ T4931] Bluetooth: hci0: command 0x040f tx timeout [ 416.384129][T15126] 8021q: adding VLAN 0 to HW filter on device team0 [ 416.439187][ T118] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.440485][ T118] bridge0: port 1(bridge_slave_0) entered forwarding state [ 416.480308][T14201] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.480505][T14201] bridge0: port 2(bridge_slave_1) entered forwarding state [ 416.525182][ T118] bond1: (slave dummy0): failed to get link speed/duplex [ 416.548630][T15254] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3014'. [ 416.548680][T15254] netlink: 'syz.1.3014': attribute type 5 has an invalid length. [ 416.548710][T15254] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3014'. [ 416.591717][T15257] lo speed is unknown, defaulting to 1000 [ 417.209114][T15270] netlink: 564 bytes leftover after parsing attributes in process `syz.2.3018'. [ 417.236318][T15271] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3019'. [ 417.257427][T15271] macsec0: entered promiscuous mode [ 417.316875][T15270] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input16 [ 417.327361][T15271] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3019'. [ 417.357240][T15271] veth1_macvtap: left promiscuous mode [ 417.497433][T15271] macsec0 (unregistering): left promiscuous mode [ 418.396285][T15292] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 418.452747][ T5619] Bluetooth: hci0: command 0x040f tx timeout [ 418.764612][T15309] netlink: 564 bytes leftover after parsing attributes in process `syz.2.3029'. [ 418.832768][T15310] lo speed is unknown, defaulting to 1000 [ 418.955553][T15309] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input17 [ 419.058255][T15313] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3030'. [ 419.141777][T15314] lo speed is unknown, defaulting to 1000 [ 419.150844][T15321] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 419.171571][T15321] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 419.171646][T15321] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 419.334965][T15126] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 419.346385][T15321] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 419.763453][T15126] veth0_vlan: entered promiscuous mode [ 419.801428][T15126] veth1_vlan: entered promiscuous mode [ 419.891255][T15126] veth0_macvtap: entered promiscuous mode [ 419.913118][T15126] veth1_macvtap: entered promiscuous mode [ 419.979697][T15126] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 420.023147][T15126] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 420.091143][T14232] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.102567][T14232] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.215542][T14232] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.234505][T15328] netlink: 'syz.2.3033': attribute type 21 has an invalid length. [ 420.244785][T15328] FAULT_INJECTION: forcing a failure. [ 420.244785][T15328] name failslab, interval 1, probability 0, space 0, times 0 [ 420.244864][T15328] CPU: 0 UID: 0 PID: 15328 Comm: syz.2.3033 Not tainted syzkaller #0 PREEMPT(full) [ 420.244886][T15328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 420.244901][T15328] Call Trace: [ 420.244912][T15328] [ 420.244920][T15328] dump_stack_lvl+0xe8/0x150 [ 420.244950][T15328] should_fail_ex+0x410/0x560 [ 420.244983][T15328] should_failslab+0xa8/0x100 [ 420.245006][T15328] __kmalloc_cache_noprof+0xa3/0x600 [ 420.245034][T15328] ? ip_fib_metrics_init+0xbe/0x6f0 [ 420.245121][T15328] ? ip_fib_metrics_init+0xbe/0x6f0 [ 420.245143][T15328] ip_fib_metrics_init+0xbe/0x6f0 [ 420.245159][T15328] ? trace_kmalloc+0x2a/0xf0 [ 420.245180][T15328] ? __pfx_ip_fib_metrics_init+0x10/0x10 [ 420.245192][T15328] ? __kmalloc_noprof+0x1ab/0x720 [ 420.245209][T15328] ? fib6_info_alloc+0x30/0xf0 [ 420.245272][T15328] ? fib6_info_alloc+0x30/0xf0 [ 420.245299][T15328] ? __asan_memset+0x22/0x50 [ 420.245322][T15328] ip6_route_info_create+0x19e/0x890 [ 420.245382][T15328] ip6_route_add+0x49/0x1b0 [ 420.245406][T15328] inet6_rtm_newroute+0x267/0x1a30 [ 420.245434][T15328] ? kasan_quarantine_put+0xbb/0x1f0 [ 420.245455][T15328] ? lockdep_hardirqs_on+0x7b/0x110 [ 420.245480][T15328] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 420.245499][T15328] ? nlmon_xmit+0xb0/0x100 [ 420.245584][T15328] ? kmem_cache_free+0x182/0x650 [ 420.245608][T15328] ? __lock_acquire+0x6df/0x2e50 [ 420.245629][T15328] ? __dev_queue_xmit+0x29b/0x3820 [ 420.245703][T15328] ? __local_bh_enable_ip+0xd6/0x140 [ 420.245724][T15328] ? lockdep_hardirqs_on+0x7b/0x110 [ 420.245769][T15328] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 420.245789][T15328] rtnetlink_rcv_msg+0x802/0xc00 [ 420.245878][T15328] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 420.245896][T15328] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 420.245914][T15328] ? ref_tracker_free+0x689/0x830 [ 420.245961][T15328] ? __pfx_ref_tracker_free+0x10/0x10 [ 420.245986][T15328] netlink_rcv_skb+0x226/0x4a0 [ 420.246004][T15328] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 420.246028][T15328] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 420.246057][T15328] ? netlink_deliver_tap+0x2e/0x1b0 [ 420.246075][T15328] ? netlink_deliver_tap+0x2e/0x1b0 [ 420.246098][T15328] netlink_unicast+0x7bd/0x940 [ 420.246124][T15328] netlink_sendmsg+0x813/0xb40 [ 420.246150][T15328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 420.246175][T15328] ? apparmor_socket_sendmsg+0x98/0x360 [ 420.246203][T15328] ? __pfx_netlink_sendmsg+0x10/0x10 [ 420.246224][T15328] sock_sendmsg_nosec+0x13a/0x180 [ 420.246252][T15328] ____sys_sendmsg+0x54e/0x850 [ 420.246290][T15328] ? __pfx_____sys_sendmsg+0x10/0x10 [ 420.246319][T15328] ? import_iovec+0x73/0xa0 [ 420.246341][T15328] ___sys_sendmsg+0x2a5/0x360 [ 420.246359][T15328] ? __lock_acquire+0x6df/0x2e50 [ 420.246380][T15328] ? __pfx____sys_sendmsg+0x10/0x10 [ 420.246429][T15328] ? __fget_files+0x2a/0x420 [ 420.246451][T15328] ? __fget_files+0x3a2/0x420 [ 420.246483][T15328] __x64_sys_sendmsg+0x1b1/0x290 [ 420.246506][T15328] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 420.246541][T15328] do_syscall_64+0x166/0x520 [ 420.246563][T15328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.246580][T15328] ? clear_bhb_loop+0x70/0xc0 [ 420.246599][T15328] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 420.246615][T15328] RIP: 0033:0x7fc757f9e159 [ 420.246631][T15328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 420.246645][T15328] RSP: 002b:00007fc758ee8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 420.246663][T15328] RAX: ffffffffffffffda RBX: 00007fc758225fa0 RCX: 00007fc757f9e159 [ 420.246676][T15328] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 420.246685][T15328] RBP: 00007fc758ee8090 R08: 0000000000000000 R09: 0000000000000000 [ 420.246696][T15328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 420.246706][T15328] R13: 00007fc758226038 R14: 00007fc758225fa0 R15: 00007ffee8566fa8 [ 420.246731][T15328] [ 420.439757][T14232] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.530522][ T5619] Bluetooth: hci0: command 0x040f tx timeout [ 420.898422][T14233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 420.898516][T14233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.345845][T14232] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 421.345877][T14232] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 421.368825][T14234] net_ratelimit: 69 callbacks suppressed [ 421.368990][T14234] bond1: (slave dummy0): failed to get link speed/duplex [ 421.369081][T14234] bond3: (slave dummy0): failed to get link speed/duplex [ 421.369142][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 421.474111][T14238] bond3: (slave bridge5): failed to get link speed/duplex [ 421.491396][T14197] bond1: (slave dummy0): failed to get link speed/duplex [ 421.511491][T14197] bond3: (slave dummy0): failed to get link speed/duplex [ 421.701018][T14189] bond1: (slave dummy0): failed to get link speed/duplex [ 421.701077][T14189] bond3: (slave dummy0): failed to get link speed/duplex [ 421.717104][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 421.811790][T14197] bond3: (slave dummy0): failed to get link speed/duplex [ 422.126394][T15356] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3041'. [ 422.303667][T15361] netlink: 452 bytes leftover after parsing attributes in process `syz.3.3044'. [ 422.402368][T15358] syzkaller0: entered promiscuous mode [ 422.412094][T15358] syzkaller0: entered allmulticast mode [ 422.450909][T15358] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3042'. [ 422.558229][T15369] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input18 [ 422.881286][ T4931] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 422.888917][ T4931] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 422.897861][ T4931] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 422.914332][ T4931] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 422.925059][ T4931] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 423.305812][T15375] lo speed is unknown, defaulting to 1000 [ 423.605297][T14197] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.619020][T14197] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 423.705487][T15391] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3050'. [ 423.739080][T15396] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3051'. [ 423.754830][T15394] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3050'. [ 423.766004][T15395] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3051'. [ 423.937846][T14197] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 423.937973][T14197] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.195022][T14197] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.195144][T14197] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.381469][T15407] batadv0: entered promiscuous mode [ 424.393821][T15407] macvtap1: entered promiscuous mode [ 424.400935][T15407] macvtap1: entered allmulticast mode [ 424.407029][T15407] batadv0: entered allmulticast mode [ 424.417275][T15407] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 424.434398][T15407] batadv0: left allmulticast mode [ 424.434614][T15407] batadv0: left promiscuous mode [ 424.589063][T14197] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 424.589193][T14197] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.699928][T15417] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3056'. [ 424.722306][T15376] lo speed is unknown, defaulting to 1000 [ 424.801905][T15420] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3057'. [ 425.009783][ T5619] Bluetooth: hci3: command tx timeout [ 425.092971][T15426] netlink: 564 bytes leftover after parsing attributes in process `syz.4.3059'. [ 425.257486][T15426] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input19 [ 425.688742][T14197] vlan2: left promiscuous mode [ 425.714195][T14197] bridge0: port 4(vlan2) entered disabled state [ 425.738434][T14197] bridge_slave_1: left allmulticast mode [ 425.755988][T14197] bridge_slave_1: left promiscuous mode [ 425.756231][T14197] bridge0: port 2(bridge_slave_1) entered disabled state [ 425.809798][T14197] bridge_slave_0: left promiscuous mode [ 425.815869][T14197] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.069608][T15446] sctp: [Deprecated]: syz.3.3062 (pid 15446) Use of struct sctp_assoc_value in delayed_ack socket option. [ 426.069608][T15446] Use struct sctp_sack_info instead [ 426.232692][T14197] dvmrp8: left allmulticast mode [ 426.678447][T15462] FAULT_INJECTION: forcing a failure. [ 426.678447][T15462] name failslab, interval 1, probability 0, space 0, times 0 [ 426.678545][T15462] CPU: 1 UID: 0 PID: 15462 Comm: syz.3.3065 Not tainted syzkaller #0 PREEMPT(full) [ 426.678587][T15462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 426.678597][T15462] Call Trace: [ 426.678604][T15462] [ 426.678612][T15462] dump_stack_lvl+0xe8/0x150 [ 426.678638][T15462] should_fail_ex+0x410/0x560 [ 426.678665][T15462] should_failslab+0xa8/0x100 [ 426.678689][T15462] __kmalloc_noprof+0xfe/0x720 [ 426.678716][T15462] ? tomoyo_encode+0x2ad/0x570 [ 426.678734][T15462] ? tomoyo_encode+0x2ad/0x570 [ 426.678760][T15462] tomoyo_encode+0x2ad/0x570 [ 426.678782][T15462] tomoyo_realpath_from_path+0x5fa/0x640 [ 426.678812][T15462] ? tomoyo_path_number_perm+0x219/0x5f0 [ 426.678911][T15462] tomoyo_path_number_perm+0x246/0x5f0 [ 426.678938][T15462] ? lock_acquire+0x115/0x350 [ 426.678956][T15462] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 426.678989][T15462] ? taprio_dequeue+0x26/0x540 [ 426.679090][T15462] ? hook_file_ioctl+0x1f2/0x600 [ 426.679153][T15462] ? net_tx_action+0x5bb/0xc30 [ 426.679211][T15462] ? __irq_exit_rcu+0xcb/0x220 [ 426.679233][T15462] ? lockdep_softirqs_on+0x11e/0x190 [ 426.679254][T15462] security_file_ioctl+0xc3/0x2a0 [ 426.679281][T15462] __se_sys_ioctl+0x47/0x170 [ 426.679303][T15462] do_syscall_64+0x166/0x520 [ 426.679329][T15462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.679348][T15462] ? clear_bhb_loop+0x70/0xc0 [ 426.679369][T15462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.679387][T15462] RIP: 0033:0x7f0c49b9e159 [ 426.679404][T15462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.679421][T15462] RSP: 002b:00007f0c4aac3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 426.679441][T15462] RAX: ffffffffffffffda RBX: 00007f0c49e25fa0 RCX: 00007f0c49b9e159 [ 426.679453][T15462] RDX: 0000000000000000 RSI: 000000008008b705 RDI: 0000000000000003 [ 426.679463][T15462] RBP: 00007f0c4aac3090 R08: 0000000000000000 R09: 0000000000000000 [ 426.679475][T15462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 426.679485][T15462] R13: 00007f0c49e26038 R14: 00007f0c49e25fa0 R15: 00007ffd5e265ba8 [ 426.679521][T15462] [ 426.684777][T15462] ERROR: Out of memory at tomoyo_realpath_from_path. [ 427.091737][ T5619] Bluetooth: hci3: command tx timeout [ 427.207694][T14197] bond5 (unregistering): (slave ip6gre1): Releasing backup interface [ 427.207832][T14197] ip6gre1 (unregistering): left promiscuous mode [ 428.103923][T14197] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 428.118534][T14197] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 428.130605][T14197] bond0 (unregistering): Released all slaves [ 428.148450][T14197] bond1 (unregistering): (slave veth3): Removing an active aggregator [ 428.148491][T14197] net_ratelimit: 30 callbacks suppressed [ 428.148519][T14197] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 428.175098][T14197] bond1 (unregistering): (slave veth3): Releasing backup interface [ 428.186480][T14197] bond1 (unregistering): (slave dummy0): Removing an active aggregator [ 428.198965][T14197] bond1 (unregistering): (slave dummy0): Releasing backup interface [ 428.214533][T14197] bond1 (unregistering): Released all slaves [ 428.247173][T14197] bond2 (unregistering): Released all slaves [ 428.285960][T14197] bond3 (unregistering): (slave veth5): Releasing active interface [ 428.305337][T14197] bond3 (unregistering): Released all slaves [ 428.397583][T14197] bond4 (unregistering): Released all slaves [ 428.464101][T14197] bond5 (unregistering): Released all slaves [ 428.527606][T14197] bond6 (unregistering): Released all slaves [ 428.585227][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 428.587864][T15466] __nla_validate_parse: 2 callbacks suppressed [ 428.587899][T15466] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3067'. [ 428.607324][T15470] tipc: Enabling of bearer rejected, failed to enable media [ 428.611924][T14238] bond3: (slave bridge5): failed to get link speed/duplex [ 428.612021][T14238] bond3: (slave dummy0): failed to get link speed/duplex [ 428.732744][T14233] bond3: (slave dummy0): failed to get link speed/duplex [ 428.732895][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 428.846545][T14238] bond3: (slave dummy0): failed to get link speed/duplex [ 428.859431][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 428.962022][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 428.973281][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 429.072752][T14233] bond3: (slave dummy0): failed to get link speed/duplex [ 429.144881][T15502] FAULT_INJECTION: forcing a failure. [ 429.144881][T15502] name failslab, interval 1, probability 0, space 0, times 0 [ 429.157869][T15502] CPU: 0 UID: 0 PID: 15502 Comm: syz.1.3077 Not tainted syzkaller #0 PREEMPT(full) [ 429.157894][T15502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 429.157905][T15502] Call Trace: [ 429.157912][T15502] [ 429.157919][T15502] dump_stack_lvl+0xe8/0x150 [ 429.157948][T15502] should_fail_ex+0x410/0x560 [ 429.157978][T15502] should_failslab+0xa8/0x100 [ 429.158000][T15502] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 429.158026][T15502] ? bpf_push_jmp_history+0x26c/0x6d0 [ 429.158043][T15502] ? bpf_push_jmp_history+0x26c/0x6d0 [ 429.158062][T15502] ? bpf_push_jmp_history+0x26c/0x6d0 [ 429.158079][T15502] krealloc_node_align_noprof+0x19a/0x390 [ 429.158097][T15502] ? __kasan_kmalloc+0x93/0xb0 [ 429.158117][T15502] bpf_push_jmp_history+0x26c/0x6d0 [ 429.158154][T15502] do_check_common+0x2a0a/0x5d30 [ 429.158206][T15502] ? __pfx_do_check_common+0x10/0x10 [ 429.158238][T15502] bpf_check+0x2639/0x2e10 [ 429.158264][T15502] ? ktime_get_with_offset+0x93/0x2d0 [ 429.158285][T15502] ? __pfx_bpf_check+0x10/0x10 [ 429.158304][T15502] ? bpf_obj_name_cpy+0x194/0x1e0 [ 429.158330][T15502] bpf_prog_load+0x14d6/0x1c20 [ 429.158360][T15502] ? __pfx_bpf_prog_load+0x10/0x10 [ 429.158415][T15502] __sys_bpf+0xd0d/0xd90 [ 429.158441][T15502] ? __pfx___sys_bpf+0x10/0x10 [ 429.158468][T15502] ? __fget_files+0x2a/0x420 [ 429.158505][T15502] ? ksys_write+0x242/0x270 [ 429.158529][T15502] ? __pfx_ksys_write+0x10/0x10 [ 429.158556][T15502] __x64_sys_bpf+0xba/0xd0 [ 429.158575][T15502] do_syscall_64+0x166/0x520 [ 429.158599][T15502] ? trace_irq_disable+0x3b/0x140 [ 429.158614][T15502] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.158631][T15502] ? clear_bhb_loop+0x70/0xc0 [ 429.158651][T15502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 429.158667][T15502] RIP: 0033:0x7f133739e159 [ 429.158685][T15502] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 429.158699][T15502] RSP: 002b:00007f13381d9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 429.158718][T15502] RAX: ffffffffffffffda RBX: 00007f1337625fa0 RCX: 00007f133739e159 [ 429.158731][T15502] RDX: 0000000000000094 RSI: 00002000000004c0 RDI: 0000000000000005 [ 429.158742][T15502] RBP: 00007f13381d9090 R08: 0000000000000000 R09: 0000000000000000 [ 429.158753][T15502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 429.158762][T15502] R13: 00007f1337626038 R14: 00007f1337625fa0 R15: 00007ffe59e5e4d8 [ 429.158790][T15502] [ 429.182394][ T5619] Bluetooth: hci3: command tx timeout [ 429.185467][T14197] tipc: Disabling bearer [ 429.212439][T14197] tipc: Left network mode [ 429.481672][T15506] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3079'. [ 429.747444][T15508] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3080'. [ 430.365767][T15376] bridge0: port 1(bridge_slave_0) entered blocking state [ 430.373666][T15376] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.373847][T15376] bridge_slave_0: entered allmulticast mode [ 430.395294][T15376] bridge_slave_0: entered promiscuous mode [ 430.449182][T15376] bridge0: port 2(bridge_slave_1) entered blocking state [ 430.464741][T15376] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.472248][T15376] bridge_slave_1: entered allmulticast mode [ 430.481025][T15376] bridge_slave_1: entered promiscuous mode [ 430.500008][T15532] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3085'. [ 430.643658][ T5277] 8021q: adding VLAN 0 to HW filter on device eth2 [ 430.811795][T15376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.830355][T15376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 431.244427][T15376] team0: Port device team_slave_0 added [ 431.249990][ T5619] Bluetooth: hci3: command tx timeout [ 431.258136][T15376] team0: Port device team_slave_1 added [ 431.405934][T15570] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3095'. [ 431.449840][T15566] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3095'. [ 431.714898][T15376] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 431.722248][T15376] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 431.722279][T15376] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 431.901166][T15592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3100'. [ 431.983404][T15594] ip6t_rpfilter: unknown options [ 431.989121][T15376] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 431.989188][T15376] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 431.989226][T15376] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 432.312228][ T5277] 8021q: adding VLAN 0 to HW filter on device eth3 [ 432.406054][T15616] netlink: 'syz.1.3106': attribute type 21 has an invalid length. [ 432.510767][T15376] hsr_slave_0: entered promiscuous mode [ 432.516471][T15376] hsr_slave_1: entered promiscuous mode [ 432.523752][T15376] debugfs: 'hsr0' already exists in 'hsr' [ 432.523824][T15376] Cannot create hsr debugfs directory [ 432.728103][T14197] hsr_slave_0: left promiscuous mode [ 432.734645][T14197] hsr_slave_1: left promiscuous mode [ 432.742217][T14197] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 432.746682][T14197] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 432.758501][T14197] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 432.758538][T14197] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 432.892376][T14197] veth1_macvtap: left promiscuous mode [ 432.893814][T14197] veth0_macvtap: left promiscuous mode [ 432.903404][T14197] veth1_vlan: left promiscuous mode [ 432.909857][T14197] veth0_vlan: left promiscuous mode [ 433.117366][T15637] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3109'. [ 433.265895][T15646] net_ratelimit: 13 callbacks suppressed [ 433.273796][T15646] ip_tables: iptables: counters copy to user failed while replacing table [ 433.458557][T15656] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3112'. [ 433.844147][T14197] team0 (unregistering): Port device team_slave_1 removed [ 433.867908][T14197] team0 (unregistering): Port device team_slave_0 removed [ 434.076091][T15635] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3109'. [ 434.121763][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 434.122116][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 434.188383][ T5277] 8021q: adding VLAN 0 to HW filter on device eth4 [ 434.380022][T14233] bond3: (slave dummy0): failed to get link speed/duplex [ 434.409920][T15660] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 434.411541][T15660] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 434.415466][T15669] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 434.416294][T15669] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 434.451620][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 434.509506][T14236] bond3: (slave dummy0): failed to get link speed/duplex [ 434.803348][T15679] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3117'. [ 434.851285][T15678] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3118'. [ 435.024542][T15678] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3118'. [ 435.256952][T14197] IPVS: stop unused estimator thread 0... [ 435.424059][T15698] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3125'. [ 435.457970][T15698] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3125'. [ 435.817859][T15706] netlink: 'syz.1.3126': attribute type 29 has an invalid length. [ 436.165572][T15724] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3132'. [ 436.677353][T15739] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3134'. [ 436.740958][T15741] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3136'. [ 436.811864][T15376] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 436.840522][T15376] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 436.859588][T15376] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 436.908485][T15376] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 436.919942][T15376] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 436.944991][T15376] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 436.953594][T15376] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 436.978697][T15376] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 437.071741][T15752] FAULT_INJECTION: forcing a failure. [ 437.071741][T15752] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 437.087905][T15752] CPU: 0 UID: 0 PID: 15752 Comm: syz.0.3138 Not tainted syzkaller #0 PREEMPT(full) [ 437.087931][T15752] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 437.087943][T15752] Call Trace: [ 437.087951][T15752] [ 437.087959][T15752] dump_stack_lvl+0xe8/0x150 [ 437.087990][T15752] should_fail_ex+0x410/0x560 [ 437.088023][T15752] _copy_to_user+0x31/0xb0 [ 437.088046][T15752] bpf_log_attr_finalize+0x124/0x1e0 [ 437.088066][T15752] ? __pfx_bpf_log_attr_finalize+0x10/0x10 [ 437.088086][T15752] ? ktime_get+0x45/0x220 [ 437.088105][T15752] ? ktime_get+0x1f5/0x220 [ 437.088124][T15752] bpf_check+0x1c55/0x2e10 [ 437.088155][T15752] ? ktime_get_with_offset+0x93/0x2d0 [ 437.088187][T15752] ? __pfx_bpf_check+0x10/0x10 [ 437.088209][T15752] ? bpf_obj_name_cpy+0x194/0x1e0 [ 437.088238][T15752] bpf_prog_load+0x14d6/0x1c20 [ 437.088269][T15752] ? __pfx_bpf_prog_load+0x10/0x10 [ 437.088314][T15752] __sys_bpf+0xd0d/0xd90 [ 437.088342][T15752] ? __pfx___sys_bpf+0x10/0x10 [ 437.088372][T15752] ? __fget_files+0x2a/0x420 [ 437.088412][T15752] ? ksys_write+0x242/0x270 [ 437.088440][T15752] ? __pfx_ksys_write+0x10/0x10 [ 437.088470][T15752] __x64_sys_bpf+0xba/0xd0 [ 437.088491][T15752] do_syscall_64+0x166/0x520 [ 437.088518][T15752] ? trace_irq_disable+0x3b/0x140 [ 437.088535][T15752] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.088554][T15752] ? clear_bhb_loop+0x70/0xc0 [ 437.088576][T15752] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.088595][T15752] RIP: 0033:0x7f0b0a59e159 [ 437.088612][T15752] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.088629][T15752] RSP: 002b:00007f0b0b53b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 437.088649][T15752] RAX: ffffffffffffffda RBX: 00007f0b0a825fa0 RCX: 00007f0b0a59e159 [ 437.088662][T15752] RDX: 0000000000000094 RSI: 00002000000004c0 RDI: 0000000000000005 [ 437.088674][T15752] RBP: 00007f0b0b53b090 R08: 0000000000000000 R09: 0000000000000000 [ 437.088685][T15752] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 437.088697][T15752] R13: 00007f0b0a826038 R14: 00007f0b0a825fa0 R15: 00007ffc95303ae8 [ 437.088725][T15752] [ 437.644338][T15767] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3137'. [ 437.720718][T15769] Unknown options in mask 6 [ 437.791991][T14236] IPVS: starting estimator thread 0... [ 438.000329][T15778] IPVS: using max 30 ests per chain, 72000 per kthread [ 438.480833][T14197] net_ratelimit: 28 callbacks suppressed [ 438.482933][T14197] bond3: (slave dummy0): failed to get link speed/duplex [ 438.483118][T14197] bond3: (slave bridge5): failed to get link speed/duplex [ 438.505007][T15785] netlink: 'syz.1.3139': attribute type 1 has an invalid length. [ 438.507441][T15773] netlink: 'syz.4.3141': attribute type 15 has an invalid length. [ 438.705166][T14197] bond3: (slave bridge5): failed to get link speed/duplex [ 438.705287][T14197] bond3: (slave dummy0): failed to get link speed/duplex [ 438.850672][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 438.850756][T14233] bond3: (slave dummy0): failed to get link speed/duplex [ 438.877989][T15376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 438.924192][T15376] 8021q: adding VLAN 0 to HW filter on device team0 [ 438.990972][T14197] bridge0: port 1(bridge_slave_0) entered blocking state [ 438.991177][T14197] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.020115][T14238] bond3: (slave bridge5): failed to get link speed/duplex [ 439.020234][T14238] bond3: (slave dummy0): failed to get link speed/duplex [ 439.116580][T14236] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.116779][T14236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 439.132727][T14236] bond3: (slave dummy0): failed to get link speed/duplex [ 439.132804][T14236] bond3: (slave bridge5): failed to get link speed/duplex [ 439.496598][T15822] __nla_validate_parse: 3 callbacks suppressed [ 439.496645][T15822] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3146'. [ 439.522523][T15822] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3146'. [ 439.600644][T15822] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3146'. [ 440.053682][ T1311] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.129111][T15844] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3154'. [ 440.357211][T15852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3155'. [ 440.411399][T15855] IPVS: set_ctl: invalid protocol: 4 224.0.0.2:20002 [ 440.424353][T15855] netlink: 'syz.0.3155': attribute type 11 has an invalid length. [ 440.688557][T15866] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3157'. [ 440.801254][T14232] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.814761][T15863] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3157'. [ 440.824862][T14238] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.836958][T14238] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 440.851618][T14238] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.019296][T15874] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3160'. [ 441.070762][T15875] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3160'. [ 441.617155][T15874] netlink: 404 bytes leftover after parsing attributes in process `syz.1.3160'. [ 442.054351][T15376] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.444150][T15376] veth0_vlan: entered promiscuous mode [ 442.798731][T15915] syzkaller0: entered promiscuous mode [ 442.798824][T15915] syzkaller0: entered allmulticast mode [ 442.818888][T15376] veth1_vlan: entered promiscuous mode [ 446.020027][T14235] net_ratelimit: 42 callbacks suppressed [ 446.020119][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 446.020214][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 446.251575][T15980] __nla_validate_parse: 6 callbacks suppressed [ 446.258853][T15979] xt_connbytes: Forcing CT accounting to be enabled [ 446.265945][T15980] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3179'. [ 446.275125][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 446.275202][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 446.375666][T15376] veth0_macvtap: entered promiscuous mode [ 446.459764][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 446.461419][T15376] veth1_macvtap: entered promiscuous mode [ 446.489741][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 446.502069][T15983] syzkaller0: entered promiscuous mode [ 446.508305][T15983] syzkaller0: entered allmulticast mode [ 446.600405][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 446.610937][T14235] bond3: (slave dummy0): failed to get link speed/duplex [ 446.627747][T15376] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 446.655495][T15376] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 446.667171][T15987] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3181'. [ 446.879509][T14236] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.881616][T14238] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.897884][T14236] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.897942][T14236] bond3: (slave bridge5): failed to get link speed/duplex [ 446.898920][T14236] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 446.914814][T14238] bond3: (slave dummy0): failed to get link speed/duplex [ 446.942633][T14233] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 446.942705][T14233] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.003494][T14233] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 447.003583][T14233] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 447.075706][T15992] netlink: 'syz.0.3184': attribute type 21 has an invalid length. [ 447.075934][T15992] FAULT_INJECTION: forcing a failure. [ 447.075934][T15992] name failslab, interval 1, probability 0, space 0, times 0 [ 447.075974][T15992] CPU: 1 UID: 0 PID: 15992 Comm: syz.0.3184 Not tainted syzkaller #0 PREEMPT(full) [ 447.075996][T15992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 447.076007][T15992] Call Trace: [ 447.076015][T15992] [ 447.076022][T15992] dump_stack_lvl+0xe8/0x150 [ 447.076052][T15992] should_fail_ex+0x410/0x560 [ 447.076084][T15992] should_failslab+0xa8/0x100 [ 447.076107][T15992] __kmalloc_cache_noprof+0xa3/0x600 [ 447.076133][T15992] ? call_usermodehelper_setup+0x8e/0x270 [ 447.076155][T15992] ? call_usermodehelper_setup+0x8e/0x270 [ 447.076176][T15992] ? __request_module+0x2ec/0x630 [ 447.076201][T15992] call_usermodehelper_setup+0x8e/0x270 [ 447.076221][T15992] ? __pfx_free_modprobe_argv+0x10/0x10 [ 447.076245][T15992] __request_module+0x3ba/0x630 [ 447.076266][T15992] ? lockdep_hardirqs_on+0x7b/0x110 [ 447.076295][T15992] ? __pfx___request_module+0x10/0x10 [ 447.076331][T15992] ? tcp_ca_find_autoload+0x110/0x240 [ 447.076438][T15992] ? tcp_ca_find_autoload+0x110/0x240 [ 447.076461][T15992] tcp_ca_find_autoload+0x138/0x240 [ 447.076484][T15992] ? tcp_ca_get_key_by_name+0x39/0x250 [ 447.076507][T15992] tcp_ca_get_key_by_name+0xdb/0x250 [ 447.076533][T15992] ip_fib_metrics_init+0x1e8/0x6f0 [ 447.076549][T15992] ? trace_kmalloc+0x2a/0xf0 [ 447.076577][T15992] ? __pfx_ip_fib_metrics_init+0x10/0x10 [ 447.076593][T15992] ? __kmalloc_noprof+0x1ab/0x720 [ 447.076616][T15992] ? fib6_update_sernum+0x280/0x2c0 [ 447.076639][T15992] ? fib6_info_alloc+0x30/0xf0 [ 447.076664][T15992] ? __asan_memset+0x22/0x50 [ 447.076693][T15992] ip6_route_info_create+0x19e/0x890 [ 447.076725][T15992] ip6_route_add+0x49/0x1b0 [ 447.076751][T15992] inet6_rtm_newroute+0x267/0x1a30 [ 447.076782][T15992] ? kasan_quarantine_put+0xbb/0x1f0 [ 447.076808][T15992] ? lockdep_hardirqs_on+0x7b/0x110 [ 447.076835][T15992] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 447.076856][T15992] ? nlmon_xmit+0xb0/0x100 [ 447.076880][T15992] ? kmem_cache_free+0x182/0x650 [ 447.076938][T15992] ? __lock_acquire+0x6df/0x2e50 [ 447.076963][T15992] ? __dev_queue_xmit+0x29b/0x3820 [ 447.076988][T15992] ? __local_bh_enable_ip+0xd6/0x140 [ 447.077011][T15992] ? lockdep_hardirqs_on+0x7b/0x110 [ 447.077060][T15992] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 447.077090][T15992] rtnetlink_rcv_msg+0x802/0xc00 [ 447.077121][T15992] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 447.077146][T15992] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 447.077197][T15992] ? ref_tracker_free+0x689/0x830 [ 447.077218][T15992] ? __pfx_ref_tracker_free+0x10/0x10 [ 447.077245][T15992] netlink_rcv_skb+0x226/0x4a0 [ 447.077269][T15992] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 447.077297][T15992] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 447.077329][T15992] ? netlink_deliver_tap+0x2e/0x1b0 [ 447.077349][T15992] ? netlink_deliver_tap+0x2e/0x1b0 [ 447.077375][T15992] netlink_unicast+0x7bd/0x940 [ 447.077404][T15992] netlink_sendmsg+0x813/0xb40 [ 447.077475][T15992] ? lockdep_hardirqs_on+0x7b/0x110 [ 447.077508][T15992] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.077537][T15992] ? apparmor_socket_sendmsg+0x98/0x360 [ 447.077566][T15992] ? __pfx_netlink_sendmsg+0x10/0x10 [ 447.077586][T15992] sock_sendmsg_nosec+0x13a/0x180 [ 447.077612][T15992] ____sys_sendmsg+0x54e/0x850 [ 447.077637][T15992] ? __pfx_____sys_sendmsg+0x10/0x10 [ 447.077664][T15992] ? import_iovec+0x73/0xa0 [ 447.077686][T15992] ___sys_sendmsg+0x2a5/0x360 [ 447.077704][T15992] ? __lock_acquire+0x6df/0x2e50 [ 447.077725][T15992] ? __pfx____sys_sendmsg+0x10/0x10 [ 447.077775][T15992] ? __fget_files+0x2a/0x420 [ 447.077796][T15992] ? __fget_files+0x3a2/0x420 [ 447.077827][T15992] __x64_sys_sendmsg+0x1b1/0x290 [ 447.077849][T15992] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 447.077886][T15992] do_syscall_64+0x166/0x520 [ 447.077910][T15992] ? trace_irq_disable+0x3b/0x140 [ 447.077925][T15992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.077942][T15992] ? clear_bhb_loop+0x70/0xc0 [ 447.077964][T15992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 447.077981][T15992] RIP: 0033:0x7f0b0a59e159 [ 447.077999][T15992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 447.078014][T15992] RSP: 002b:00007f0b0b53b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 447.078033][T15992] RAX: ffffffffffffffda RBX: 00007f0b0a825fa0 RCX: 00007f0b0a59e159 [ 447.078047][T15992] RDX: 0000000004000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 447.078058][T15992] RBP: 00007f0b0b53b090 R08: 0000000000000000 R09: 0000000000000000 [ 447.078070][T15992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 447.078080][T15992] R13: 00007f0b0a826038 R14: 00007f0b0a825fa0 R15: 00007ffc95303ae8 [ 447.078107][T15992] [ 448.013904][ T4931] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 448.028309][ T4931] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 448.038263][ T4931] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 448.053893][ T4931] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 448.062243][ T4931] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 448.834125][T16030] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3196'. [ 448.860336][T16030] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3196'. [ 449.114038][T14189] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.266777][T16044] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3197'. [ 449.384473][T16038] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3197'. [ 449.434553][T14189] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.553166][T14189] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.581177][T16028] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 449.665580][T16009] lo speed is unknown, defaulting to 1000 [ 449.739737][T14189] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.757429][T16055] netlink: 'syz.4.3202': attribute type 21 has an invalid length. [ 449.807408][T16055] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3202'. [ 449.986310][T16055] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3202'. [ 449.986352][T16055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3202'. [ 450.129944][ T5619] Bluetooth: hci4: command tx timeout [ 450.289330][T16059] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3201'. [ 450.374936][T16068] netlink: 'syz.2.3203': attribute type 9 has an invalid length. [ 450.791017][T16081] netlink: 'syz.1.3204': attribute type 11 has an invalid length. [ 451.171626][T14233] net_ratelimit: 38 callbacks suppressed [ 451.171685][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 451.171732][T14233] bond3: (slave dummy0): failed to get link speed/duplex [ 451.236211][T16091] lo speed is unknown, defaulting to 1000 [ 451.236295][T16091] lo speed is unknown, defaulting to 1000 [ 451.237047][T16091] lo speed is unknown, defaulting to 1000 [ 451.276388][T16091] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 451.292690][T16091] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 451.292767][T16091] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 451.346856][T16091] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 451.426059][T16074] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 451.436219][T16093] __nla_validate_parse: 3 callbacks suppressed [ 451.436255][T16093] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3208'. [ 451.456883][T16078] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 451.457326][T16091] lo speed is unknown, defaulting to 1000 [ 451.514331][T16091] lo speed is unknown, defaulting to 1000 [ 451.531415][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 451.641273][T14233] bond3: (slave bridge5): failed to get link speed/duplex [ 451.682049][T16091] lo speed is unknown, defaulting to 1000 [ 451.689846][T14234] bond3: (slave dummy0): failed to get link speed/duplex [ 451.706066][T16091] lo speed is unknown, defaulting to 1000 [ 451.847669][T16102] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3209'. [ 451.908285][T16103] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 452.099610][T16103] xt_CT: No such helper "netbios-ns" [ 452.212059][ T4931] Bluetooth: hci4: command tx timeout [ 452.614367][T14189] gretap0 (unregistering): left promiscuous mode [ 452.993126][T14189] bond0 (unregistering): Released all slaves [ 453.004549][T14189] bond1 (unregistering): Released all slaves [ 453.025647][T14189] bond2 (unregistering): Released all slaves [ 453.044434][T14189] bond3 (unregistering): (slave veth3): Releasing backup interface [ 453.065034][T14189] bond3 (unregistering): (slave dummy0): Removing an active aggregator [ 453.068933][T14189] bond3 (unregistering): (slave dummy0): Releasing backup interface [ 453.077196][T14189] bond3 (unregistering): Released all slaves [ 453.090679][T14189] bond4 (unregistering): Released all slaves [ 453.109309][T14189] bond5 (unregistering): Released all slaves [ 453.149073][T16091] lo speed is unknown, defaulting to 1000 [ 453.222212][T16102] team0: Port device team_slave_0 removed [ 453.254781][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 453.303385][T16091] lo speed is unknown, defaulting to 1000 [ 453.337611][T16091] lo speed is unknown, defaulting to 1000 [ 453.349196][T16133] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3212'. [ 453.367457][T16091] lo speed is unknown, defaulting to 1000 [ 453.466554][T14236] bond3: (slave bridge5): failed to get link speed/duplex [ 453.631026][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 453.682879][T14197] smbdirect: ib_dev[syz1] removed [ 453.740432][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 454.033502][T14189] tipc: Left network mode [ 454.128433][T16154] nbd2: detected capacity change from 0 to 63 [ 454.150685][ T1996] [ 454.153049][ T1996] ====================================================== [ 454.160076][ T1996] WARNING: possible circular locking dependency detected [ 454.167114][ T1996] syzkaller #0 Not tainted [ 454.171543][ T1996] ------------------------------------------------------ [ 454.178561][ T1996] kworker/0:1H/1996 is trying to acquire lock: [ 454.184712][ T1996] ffff88807c10a668 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x373/0xff0 [ 454.193838][ T1996] [ 454.193838][ T1996] but task is already holding lock: [ 454.201197][ T1996] ffff888027db7178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 454.209659][ T1996] [ 454.209659][ T1996] which lock already depends on the new lock. [ 454.209659][ T1996] [ 454.220064][ T1996] [ 454.220064][ T1996] the existing dependency chain (in reverse order) is: [ 454.229079][ T1996] [ 454.229079][ T1996] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 454.236306][ T1996] __mutex_lock+0x19d/0x1550 [ 454.241458][ T1996] nbd_queue_rq+0xc1/0xff0 [ 454.246412][ T1996] blk_mq_dispatch_rq_list+0x499/0x1990 [ 454.252633][ T1996] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 454.259572][ T1996] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 454.266086][ T1996] blk_mq_run_work_fn+0x16c/0x300 [ 454.271647][ T1996] process_scheduled_works+0xc3d/0x1630 [ 454.277727][ T1996] worker_thread+0xa47/0xfb0 [ 454.282853][ T1996] kthread+0x38b/0x480 [ 454.287454][ T1996] ret_from_fork+0x514/0xb70 [ 454.292604][ T1996] ret_from_fork_asm+0x1a/0x30 [ 454.297902][ T1996] [ 454.297902][ T1996] -> #5 (set->srcu){.+.+}-{0:0}: [ 454.305035][ T1996] __synchronize_srcu+0xc9/0x2f0 [ 454.310503][ T1996] elevator_switch+0x1e8/0x7b0 [ 454.315919][ T1996] elevator_change+0x2fa/0x480 [ 454.321222][ T1996] elevator_set_default+0x375/0x440 [ 454.326955][ T1996] blk_register_queue+0x3f3/0x4e0 [ 454.332585][ T1996] __add_disk+0x6cb/0xe30 [ 454.337451][ T1996] add_disk_fwnode+0x100/0x3a0 [ 454.342742][ T1996] nbd_dev_add+0x733/0xb60 [ 454.347691][ T1996] nbd_init+0x168/0x1f0 [ 454.352504][ T1996] do_one_initcall+0x250/0x870 [ 454.357807][ T1996] do_initcall_level+0x10a/0x1a0 [ 454.363374][ T1996] do_initcalls+0x59/0xa0 [ 454.368249][ T1996] kernel_init_freeable+0x29d/0x3e0 [ 454.373980][ T1996] kernel_init+0x22/0x1d0 [ 454.378838][ T1996] ret_from_fork+0x514/0xb70 [ 454.383957][ T1996] ret_from_fork_asm+0x1a/0x30 [ 454.389267][ T1996] [ 454.389267][ T1996] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 454.397095][ T1996] __mutex_lock+0x19d/0x1550 [ 454.402224][ T1996] elevator_change+0x1af/0x480 [ 454.407519][ T1996] elevator_set_none+0xb5/0x140 [ 454.412907][ T1996] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 454.419241][ T1996] nbd_start_device+0x189/0xb30 [ 454.424624][ T1996] nbd_genl_connect+0x167d/0x1cd0 [ 454.430187][ T1996] genl_family_rcv_msg_doit+0x233/0x340 [ 454.436276][ T1996] genl_rcv_msg+0x614/0x7a0 [ 454.441314][ T1996] netlink_rcv_skb+0x226/0x4a0 [ 454.446606][ T1996] genl_rcv+0x28/0x40 [ 454.451120][ T1996] netlink_unicast+0x7bd/0x940 [ 454.456408][ T1996] netlink_sendmsg+0x813/0xb40 [ 454.461705][ T1996] sock_sendmsg_nosec+0x13a/0x180 [ 454.467261][ T1996] ____sys_sendmsg+0x54e/0x850 [ 454.472547][ T1996] ___sys_sendmsg+0x2a5/0x360 [ 454.477736][ T1996] __x64_sys_sendmsg+0x1b1/0x290 [ 454.483185][ T1996] do_syscall_64+0x166/0x520 [ 454.488470][ T1996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.494873][ T1996] [ 454.494873][ T1996] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 454.503473][ T1996] blk_alloc_queue+0x544/0x690 [ 454.508762][ T1996] __blk_mq_alloc_disk+0x194/0x390 [ 454.514382][ T1996] nbd_dev_add+0x494/0xb60 [ 454.519320][ T1996] nbd_init+0x168/0x1f0 [ 454.523990][ T1996] do_one_initcall+0x250/0x870 [ 454.529283][ T1996] do_initcall_level+0x10a/0x1a0 [ 454.534749][ T1996] do_initcalls+0x59/0xa0 [ 454.539603][ T1996] kernel_init_freeable+0x29d/0x3e0 [ 454.545318][ T1996] kernel_init+0x22/0x1d0 [ 454.550162][ T1996] ret_from_fork+0x514/0xb70 [ 454.555267][ T1996] ret_from_fork_asm+0x1a/0x30 [ 454.560547][ T1996] [ 454.560547][ T1996] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 454.567748][ T1996] fs_reclaim_acquire+0x71/0x100 [ 454.573203][ T1996] __kmalloc_noprof+0xbc/0x720 [ 454.578485][ T1996] tls_sw_sendmsg+0x59b/0x2b50 [ 454.583845][ T1996] sock_sendmsg_nosec+0x90/0x180 [ 454.589300][ T1996] sock_sendmsg+0x1ca/0x2d0 [ 454.594320][ T1996] splice_to_socket+0xb5e/0x12a0 [ 454.599781][ T1996] direct_splice_actor+0x101/0x160 [ 454.605408][ T1996] splice_direct_to_actor+0x57b/0xcb0 [ 454.611303][ T1996] do_splice_direct+0x195/0x290 [ 454.616692][ T1996] do_sendfile+0x52e/0x7c0 [ 454.621619][ T1996] __se_sys_sendfile64+0x144/0x1a0 [ 454.627238][ T1996] do_syscall_64+0x166/0x520 [ 454.632342][ T1996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.638746][ T1996] [ 454.638746][ T1996] -> #1 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 454.646814][ T1996] lock_sock_nested+0x41/0x100 [ 454.652097][ T1996] inet_shutdown+0x6a/0x390 [ 454.657137][ T1996] nbd_mark_nsock_dead+0x2cb/0x550 [ 454.662764][ T1996] recv_work+0x1cee/0x1e10 [ 454.667696][ T1996] process_scheduled_works+0xc3d/0x1630 [ 454.673752][ T1996] worker_thread+0xa47/0xfb0 [ 454.678856][ T1996] kthread+0x38b/0x480 [ 454.683451][ T1996] ret_from_fork+0x514/0xb70 [ 454.688556][ T1996] ret_from_fork_asm+0x1a/0x30 [ 454.693838][ T1996] [ 454.693838][ T1996] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 454.701482][ T1996] __lock_acquire+0x15ff/0x2e50 [ 454.706854][ T1996] lock_acquire+0x115/0x350 [ 454.711867][ T1996] __mutex_lock+0x19d/0x1550 [ 454.716977][ T1996] nbd_queue_rq+0x373/0xff0 [ 454.721997][ T1996] blk_mq_dispatch_rq_list+0x499/0x1990 [ 454.728083][ T1996] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 454.734919][ T1996] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 454.741411][ T1996] blk_mq_run_work_fn+0x16c/0x300 [ 454.746954][ T1996] process_scheduled_works+0xc3d/0x1630 [ 454.753015][ T1996] worker_thread+0xa47/0xfb0 [ 454.758117][ T1996] kthread+0x38b/0x480 [ 454.762702][ T1996] ret_from_fork+0x514/0xb70 [ 454.767831][ T1996] ret_from_fork_asm+0x1a/0x30 [ 454.773116][ T1996] [ 454.773116][ T1996] other info that might help us debug this: [ 454.773116][ T1996] [ 454.783331][ T1996] Chain exists of: [ 454.783331][ T1996] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 454.783331][ T1996] [ 454.795405][ T1996] Possible unsafe locking scenario: [ 454.795405][ T1996] [ 454.802841][ T1996] CPU0 CPU1 [ 454.808201][ T1996] ---- ---- [ 454.813551][ T1996] lock(&cmd->lock); [ 454.817525][ T1996] lock(set->srcu); [ 454.823930][ T1996] lock(&cmd->lock); [ 454.830420][ T1996] lock(&nsock->tx_lock); [ 454.834826][ T1996] [ 454.834826][ T1996] *** DEADLOCK *** [ 454.834826][ T1996] [ 454.842954][ T1996] locks held by kworker/0:1H/1996: 4, last CPU#0: [ 454.849356][ T1996] #0: ffff88801eaff140 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 454.860519][ T1996] #1: ffffc9000653fc40 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 454.873385][ T1996] #2: ffff88802775d598 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x144/0x300 [ 454.882781][ T1996] #3: ffff888027db7178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc1/0xff0 [ 454.891653][ T1996] [ 454.891653][ T1996] stack backtrace: [ 454.897529][ T1996] CPU: 0 UID: 0 PID: 1996 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT(full) [ 454.906977][ T1996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 454.917027][ T1996] Workqueue: kblockd blk_mq_run_work_fn [ 454.922575][ T1996] Call Trace: [ 454.925847][ T1996] [ 454.928765][ T1996] dump_stack_lvl+0xe8/0x150 [ 454.933355][ T1996] print_circular_bug+0x2e2/0x300 [ 454.938378][ T1996] check_noncircular+0x12f/0x150 [ 454.943310][ T1996] __lock_acquire+0x15ff/0x2e50 [ 454.948149][ T1996] ? iowrite16+0x31/0x80 [ 454.952466][ T1996] lock_acquire+0x115/0x350 [ 454.956961][ T1996] ? nbd_queue_rq+0x373/0xff0 [ 454.961644][ T1996] __mutex_lock+0x19d/0x1550 [ 454.966233][ T1996] ? nbd_queue_rq+0x373/0xff0 [ 454.970934][ T1996] ? ret_from_fork_asm+0x1a/0x30 [ 454.975878][ T1996] ? unwind_next_frame+0x8f/0x2550 [ 454.981003][ T1996] ? nbd_queue_rq+0x373/0xff0 [ 454.985676][ T1996] ? __pfx___mutex_lock+0x10/0x10 [ 454.990695][ T1996] ? ret_from_fork_asm+0x1a/0x30 [ 454.995629][ T1996] ? stack_trace_save+0xa9/0x100 [ 455.000562][ T1996] ? __pfx_stack_trace_save+0x10/0x10 [ 455.005937][ T1996] nbd_queue_rq+0x373/0xff0 [ 455.010451][ T1996] ? __lock_acquire+0x14b9/0x2e50 [ 455.015471][ T1996] ? __pfx_nbd_queue_rq+0x10/0x10 [ 455.020496][ T1996] blk_mq_dispatch_rq_list+0x499/0x1990 [ 455.026051][ T1996] ? sbitmap_get+0x229/0x390 [ 455.030635][ T1996] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 455.036624][ T1996] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 455.042434][ T1996] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 455.048758][ T1996] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 455.055528][ T1996] ? lock_acquire+0x115/0x350 [ 455.060200][ T1996] ? process_scheduled_works+0x97a/0x1630 [ 455.065910][ T1996] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 455.071883][ T1996] ? blk_mq_run_work_fn+0x144/0x300 [ 455.077075][ T1996] blk_mq_run_work_fn+0x16c/0x300 [ 455.082091][ T1996] ? process_scheduled_works+0x97a/0x1630 [ 455.087804][ T1996] process_scheduled_works+0xc3d/0x1630 [ 455.093355][ T1996] ? __pfx_process_scheduled_works+0x10/0x10 [ 455.099333][ T1996] ? assign_work+0x3cf/0x5d0 [ 455.103918][ T1996] worker_thread+0xa47/0xfb0 [ 455.108512][ T1996] ? __kthread_parkme+0x71/0x1f0 [ 455.113453][ T1996] kthread+0x38b/0x480 [ 455.117515][ T1996] ? __pfx_worker_thread+0x10/0x10 [ 455.122707][ T1996] ? __pfx_kthread+0x10/0x10 [ 455.127284][ T1996] ret_from_fork+0x514/0xb70 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 455.131888][ T1996] ? __pfx_ret_from_fork+0x10/0x10 [ 455.136993][ T1996] ? __switch_to+0xc89/0x1420 [ 455.141753][ T1996] ? __pfx_kthread+0x10/0x10 [ 455.146334][ T1996] ret_from_fork_asm+0x1a/0x30 [ 455.151109][ T1996] [ 455.163235][T16154] block nbd2: NBD_DISCONNECT [ 455.180630][ T5619] Bluetooth: hci4: command tx timeout [ 455.191538][T16154] block nbd2: Disconnected due to user request. [ 455.191579][T16154] block nbd2: shutting down sockets [ 455.229681][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 455.229816][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 455.229851][ C1] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 455.229945][ C1] Buffer I/O error on dev nbd2, logical block 1, async page read [ 455.230012][ C1] Buffer I/O error on dev nbd2, logical block 2, async page read [ 455.230077][ C1] Buffer I/O error on dev nbd2, logical block 3, async page read [ 455.230473][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.230509][ T131] Buffer I/O error on dev nbd2, logical block 0, async page read [ 455.230534][ T131] Buffer I/O error on dev nbd2, logical block 1, async page read [ 455.230546][ T131] Buffer I/O error on dev nbd2, logical block 2, async page read [ 455.230570][ T131] Buffer I/O error on dev nbd2, logical block 3, async page read [ 455.230729][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.230763][ T131] Buffer I/O error on dev nbd2, logical block 0, async page read [ 455.230775][ T131] Buffer I/O error on dev nbd2, logical block 1, async page read [ 455.230938][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.231120][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.231318][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.231495][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.231676][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.231752][T15981] ldm_validate_partition_table(): Disk read failed. [ 455.231878][ T131] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 455.232369][T15981] Dev nbd2: unable to read RDB block 0 [ 455.233321][T15981] nbd2: unable to read partition table [ 455.286842][T15981] ldm_validate_partition_table(): Disk read failed. [ 455.292797][T15981] Dev nbd2: unable to read RDB block 0 [ 455.297999][ T5277] 8021q: adding VLAN 0 to HW filter on device eth2 [ 455.326456][T15981] nbd2: unable to read partition table [ 455.353058][T16154] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3218'. [ 455.569909][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 455.695080][T16009] bridge0: port 1(bridge_slave_0) entered blocking state [ 455.695371][T16009] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.695568][T16009] bridge_slave_0: entered allmulticast mode [ 455.706307][T16009] bridge_slave_0: entered promiscuous mode [ 455.971311][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 456.290758][T14232] net_ratelimit: 1 callbacks suppressed [ 456.290814][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 456.469573][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 456.529278][ T5277] 8021q: adding VLAN 0 to HW filter on device eth3 [ 456.592429][T14189] veth1_to_team: left promiscuous mode [ 456.606562][T14189] hsr_slave_0: left promiscuous mode [ 456.613682][T14189] hsr_slave_1: left promiscuous mode [ 456.626880][T14189] veth1_macvtap: left promiscuous mode [ 456.626934][T14189] veth0_macvtap: left promiscuous mode [ 456.627002][T14189] veth1_vlan: left promiscuous mode [ 456.627047][T14189] veth0_vlan: left promiscuous mode [ 456.930310][ T9811] lo speed is unknown, defaulting to 1000 [ 456.930352][ T9811] syz_device_name_32_chars_1234567: Port: 1 Link DOWN [ 456.933429][ T5277] 8021q: adding VLAN 0 to HW filter on device eth4 [ 456.934586][T14232] smbdirect: ib_dev[syz_device_name_32_chars_1234567] removed [ 456.951080][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 457.065966][T14232] bond3: (slave bridge5): failed to get link speed/duplex [ 457.170089][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 457.179058][T14189] IPVS: stop unused estimator thread 0... [ 457.275807][T14189] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.275839][T14189] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.299519][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 457.335396][T14189] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.335429][T14189] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.383970][T14189] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.384003][T14189] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.409596][T14234] bond3: (slave bridge5): failed to get link speed/duplex [ 457.434350][T14189] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 457.434385][T14189] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.513446][T14189] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.540630][T14236] bond3: (slave bridge5): failed to get link speed/duplex [ 457.569187][T14189] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.605821][T14189] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.657695][T14189] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.669617][T14236] bond3: (slave bridge5): failed to get link speed/duplex [ 457.768625][T14189] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.799666][T14235] bond3: (slave bridge5): failed to get link speed/duplex [ 457.809630][ T5277] 8021q: adding VLAN 0 to HW filter on device eth5 [ 457.841760][T14189] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.937928][T14189] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 457.992789][T14189] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.118895][T14189] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.118928][T14189] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.141375][ T5277] 8021q: adding VLAN 0 to HW filter on device eth6 [ 458.196459][T14189] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.196512][T14189] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.266063][T14189] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.266118][T14189] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.328380][T14189] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 458.339038][T14189] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.416419][T14189] bridge_slave_1: left allmulticast mode [ 458.416455][T14189] bridge_slave_1: left promiscuous mode [ 458.416603][T14189] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.441789][T14189] bridge_slave_0: left allmulticast mode [ 458.447507][T14189] bridge_slave_0: left promiscuous mode [ 458.453351][T14189] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.473261][T14189] bridge_slave_0: left allmulticast mode [ 458.473287][T14189] bridge_slave_0: left promiscuous mode [ 458.475219][T14189] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.494032][T14189] bridge_slave_1: left allmulticast mode [ 458.494058][T14189] bridge_slave_1: left promiscuous mode [ 458.494446][T14189] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.505856][T14189] bridge_slave_0: left allmulticast mode [ 458.505879][T14189] bridge_slave_0: left promiscuous mode [ 458.506010][T14189] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.531572][T14189] vlan2: left allmulticast mode [ 458.531666][T14189] vlan2: left promiscuous mode [ 458.531944][T14189] bridge0: port 3(vlan2) entered disabled state [ 458.550126][T14189] bridge_slave_1: left allmulticast mode [ 458.550166][T14189] bridge_slave_1: left promiscuous mode [ 458.550311][T14189] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.570246][T14189] bridge_slave_0: left allmulticast mode [ 458.570273][T14189] bridge_slave_0: left promiscuous mode [ 458.570584][T14189] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.597522][T14189] bridge_slave_1: left allmulticast mode [ 458.597548][T14189] bridge_slave_1: left promiscuous mode [ 458.598079][T14189] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.617947][T14189] bridge_slave_0: left allmulticast mode [ 458.617973][T14189] bridge_slave_0: left promiscuous mode [ 458.618348][T14189] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.788985][T14189] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 458.801218][T14189] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 458.810934][T14189] bond0 (unregistering): Released all slaves [ 458.826080][T14189] bond0 (unregistering): Released all slaves [ 458.856987][T14189] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 458.866706][T14189] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 458.876023][T14189] bond0 (unregistering): Released all slaves [ 458.959824][T14189] bond3 (unregistering): (slave bridge5): Removing an active aggregator [ 458.960041][T14189] bond3 (unregistering): (slave bridge5): Releasing backup interface [ 458.977872][T14189] bond4 (unregistering): (slave bridge6): Releasing backup interface [ 459.028884][T14189] bond9 (unregistering): (slave bridge14): Releasing backup interface [ 459.072881][T14189] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 459.082708][T14189] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 459.092054][T14189] bond0 (unregistering): Released all slaves [ 459.094968][T14189] bond1 (unregistering): Released all slaves [ 459.100433][T14189] bond2 (unregistering): Released all slaves [ 459.105551][T14189] bond3 (unregistering): Released all slaves [ 459.110482][T14189] bond4 (unregistering): Released all slaves [ 459.115422][T14189] bond5 (unregistering): Released all slaves [ 459.121167][T14189] bond6 (unregistering): Released all slaves [ 459.128117][T14189] bond7 (unregistering): Released all slaves [ 459.139733][T14189] bond8 (unregistering): Released all slaves [ 459.144756][T14189] bond9 (unregistering): Released all slaves [ 459.158014][T14189] bond10 (unregistering): Released all slaves [ 459.239365][T14189] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 459.250387][T14189] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 459.260011][T14189] bond0 (unregistering): Released all slaves [ 459.268236][ T5277] 8021q: adding VLAN 0 to HW filter on device eth7 [ 459.393962][T14189] : left promiscuous mode [ 459.472954][T14189] tipc: Disabling bearer [ 459.473038][T14189] tipc: Disabling bearer [ 459.484559][T14189] tipc: Left network mode [ 459.645047][ T5277] 8021q: adding VLAN 0 to HW filter on device eth8 [ 459.912440][ T5277] 8021q: adding VLAN 0 to HW filter on device eth9 [ 459.983010][T14189] hsr_slave_0: left promiscuous mode [ 459.988479][T14189] hsr_slave_1: left promiscuous mode [ 459.989001][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 459.989018][T14189] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 459.996386][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 459.996403][T14189] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.029691][T14189] hsr_slave_0: left promiscuous mode [ 460.035486][T14189] hsr_slave_1: left promiscuous mode [ 460.041779][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.049492][T14189] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.057386][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.065217][T14189] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.080069][T14189] hsr_slave_0: left promiscuous mode [ 460.087307][T14189] hsr_slave_1: left promiscuous mode [ 460.093585][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.101214][T14189] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.109961][T14189] batman_adv: batadv0: Removing interface: dummy0 [ 460.119193][T14189] hsr_slave_0: left promiscuous mode [ 460.128490][T14189] hsr_slave_1: left promiscuous mode [ 460.134701][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 460.142389][T14189] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 460.150322][T14189] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 460.157936][T14189] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 460.174971][T14189] veth1_macvtap: left promiscuous mode [ 460.175009][T14189] veth0_macvtap: left promiscuous mode [ 460.176297][T14189] veth1_vlan: left promiscuous mode [ 460.176343][T14189] veth0_vlan: left promiscuous mode [ 460.187209][T14189] veth1_macvtap: left promiscuous mode [ 460.187252][T14189] veth0_macvtap: left promiscuous mode [ 460.187312][T14189] veth1_vlan: left promiscuous mode [ 460.187353][T14189] veth0_vlan: left promiscuous mode [ 460.210427][T14189] batadv_slave_1: left promiscuous mode [ 460.210534][T14189] veth0_macvtap: left promiscuous mode [ 460.210607][T14189] veth1_vlan: left promiscuous mode [ 460.210672][T14189] veth0_vlan: left promiscuous mode [ 460.227975][T14189] veth1_macvtap: left promiscuous mode [ 460.228002][T14189] veth0_macvtap: left promiscuous mode [ 460.228084][T14189] veth1_vlan: left promiscuous mode [ 460.228132][T14189] veth0_vlan: left promiscuous mode [ 460.448808][T14189] team0 (unregistering): Port device team_slave_1 removed [ 460.456731][T14189] team0 (unregistering): Port device team_slave_0 removed [ 460.576001][T14189] team0 (unregistering): Port device team_slave_1 removed [ 460.591974][T14189] team0 (unregistering): Port device team_slave_0 removed [ 460.640012][T14197] smbdirect: ib_dev[syz0] removed [ 460.754146][T14189] team0 (unregistering): Port device team_slave_1 removed [ 460.764813][T14189] team0 (unregistering): Port device team_slave_0 removed [ 460.899013][T14189] team0 (unregistering): Port device team_slave_1 removed [ 460.932742][ T5277] 8021q: adding VLAN 0 to HW filter on device eth10 [ 460.933740][ T9809] lo speed is unknown, defaulting to 1000 [ 460.933759][ T9809] infiniband syz0: ib_query_port failed (-19) [ 461.220080][ T5277] 8021q: adding VLAN 0 to HW filter on device eth11 [ 461.547919][ T5277] 8021q: adding VLAN 0 to HW filter on device eth12 [ 461.741412][T14189] IPVS: stop unused estimator thread 0... [ 461.747468][T14189] IPVS: stop unused estimator thread 0... [ 461.847130][ T5277] 8021q: adding VLAN 0 to HW filter on device eth13 [ 462.033438][ T5277] 8021q: adding VLAN 0 to HW filter on device eth14 [ 462.237763][ T5277] 8021q: adding VLAN 0 to HW filter on device eth15 [ 462.438601][ T5277] 8021q: adding VLAN 0 to HW filter on device eth16 [ 462.642959][ T5277] 8021q: adding VLAN 0 to HW filter on device eth17 [ 462.840998][ T5277] 8021q: adding VLAN 0 to HW filter on device eth18 [ 463.054735][ T5277] 8021q: adding VLAN 0 to HW filter on device eth19 [ 463.268944][ T5277] 8021q: adding VLAN 0 to HW filter on device eth20