last executing test programs: 3.092239351s ago: executing program 4 (id=4862): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a1d010000000000000000020000000900010073797a3000000000080002400000000098000000030a0102000000000000000002000000090001f573797a30000000000900030073797a32000000006b00030091abc12404d0c4c731b168d80d1f7f1dbb33f596f8d2c561caaa1084771e6f3ea6b67f18fb9a417e95479db73d446fa06daf7a4e3a6d93b186b035fecf7ee8"], 0xfc}, 0x1, 0x0, 0x0, 0x40010}, 0x4000914) 2.753899614s ago: executing program 4 (id=4864): connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$netlink(0x10, 0x3, 0x4) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000440)="580000001400192340834b80043f679a10ff3d425f0600ffa600000000becc4b381eaadc1af23457e792945f918be4f04247e374b97164009400050028925aaa160000c600ff5f442059e12817c009fb2366e6cfe1dae7d9", 0x58}], 0x1) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@ipv4_getroute={0x1c, 0x1a, 0x2, 0x70bd2a, 0x25dfdbfe, {0x2, 0x10, 0x0, 0xc, 0x7e, 0x4, 0x0, 0xb, 0xc00}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) (async) socket$packet(0x11, 0x2, 0x300) (async) socket$netlink(0x10, 0x3, 0x4) (async) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) (async) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000440)="580000001400192340834b80043f679a10ff3d425f0600ffa600000000becc4b381eaadc1af23457e792945f918be4f04247e374b97164009400050028925aaa160000c600ff5f442059e12817c009fb2366e6cfe1dae7d9", 0x58}], 0x1) (async) socket$packet(0x11, 0x2, 0x300) (async) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) (async) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@ipv4_getroute={0x1c, 0x1a, 0x2, 0x70bd2a, 0x25dfdbfe, {0x2, 0x10, 0x0, 0xc, 0x7e, 0x4, 0x0, 0xb, 0xc00}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) (async) 2.680848828s ago: executing program 2 (id=4865): vmsplice(0xffffffffffffffff, &(0x7f0000000680)=[{0x0}, {&(0x7f0000000a80)}], 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000003800000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68af5f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c0005800800014008000008080002"], 0x1ec}}, 0x0) 2.621373656s ago: executing program 4 (id=4866): r0 = accept$unix(0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000580)=0x6e) getpeername$unix(r0, &(0x7f00000005c0)=@abs, &(0x7f0000000680)=0x6e) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20000000520001002000000000070000000000000c00dd1936618b8e831fa244227105c7e54b087e7d40db14580526f8fde9be5f690d07a2a76ac3e57e4ca620f31980b9b6e7ed86c6bdcfaf422434947b2b60356993346610c14a51e407d2180cc010b59caee215a40220cc37487236baabc57176bfeb11fb14fe487d3b6c44f993d1f5a202cf3420783481055d3f8b08b50c87191077285d1e6e59bc1418c1c169", @ANYRES16=r1], 0x20}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000004001000ffff00000b00000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="000000000000eff40000000000005c1f7aa4a011e08ff1348a3da8cdc04adc1b9274f7f5dce7eebea0ac83d23347ebee0c352e71dc4a4645228efc8086aa936a3c7f098a52ffe8171b2b7e12f83062d9bc56391de1492070765b97316b852dc5528650573fb885259ab0d1d5b9328050579cf4346dbedb6def76bfdd91e68d29b3f3da72c2e0b890dca9433c96f4a8ad8a603f70df60c99803ff08b4911bba7ed5e18af66647dbb5"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r3, 0x600}, 0x38) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000001240)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb2011aa006b370b6388f52de303b71d0c3ce7b6"], 0x0) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f00000000c0)) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getpeername(r5, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000480)="b11430c100"/16, 0x10) socket$rxrpc(0x21, 0x2, 0x2) r7 = accept$alg(r6, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f00000009c0)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="3f5e97", 0x3}], 0x1, &(0x7f0000000640)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x20000000}], 0x1, 0x24000040) recvmmsg(r7, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001480)=""/194, 0x34000}], 0x1}, 0x4}], 0x1, 0x2120, 0x0) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCDELRT(r8, 0x890c, &(0x7f0000000f00)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={'nr', 0x0}, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000000), 0x0) sendmsg$802154_dgram(r4, &(0x7f0000000540)={&(0x7f00000003c0)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000400)={&(0x7f00000006c0)="cd62aa1a2c5cd7ecb03d9bb63e4b46e147db694de1af077daaf1529c86be71d45c050474f11ea3a0e31d31de6d74cb0f43658ce4656debc0bf128d3b9d75d6c72380d245b48fb12507d40b0819269b21efc58a61e4f37d246b230dbb08ba2b5f3fc4", 0x62}}, 0x0) 2.36967593s ago: executing program 2 (id=4870): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) listen(r2, 0x200026) listen(r2, 0x0) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x400c941) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r3 = socket$kcm(0x21, 0x5, 0x2) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x800) sendto$inet(r5, &(0x7f0000000000)='\x00\x00', 0x2, 0x24008800, 0x0, 0x0) r6 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000000340)={r6}) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8001c00180081064e81f782db44fd56170d12a0b9b545c7", 0x18}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e3, &(0x7f0000000180)={r6, r9}) accept4$tipc(r5, 0x0, 0x0, 0x800) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000000000001001"], 0x10b8}, 0xff4c) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000008c0)={'vcan0\x00', 0x0}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, 0x0) ioctl$sock_inet6_SIOCADDRT(r11, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x26}, 0x5, 0x6, 0x0, 0x100, 0x4, 0x80000002}) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000900)=0x0, &(0x7f0000000980)=0x4) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000001300)={'syztnl2\x00', &(0x7f00000011c0)={'gre0\x00', 0x0, 0x7800, 0x700, 0x80, 0x10, {{0x2f, 0x4, 0x3, 0x1f, 0xbc, 0x66, 0x0, 0x0, 0x4, 0x0, @private=0xa010102, @loopback, {[@timestamp_prespec={0x44, 0x2c, 0x96, 0x3, 0x6, [{@remote, 0x6}, {@rand_addr=0x64010101, 0x1}, {@rand_addr=0x64010101, 0x9}, {@empty, 0xfffffff0}, {@empty, 0x81}]}, @ssrr={0x89, 0xf, 0xa3, [@loopback, @loopback, @empty]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x24, 0x0, [{0x2, 0x2}, {0x5, 0x7, "66852f9575"}, {0x2, 0x6, "66199f48"}, {0x7, 0x2}, {0x0, 0xb, "2085595c4dedbce0d8"}, {0x0, 0x2}]}, @generic={0x89, 0xa, "3b2891a17f9ef5be"}, @cipso={0x86, 0x2b, 0x2, [{0x7, 0x5, '_>K'}, {0x6, 0x12, "f56ecc41a0a3ed275d4b0245896c8ae7"}, {0x0, 0x2}, {0x6, 0xa, "52279fb8853eb234"}, {0x5, 0x2}]}, @end, @rr={0x7, 0xf, 0xdb, [@private=0xa010102, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) sendmmsg$inet(r5, &(0x7f00000042c0)=[{{&(0x7f0000000100)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f0000000140)=[{0x0}], 0x1}}, {{&(0x7f00000002c0)={0x2, 0x4e21, @private=0xa010101}, 0x10, &(0x7f0000000840)=[{&(0x7f0000000300)="4a707249efb45598f3fc9fc1fa", 0xd}, {&(0x7f00000005c0)="38b9db632199ee3c8615eb7182601609aa053dbe701f5c1785b0987ae8220f1a1be421c189f03eacb608886f665f0adf5369ec393640806e544ccea35ac6aa", 0x3f}, {&(0x7f0000000740)="4f8900c3a3b1df7fa7e546290d7b21d10f548b981dba63e34fd59dad8d6e5bcdf23aecb5c69a47977f37be947d989c41cac73af5dfcfc482731c3d8fe6305bc79f10ce65dafb827205e5b0e98373f347a19ed5feb5715ad397784e7a7a7ac9366bdd427f5a982498e59fbc4c82a0c0493b63c03c80482deadbd680cf8661ba35e7885d7f31d030bb66a563fde4116d130af9662633d42584d1875389bf082dcf43d914ab4291f532290bbbe4c2a7e18145b31605", 0xb4}, {&(0x7f0000000600)='-', 0x1}, {&(0x7f0000000640)="b05b3cd4c8e5", 0x6}], 0x5, &(0x7f00000009c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0xe0}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @loopback, @multicast1}}}, @ip_tos_int={{0x14}}, @ip_retopts={{0x34, 0x0, 0x7, {[@noop, @lsrr={0x83, 0x1f, 0x42, [@dev={0xac, 0x14, 0x14, 0x40}, @local, @rand_addr=0x64010102, @broadcast, @dev={0xac, 0x14, 0x14, 0xd}, @multicast2, @multicast2]}, @rr={0x7, 0x3, 0x37}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x93, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r12, @remote, @multicast1}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@rr={0x7, 0xb, 0x26, [@multicast2, @local]}, @generic={0x88, 0xe, "201902f66de3b16de0d14ae7"}]}}}], 0x130}}, {{&(0x7f0000000b00)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001100), 0x0, &(0x7f0000001340)=[@ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x24, 0x0, 0x7, {[@rr={0x7, 0x13, 0x98, [@multicast1, @local, @multicast2, @multicast2]}]}}}, @ip_retopts={{0x5c, 0x0, 0x7, {[@timestamp_addr={0x44, 0x34, 0xa8, 0x1, 0xf, [{@empty, 0x5}, {@multicast2, 0xf1}, {@rand_addr=0x64010100, 0x10001}, {@empty, 0x200}, {@broadcast, 0x2}, {@private=0xa010100, 0x4}]}, @timestamp_prespec={0x44, 0x4, 0xd2, 0x3, 0x2}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4, 0x1}, @noop, @ssrr={0x89, 0xb, 0xb1, [@local, @local]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffffffa}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7ff}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @dev={0xac, 0x14, 0x14, 0x2d}}}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r13, @loopback, @remote}}}], 0x150}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000002c80)="af59e9017d28930587183c09b660a961cab132074cc616e2c95bf0bde30c0b57ae165612bb982122e30c5de1350ac57d668d3d0228e1775fd9102feb52d723400cdc8398225f9d95f4a76a15fb1158d801bfa9636758842f4e3c4a33bb40f35ad7cef25364187e6dbec83c005a58ff90efcb534e78ffbfcc8ee55918cb778b6c2f9a8fe2f743817cdded816b4d4dca6b408029b6f335042b1fd2a4227759838102e0c3fb8179015ec92739f9b5df08a2e563419558bfa48c18071b925d5189a47649396e2f389c383a7b48732734f214d978259fd13498e06963e550a4d9956e273b851273f5b1c6e9c8baa6c117771b779f58b88527860670a47c03b89edbcca31348c9062d103ffa445c1053dadbb52033d4f46b4651fd868ad476f857e282b2044ac4047b12b29f147fe63a7d458620159c86a830bcb66b13f08f9b9b2364c6a3139eacd2d523144d55a4cbb9f0a9e17795bbcc7e329eb67901c762e9ce39b0ef5adefc873a918b79aa1501f27b1cec784d904922d2e8edebece93674c2d2f23674b38dc3bc2f4ccf41f065c1e557aed03e7d09558e83c266590c537b54ae09eea5d418d9efed69d176f74a161208c0b4143d7cdfbfcd8e09e97df282715adca9107c9e1aeb620beb23dfb34b060ad4aec33a99bbdd6f9012202ca930a4ea466eac47b2bf3cd948adadf47200f277d668369d01c925f4c998572dd86144d0f2edd627cb7e53e12e900e80cc8a9938f2eb36f06d547963d85667380535ebb05994d53fb5a0340aaaf36acca56020458944987b158b38f9cb5a35aa4b2f3674442237ae89ca1600fba9c43c763b742fee603391a610248f55bc893a504ae8a003ca7813e35f83bab7f283b7280c4a98ebe3f7a7a4126903ec7b378e210d4a2a32438b08286b45b5f54bcc21f3fcf228602f399d95042396407cbb93c78901f133316861dca7eb832b2d7b541dab53566db3520d2d9c083e29b30431373e71ead7b2087856fb4c7d95cb0944d5f112612630f7887c5ee779486403ef563fb735a46490ba7e1a38ba5c127d6d79739be46a7025a07cb6eb5cabedd0254df582f4579964b8170327ef1c03910c0ce1042a3334822ee7700b6ce849226bd2562e10812c5a66280a8cb4df20c98e6df74ac5297e34a6744e809d6d8f440fa53bcf47800e570b71c65121c28601f6c1c34aae149ddabcd60fd086a477ac7cda51071843362939beb6501ed4b1ccdc152b0008d4d8bfe45a345d09448c687c0e0a8ffd9c36a7fb22b7c408186c62710b67936a3fceca3439e421b0c8e5da68bd1660b9cc73cde6706a2738e39521864cb832e369c9ec34df0e45a1fc2cf5de3dece50446c8914e94672d93b7d4c80624b35a5d632442529b28e33a6982b440b897c405979be3854c388e3449895569b13c976605e3e19a100c9efb20b51ed0e8ce21a5d20f443d796ca4552d22e41a3c60fe42a96bd7e097d6d0b6f80580848f7e3ce0d343b12148d2d217580c28d6b6d86003be4466f32105791dc6ff4c73bf11e29134d6c5e766b127c94b1b83b60f98b2a5b0b7ac59d496bb1ab919b3d95806933d9beac4a53b2af0fe16b3f87906748afa047a27978e381a28743cead21201dc599da91875858e3e08fdaf580edd2e50184234b2bd875bb090634d17ada042dbd88c767d53fe4fe51d5a8c2150a332464f19ff0573f694f97cf46dd072d1355836aee2dcd09463c8fd937fe31deb8884d0e73d6f3660fe6b1a0eee62ea136edd8ca0ee2c6bbee0ded88535a4a83cabc02534d13878896fceceb1041d1df2b32ecb976e44be41fb8fc9289c0a3c7c3c248f58241d71d981aace0832541c58ad4ad5f4b2e42edce454668202495576a2df6210cbcc2d80304c1b7c5cfb7f166e0e05674fffe40e5ac0d630446dc6e65af54c015976429d520dd3b71b40d1ac918c093f1470c35cfc85d71d4b26c0bb5d30c6711e18ac154797d948391ecad034840b265ee04fa11bedf9483dca57ca5dc605d7d24f8dc3062cac9741befe49ac76d1279a402384d87c73166444d971ebf1f07567335362ced58a950609fca1ab4a8a864339c32a46b2ce2ec14ae69ed23d2c0e6dc73605f26c0d89fbfcf1287a8621078e3992ed2507838770606e51a7d81d5b6b226650df91a6be5f9d62bf9d648d9801b7a9e2b1a7b264d28b69d52596979484a324cd869c8cf51e7b472961406a57ea73b1d9071562a2d13979cfb20badfa37047f57c01ebde8374302ed3ba777fdf45018660e6595a5d1c5adbbaed414e849e910f1ac55e18c4f15559408ffc85c4697efae42a73bf69c367c32aad3367516f5089a2cb37edd9dcfb53ff73d030a2340617ee85eefe5710fd5a2303843508d5102551b39b3f894b08968aceefadb9db9b63eebd077c71bf7cd96fc512688d3f315b940f2368cca3e9ddf04288dda3a0d6f7d52ccec3d8d800f702ba54e04addbc8fc446e270a18935de77a2cdbd527e34cc543fa69bce20ad9207892c856b94cc0ed9eb66ad19e1e01b12d7f6594d8be20b535fdeb33e0af419405ec7e8d9d75ae3ddc2d9c1f35455d9e2d5c447a7155388795842f0cd83b66d0ad3228a8c720d4af4522235105bb4de7ad3fac9c27a3c2603599a4f38cdf80aeae60db48366cd98734dd169ac2eeb860e9796c822d072a0b81757e7d968c9192b99857ed7ab871715911af6e4ab88e2a7c80c8e85a45d1edee92368027f345571f594ecfd650c092ca04da4be1f02644b1359f925072605c15f169f8655b97e45ef9f05451df57084bbf889308eda35f2306913bf9964f123f171081b28bf9fa0fcb99acf3e623b7142c15255b575044f537cbace4fc7ce3e93db765d5705dbaae7f04ad25b4a753f2f091ab7ae153859649ba6297dcd0996911cdce167790eca21df4ccc82c20ef8bbf92f23cdc51ecde9072c2c661a0f4f0aa5c5d6a1be32fdc5a6bb241a85a2af4a30d2b08ca64e056cf3ab7e2590ef9b7c9a994b1740df4c0ca9b17bf8df3a2f1dc570391ee9f1d133bf9dd00df4e8a2fe642e9262cc4def6810ef12551d4b1a80d6a9cf9deb5f3d324f042602c927986bcb381a7c38841352a7a00edda9c910bac7b6dc32ae180ff9657421fefb6cff760a9ac118eabd419c51ee97b60630cb1f67db90dbbf0a0e3265637ec418e9aaf87b524c9841f4e33597ca83001317cc6bdf5ae5068caf03813d5bcec54640c150411863531fa817d388859fee652981c9d364c165fd909a9a95ba167dbf293236ab8ada2487750d7bdd28d56ac96108c9f9e970db356941430f82fd938aa73bb78fd1f724c4d7d912c94209d8f5ee56317b575f0c7025d5bb82f92958d6d9e245e5ff035e1eadd731f26f303a346acb0219a48b3b3253a74265f73d5df42299fdd0f38b3d282a40a91c99653ae1d2bb8cb06772e83caf13a3bfb80465dd96a35d81a43d860ae6326fbcdb76334dcd79baa0db93df5ab3581e2c6a1a3b03ad22ab09f074d43d88fe1dadf8eaff977ebac0efb6b9acaee954e85474cf1a66ce582307414459f4da9393b13d0f05db3e8ab5ff5ffdd58ae9ccffb42d6ed02ee200ffc3d1da296c0ea4a87e3ac0dace62f10f050f3765b75abb61dcbd8cb5e43688a86959ba7ad43370399fdad81bfe33e52abfdc09b46a79b5668f9cc24a5bfd5289c21502306ae6660aedceb15fcefbf9fd19d5976c39142b55dd9791d1a7247231b7c8be54e81b0dd5f6655463de0608eb609dad1896780262d82bdd0d43cb0be7df0b0bf439fc85869f3279ff6cecee932cf4c1505bf61347d538ff8f4a30dd61529709211b3a74ca5ed3c28a088cd0d4304220d3c40053360b2af11712e93a0453fbf2d4ae96cff1cf9852e96532cae82b430f6ec61ebcadab8e06efd84a6d2eff721975fa8e5175d776d9dc55714f2edcc6ef2fa9220ce297e73fc82d639a45fe09dc3659ae4c649fb30b08a94facc8a6a01478317bf81a2c9029cc47bde90b99d6181222f8e70d50647382f6bf55f0740a257984e275d59d1eaef105992c507d0c744ba94daf5d2102ace552285921e4b72b9edf7e67a356bc8407a0805c3b157d38a70440e7b3db6d7606fb28fe4596792eabe572b5a3801cd3039d004ca4764ac2249da3e3ef9bbd86a66e4c9505c14fd6416d8b4f85198cc604a698a46e65142996283508ec99df11f56d907248b8a1938956f0f5f7c3883ca963fac2c6d333a04f719b4245954b553571edeb43b8ef37352855e925f8fcf6571c0f309bdba670379916c7d9371", 0xbd0}], 0x1}}, {{&(0x7f0000001a40)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001a80)="2301df29ca56b5d6898a186fc24893d4ce3c8925aafc510f4355a06de94da6eaa57ebfd00a828fef2f026ed6cb413819bb6ea621b6081afb42437273990c5b57d61e0158edd6672e84afd230313db0ef3835bcd3eb525d81f4da71bad7d4c5c1d7ff4336ed66267196ee23975677a46cded8d9120288c6bbad00fdbdb2b26384eed8fc10aeafc6c2e8c492f9da6221d4e04d2bff7604a7e9fc495aba301a69b192a2fcd08ab1fc77415b7151ba3c776a766be85d1fd0c07bbe8d9cfde69491740babb69547c6d7c93ef54d4a8b77f619ca", 0xd1}, {&(0x7f0000003c80)="1c69b5cb466630fe176c1896eb1b299a045dd859fb02ea7757f7bc6ae67b1c86e8a9875fb569d6ea2b6326bef9d9cbdc5196383f88f80dd33d43f345b72f3dcfa355e472263f08e6ff2929769e72a337661a21738243251256737dc9880b81f3bb30404a6ca5aed71e6825abb22d422a1af394cea38b7ec18532f0bf9480309785d7867276bda0e9413c2c25dde5160a4533c068f1fd6b4de668906eef552951817f76ed1ed51307723a2dd9daea1516d1be9518ed6bc0da5b493b5fb4dc28f8b654a7e36c2ee6975b", 0xc9}, {&(0x7f0000001b80)="c28c82c0be7f9a753a5e62623c533405611513d630342923cea28b9e08029225564d6d81d07b74a4a82cc5c93b68f47b3a34fd02317293371e5c41424b0c8dc8631675cc92d2814f42b0de", 0x4b}, {&(0x7f0000003d80)="6ebf505606d58b9e16fcf6b8b042ed7c47a924890bfd55e6e9d01cbbf570340f0b8ea98235577354ed3d1438ab677891a39734d224b14b800bd7938956480a32685f5dcc69ce7d75cc3cb5559b9cdba3642ce63d0fda7cc89155fee787", 0x5d}], 0x4, &(0x7f0000003e40)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x1a1}}, @ip_retopts={{0x18, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1000}}], 0x48}}, {{&(0x7f0000003ec0)={0x2, 0x4e20, @remote}, 0x10, &(0x7f0000004140)=[{&(0x7f0000003f00)="0e6d7f0b4d99a98994f4f23fdce6fe7acd4d6739c6f2d5ed085e521512ec0eee44d3097e2749e368a3ccde21168294193b14e28a49254d9932dcf1ea61d53c4a33335b94b20f3b6a98e8ab1338019dd984ec548051415393ba3d9c91ab7ead4d6b832f8b45c12f864fef470753c883e74bb668187c5995b46f407d7d754e6274d5649342dbccbb42fe434e50d2add44f06762c8d5b", 0x95}, {&(0x7f0000003fc0)="059e71db280ac647e4a5c1c81856db426ea2e164155bda4b9f65ca486f5506168aab26bfb3ba5d63da21648cd7763493af4cbbee5590f9ea3328a0540031865732393184d77a71ceaff75a398af2344f35e3e6b8a0a0132bc0aaa406dedba92a2a4318c67ff3bceff10c421fbc65", 0x6e}, {&(0x7f0000004040)="f85928adf79c987ca5", 0x9}, {&(0x7f0000004080)="0dc2ed59a8f11c451eb775f20cea5cd3410239cbead5d5d06ca8637e316be1649c176d04e1f2f746b7be3c09b66e295228e0bf", 0x33}, {&(0x7f00000040c0)="6c3251b0efdc5f205eed782fe5d21da81569743111a34996c29c4de05b1d54115d3e512f9cad340df7427b9d45a0464edcdf679ae3416f195b6ad5dc5e93ca897acb354b45f22089b20fdcc6d1a7c583a74501c28d1aafd7f4d4dc52053971", 0x5f}], 0x5, &(0x7f00000041c0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x80}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}, @ip_retopts={{0x78, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0xca, [@multicast2, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x20, 0xd7, 0x0, 0x1, [0x1, 0x2, 0x1089, 0x6, 0x16e4, 0x5, 0x5]}, @timestamp_addr={0x44, 0x2c, 0xa, 0x1, 0x8, [{@empty, 0x4}, {@private=0xa010101, 0x400}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@multicast1, 0x8}, {@multicast2, 0x1}]}, @generic={0x88, 0xd, "5c57dbaa1f6924c15cd171"}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}], 0xc0}}], 0x6, 0x4000000) 2.356778687s ago: executing program 3 (id=4872): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000001400), 0xffffffffffffffff) setsockopt(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a40)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x130, 0x2a8, 0x2a8, 0x208, 0x98, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x4}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x3}}}, {{@uncond, 0x0, 0x98, 0xd8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x3, 0xfffffff8, @ipv6=@private0, 0x4e24}}}, {{@ip={@broadcast, @multicast2, 0x0, 0xff, 'pim6reg\x00', 'ip6erspan0\x00', {}, {}, 0x0, 0x3, 0x10}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x5, 0x9, @dev={0xac, 0x14, 0x14, 0x25}, 0x4e23}}}, {{@uncond, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0xfffffffc, @empty}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(0xffffffffffffffff, &(0x7f0000000000)="05000000010001", 0x7) close(0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYRES64=r0], 0x40}, 0x1, 0x0, 0x0, 0x4d}, 0x4008000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c000780080006"], 0x5c}}, 0x20084884) r4 = socket(0x8, 0x3, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x44084) getsockname$packet(r4, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @private=0xa010100}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x510) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x4f) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000080) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048014}, 0x20040040) 1.986077543s ago: executing program 1 (id=4877): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0900000004000000e27f00000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000100"/28], 0x48) r1 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) close(r4) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000440)="be6f88e90400", 0x6}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="2000000000000000840000000200000006000900280100000b008002", @ANYRES32=r6], 0x20, 0x6044}, 0x6) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002940)=@delchain={0x38, 0x2c, 0xf31, 0x70bd27, 0x2000, {0x0, 0x0, 0x0, r10, {0x8}, {0xfff2, 0xffff}, {0xffff, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x10, 0xf}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x6, "8a5ecb05fc9c"}, &(0x7f0000000100)=0x2a) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0xa, 0x17, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf09000000000000b609010000000281650000000000000018010000646c6c2500000000002020207b9af8ff000000002e9100000000000037010000f8ffffffb702000008000000b70300000000000014000000060000805f93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.697636574s ago: executing program 0 (id=4881): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x4000000) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) bpf$PROG_LOAD(0x5, 0x0, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f00000002c0)={'broute\x00', 0x0, 0x3, 0x0, [0x2, 0xd, 0x5, 0x9, 0x4, 0x4], 0x6, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000240)}, &(0x7f0000000380)=0x78) r2 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0x1, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x3}, {}, {0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c011}, 0x4000000) getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, 0x0, &(0x7f00000005c0)=0xfffffffffffffed1) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x44}}, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f00000008c0)=ANY=[@ANYBLOB="84010000100001000000000000000000ac1e0101000000000000000000000000ac1e0101000000000000000000000000000000002000"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb000000006c000000000000000000000000000000000000000000000002000000000000000000000007000000000000100000000000000000000000003000000000000000000000000000000000000010000000000000000000000000000000000400000000000000000000000000000000000000000000001000000000000000000000002abd7000000000000a0001060000000000000000920003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500200009d5560361534539247ae96b9b006a93ee0f2a21f5c1e00000000520adf1c5a08a900bdeaed1c7c0dbdf8432f4937e59b965b4cc685b2a9b2e66489f26bc054e77358ced1ef5ea2a86e5d00001b36136c2d213e6f0a0c3bb40626a97356cb071a1a0b15d600"/353], 0x184}}, 0x20000000) 1.671941175s ago: executing program 3 (id=4882): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'geneve0\x00'}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r0}, &(0x7f0000000000), &(0x7f0000000040)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) 1.623818247s ago: executing program 4 (id=4883): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x4, 0xf}, {}, {0xffe0, 0xd}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_EMATCHES={0x34, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0x0, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x3, 0x6e4, 0xc}, {0x4, 0x80000000, 0x3, 0x1, 0xf, 0x1}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.527525365s ago: executing program 3 (id=4884): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f00000000c0)=@framed={{0x18, 0x5, 0x0, 0x0, 0x40000}, [@call={0x85, 0x0, 0x0, 0x7a}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x101}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000080)=r0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x4}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x28}, 0x1, 0x2d00}, 0x0) 1.478075757s ago: executing program 3 (id=4885): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="6000000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0800000008440000380012800b00010067656e65766500002800028005000900010000001400070000000000ff0000000000000000140001050003000800000008000a00", @ANYRES32=r2], 0x60}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.463649437s ago: executing program 2 (id=4886): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000004c0)={'syzkaller0\x00', 0xf101}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) read$alg(r3, &(0x7f0000000b80)=""/237, 0xed) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0d00000004000000040000000900000000000000", @ANYRES32, @ANYBLOB='\x00'/17, @ANYRES32=0xffffffffffffffff], 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r7, &(0x7f0000000000)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r1, 0x80047213, &(0x7f0000000400)) write$cgroup_subtree(r4, &(0x7f00000005c0)=ANY=[@ANYRES8=r6, @ANYRES8=r5], 0xa97b8fcc84c81ad8) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r8) sendmsg$802154_dgram(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000440)={0x24, @none={0x0, 0xffff}}, 0x14, &(0x7f0000000340)={&(0x7f0000000280)="f2b70dd3d3a1ae0ecafaac5c88d26ba9a03fb297b424b2be0b0e2d3d4f3b381757ce9e5f2131ffac427408fdb4c019610dbbc8dda94f7ea3f564b68d105d16d14aaa5d2ad33259a82a14bb450cdc6b8cb757b79fb47ea55b998f299438b4c123303fdf53bd001ffc924ddd3d7a2263b0e00bedc826642a523997d56c08a8c07e3a17294ed00288ec6f6298b8143f5667c6a8691ac4850569e4434dcc2304bb001ea38712659703e4b1ce35ad25ff088b627c1d357aee2684bededd667d", 0xbd}, 0x1, 0x0, 0x0, 0xfb8045516aeb107}, 0x20060881) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb01001800000000000000500000005000000004000000020000000000000e05000000010000000000000000000001050000000800000000000000000000830000000001000000020000000180000000000000000000030000000002000000020000000b000000006161"], 0x0, 0x9b, 0x0, 0x1}, 0x28) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="000006100001aaaaaaaaaabbfe8000000000000000000000000000aabbbbbbbbbbbbfe80000000000000e6000000000000bb"], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = socket(0x10, 0x803, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'wg2\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x400, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0xf, 0xc}, {0xfff3, 0xffff}, {0xd, 0xa}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x3, 0xc}}}]}, 0x3c}}, 0x0) write$cgroup_devices(r8, &(0x7f00000000c0)=ANY=[], 0xffdd) close(0x3) close(0x4) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000500)={&(0x7f0000000700)=ANY=[@ANYBLOB="8000000009060300000000000000000002000003050001000700000030000880100007800c001b4080000000000000011c0007801800026814000240000000000000000000000001000000000500010007000000200008801c8007801800148014000240000000000000000000000000000000000900020073797a32000000007380743466105c4493f90dd2defe065e4846cde9c36f226f5f99174d43a5c456c08c8f95d971e308af61"], 0x80}}, 0x0) 1.403431036s ago: executing program 4 (id=4887): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000940)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) write$cgroup_pid(r2, &(0x7f0000000000), 0xffffff98) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000a000000009500000000000000ed0759cb47cd90df41fa7a40c72a22dcc53a83731c39b01fceb7"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r4, 0x0, 0x0}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r6, 0x1, 0x29, &(0x7f00000000c0)=0xa, 0x4) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, 0x0, 0x0) sendmmsg$inet(r6, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) recvmmsg(r6, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}, 0x75}], 0x1, 0x2100, 0x0) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="3000000040000701feffffff00000000017c0000040042800c00018006000600800a00000c000280040012"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) unshare(0x400) vmsplice(r2, &(0x7f0000000440)=[{&(0x7f0000000240)="f9", 0x1}], 0x1, 0xf) splice(r1, 0x0, r2, 0x0, 0xc, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0x54}}, 0x0) sendmsg$NFT_MSG_GETTABLE(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x400c895}, 0x24000800) write(r0, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket(0x3, 0x3, 0x20002) sendmsg$nl_route(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="a400000010000104000000000304000000000000", @ANYRES32=0x0, @ANYBLOB], 0xa4}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) 1.122633375s ago: executing program 3 (id=4888): socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4001, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000000)='cdg', 0x3) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x931766f6319eed40) shutdown(0xffffffffffffffff, 0x1) sendmmsg$inet6(r2, &(0x7f0000003180)=[{{0x0, 0x0, &(0x7f0000002680)=[{&(0x7f0000001340)='\'', 0x7ab8}], 0x1}}], 0x1, 0x0) r3 = socket(0x40000000015, 0x5, 0x0) sendmsg$inet(r3, 0x0, 0x40) sendto$inet(r3, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt(r3, 0x200000000114, 0x2715, &(0x7f0000000580)=""/102393, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x83, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000001c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "000200", 0x14, 0x6, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x2, 0x8, 0x0, 0x3}}}}}}}, 0x0) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) 1.104239272s ago: executing program 1 (id=4889): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000020000000000000504000000002e"], 0x0, 0x37}, 0x20) 1.035380998s ago: executing program 1 (id=4890): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000005880)=ANY=[@ANYBLOB="280000002c0007012bbd7000ffdbdf25077c0000080001"], 0x28}}, 0xc010) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), r0) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xc0, r1, 0x400, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'batadv0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x26, 0xc}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x76}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x5}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x40010}, 0x80) 962.816761ms ago: executing program 2 (id=4891): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x44, 0x4, 0x2}, 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000020000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800001100ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) 909.301242ms ago: executing program 1 (id=4892): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000001400), 0xffffffffffffffff) setsockopt(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a40)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x130, 0x2a8, 0x2a8, 0x208, 0x98, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x4}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x3}}}, {{@uncond, 0x0, 0x98, 0xd8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x3, 0xfffffff8, @ipv6=@private0, 0x4e24}}}, {{@ip={@broadcast, @multicast2, 0x0, 0xff, 'pim6reg\x00', 'ip6erspan0\x00', {}, {}, 0x0, 0x3, 0x10}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x5, 0x9, @dev={0xac, 0x14, 0x14, 0x25}, 0x4e23}}}, {{@uncond, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0xfffffffc, @empty}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000000)="05000000010001", 0x7) close(0x4) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r3, @ANYRES64=r0], 0x40}, 0x1, 0x0, 0x0, 0x4d}, 0x4008000) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c000780080006"], 0x5c}}, 0x20084884) r4 = socket(0x8, 0x3, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x44084) getsockname$packet(r4, 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e24, @private=0xa010100}, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000180)=ANY=[@ANYRESDEC], 0x510) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x4f) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000080) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24048014}, 0x20040040) 836.806685ms ago: executing program 2 (id=4893): socket(0x1e, 0x805, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 734.944485ms ago: executing program 0 (id=4894): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1805000000000400ffffffff7fffffff850000007a000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffefb702000008000000b70300000101000085000000060000009500"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 695.447643ms ago: executing program 0 (id=4895): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002020000000000000000100095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000980)={r1, r3, 0x25, 0x4, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x8}}, 0x40) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000a40)="2e9b3d0007e03dd65193dfb6c575963f88", 0x11}, {&(0x7f0000000240)="0017", 0x2}], 0x2) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) r5 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r5, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r7, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=@newlink={0x4c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r8, 0x9801}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_PROTO={0x5, 0x9, 0x89}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @remote}, @IFLA_IPTUN_PMTUDISC={0x5, 0xa, 0x1}]}}}]}, 0x4c}}, 0x0) sendto$packet(r5, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c642b4a1b7880610cc9", 0x26, 0x0, &(0x7f0000000040)={0xc9, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) r9 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r9, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, 'C'}, {0x10, 0x110, 0xd}], 0x28}, 0xfc40) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_lsm={0x6, 0x6, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000fcfffff7000000000000000018200000", @ANYRES32=r4, @ANYBLOB="0000000004000000c30000000000000095"], &(0x7f0000000180)='GPL\x00', 0x2, 0xc2, &(0x7f00000002c0)=""/194, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) 662.461668ms ago: executing program 2 (id=4896): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x10002) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0xcb) listen(r2, 0x200026) listen(r2, 0x0) sendmsg$inet(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)='l', 0x1}], 0x1}, 0x400c941) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r3 = socket$kcm(0x21, 0x5, 0x2) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r5 = accept4(r4, 0x0, 0x0, 0x800) sendto$inet(r5, &(0x7f0000000000)='\x00\x00', 0x2, 0x24008800, 0x0, 0x0) r6 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x89e2, &(0x7f0000000340)={r6}) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000580)="d8001c00180081064e81f782db44fd56170d12a0b9b545c7", 0x18}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e3, &(0x7f0000000180)={r6, r9}) accept4$tipc(r5, 0x0, 0x0, 0x800) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="18000000000000001001"], 0x10b8}, 0xff4c) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000008c0)={'vcan0\x00', 0x0}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, 0x0) ioctl$sock_inet6_SIOCADDRT(r11, 0x890b, &(0x7f00000002c0)={@mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x26}, 0x5, 0x6, 0x0, 0x100, 0x4, 0x80000002}) getsockopt$PNPIPE_IFINDEX(r7, 0x113, 0x2, &(0x7f0000000900)=0x0, &(0x7f0000000980)=0x4) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000001300)={'syztnl2\x00', &(0x7f00000011c0)={'gre0\x00', 0x0, 0x7800, 0x700, 0x80, 0x10, {{0x2f, 0x4, 0x3, 0x1f, 0xbc, 0x66, 0x0, 0x0, 0x4, 0x0, @private=0xa010102, @loopback, {[@timestamp_prespec={0x44, 0x2c, 0x96, 0x3, 0x6, [{@remote, 0x6}, {@rand_addr=0x64010101, 0x1}, {@rand_addr=0x64010101, 0x9}, {@empty, 0xfffffff0}, {@empty, 0x81}]}, @ssrr={0x89, 0xf, 0xa3, [@loopback, @loopback, @empty]}, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x24, 0x0, [{0x2, 0x2}, {0x5, 0x7, "66852f9575"}, {0x2, 0x6, "66199f48"}, {0x7, 0x2}, {0x0, 0xb, "2085595c4dedbce0d8"}, {0x0, 0x2}]}, @generic={0x89, 0xa, "3b2891a17f9ef5be"}, @cipso={0x86, 0x2b, 0x2, [{0x7, 0x5, '_>K'}, {0x6, 0x12, "f56ecc41a0a3ed275d4b0245896c8ae7"}, {0x0, 0x2}, {0x6, 0xa, "52279fb8853eb234"}, {0x5, 0x2}]}, @end, @rr={0x7, 0xf, 0xdb, [@private=0xa010102, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) sendmmsg$inet(r5, &(0x7f00000042c0)=[{{&(0x7f0000000100)={0x2, 0x4e24, @multicast1}, 0x10, &(0x7f0000000140)=[{0x0}], 0x1}}, {{&(0x7f00000002c0)={0x2, 0x4e21, @private=0xa010101}, 0x10, &(0x7f0000000840)=[{&(0x7f0000000300)="4a707249efb45598f3fc9fc1fa", 0xd}, {0x0}, {&(0x7f00000005c0)="38b9db632199ee3c8615eb7182601609aa053dbe701f5c1785b0987ae8220f1a1be421c189f03eacb608886f665f0adf5369ec393640806e544ccea35ac6aa", 0x3f}, {&(0x7f0000000740)="4f8900c3a3b1df7fa7e546290d7b21d10f548b981dba63e34fd59dad8d6e5bcdf23aecb5c69a47977f37be947d989c41cac73af5dfcfc482731c3d8fe6305bc79f10ce65dafb827205e5b0e98373f347a19ed5feb5715ad397784e7a7a7ac9366bdd427f5a982498e59fbc4c82a0c0493b63c03c80482deadbd680cf8661ba35e7885d7f31d030bb66a563fde4116d130af9662633d42584d1875389bf082dcf43d914ab4291f532290bbbe4c2a7e18145b31605", 0xb4}, {&(0x7f0000000600)='-', 0x1}, {&(0x7f0000000640)="b05b3cd4c8e5", 0x6}], 0x6, &(0x7f00000009c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_ttl={{0x14, 0x0, 0x2, 0xe0}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r10, @loopback, @multicast1}}}, @ip_tos_int={{0x14}}, @ip_retopts={{0x34, 0x0, 0x7, {[@noop, @lsrr={0x83, 0x1f, 0x42, [@dev={0xac, 0x14, 0x14, 0x40}, @local, @rand_addr=0x64010102, @broadcast, @dev={0xac, 0x14, 0x14, 0xd}, @multicast2, @multicast2]}, @rr={0x7, 0x3, 0x37}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x93, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r12, @remote, @multicast1}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102}}}, @ip_retopts={{0x2c, 0x0, 0x7, {[@rr={0x7, 0xb, 0x26, [@multicast2, @local]}, @generic={0x88, 0xe, "201902f66de3b16de0d14ae7"}]}}}], 0x130}}, {{&(0x7f0000000b00)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001100), 0x0, &(0x7f0000001340)=[@ip_ttl={{0x14, 0x0, 0x2, 0x2}}, @ip_retopts={{0x24, 0x0, 0x7, {[@rr={0x7, 0x13, 0x98, [@multicast1, @local, @multicast2, @multicast2]}]}}}, @ip_retopts={{0x5c, 0x0, 0x7, {[@timestamp_addr={0x44, 0x34, 0xa8, 0x1, 0xf, [{@empty, 0x5}, {@multicast2, 0xf1}, {@rand_addr=0x64010100, 0x10001}, {@empty, 0x200}, {@broadcast, 0x2}, {@private=0xa010100, 0x4}]}, @timestamp_prespec={0x44, 0x4, 0xd2, 0x3, 0x2}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4, 0x1}, @noop, @ssrr={0x89, 0xb, 0xb1, [@local, @local]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xfffffffa}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7ff}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @dev={0xac, 0x14, 0x14, 0x2d}}}}, @ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r13, @loopback, @remote}}}], 0x150}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000002c80)="af59e9017d28930587183c09b660a961cab132074cc616e2c95bf0bde30c0b57ae165612bb982122e30c5de1350ac57d668d3d0228e1775fd9102feb52d723400cdc8398225f9d95f4a76a15fb1158d801bfa9636758842f4e3c4a33bb40f35ad7cef25364187e6dbec83c005a58ff90efcb534e78ffbfcc8ee55918cb778b6c2f9a8fe2f743817cdded816b4d4dca6b408029b6f335042b1fd2a4227759838102e0c3fb8179015ec92739f9b5df08a2e563419558bfa48c18071b925d5189a47649396e2f389c383a7b48732734f214d978259fd13498e06963e550a4d9956e273b851273f5b1c6e9c8baa6c117771b779f58b88527860670a47c03b89edbcca31348c9062d103ffa445c1053dadbb52033d4f46b4651fd868ad476f857e282b2044ac4047b12b29f147fe63a7d458620159c86a830bcb66b13f08f9b9b2364c6a3139eacd2d523144d55a4cbb9f0a9e17795bbcc7e329eb67901c762e9ce39b0ef5adefc873a918b79aa1501f27b1cec784d904922d2e8edebece93674c2d2f23674b38dc3bc2f4ccf41f065c1e557aed03e7d09558e83c266590c537b54ae09eea5d418d9efed69d176f74a161208c0b4143d7cdfbfcd8e09e97df282715adca9107c9e1aeb620beb23dfb34b060ad4aec33a99bbdd6f9012202ca930a4ea466eac47b2bf3cd948adadf47200f277d668369d01c925f4c998572dd86144d0f2edd627cb7e53e12e900e80cc8a9938f2eb36f06d547963d85667380535ebb05994d53fb5a0340aaaf36acca56020458944987b158b38f9cb5a35aa4b2f3674442237ae89ca1600fba9c43c763b742fee603391a610248f55bc893a504ae8a003ca7813e35f83bab7f283b7280c4a98ebe3f7a7a4126903ec7b378e210d4a2a32438b08286b45b5f54bcc21f3fcf228602f399d95042396407cbb93c78901f133316861dca7eb832b2d7b541dab53566db3520d2d9c083e29b30431373e71ead7b2087856fb4c7d95cb0944d5f112612630f7887c5ee779486403ef563fb735a46490ba7e1a38ba5c127d6d79739be46a7025a07cb6eb5cabedd0254df582f4579964b8170327ef1c03910c0ce1042a3334822ee7700b6ce849226bd2562e10812c5a66280a8cb4df20c98e6df74ac5297e34a6744e809d6d8f440fa53bcf47800e570b71c65121c28601f6c1c34aae149ddabcd60fd086a477ac7cda51071843362939beb6501ed4b1ccdc152b0008d4d8bfe45a345d09448c687c0e0a8ffd9c36a7fb22b7c408186c62710b67936a3fceca3439e421b0c8e5da68bd1660b9cc73cde6706a2738e39521864cb832e369c9ec34df0e45a1fc2cf5de3dece50446c8914e94672d93b7d4c80624b35a5d632442529b28e33a6982b440b897c405979be3854c388e3449895569b13c976605e3e19a100c9efb20b51ed0e8ce21a5d20f443d796ca4552d22e41a3c60fe42a96bd7e097d6d0b6f80580848f7e3ce0d343b12148d2d217580c28d6b6d86003be4466f32105791dc6ff4c73bf11e29134d6c5e766b127c94b1b83b60f98b2a5b0b7ac59d496bb1ab919b3d95806933d9beac4a53b2af0fe16b3f87906748afa047a27978e381a28743cead21201dc599da91875858e3e08fdaf580edd2e50184234b2bd875bb090634d17ada042dbd88c767d53fe4fe51d5a8c2150a332464f19ff0573f694f97cf46dd072d1355836aee2dcd09463c8fd937fe31deb8884d0e73d6f3660fe6b1a0eee62ea136edd8ca0ee2c6bbee0ded88535a4a83cabc02534d13878896fceceb1041d1df2b32ecb976e44be41fb8fc9289c0a3c7c3c248f58241d71d981aace0832541c58ad4ad5f4b2e42edce454668202495576a2df6210cbcc2d80304c1b7c5cfb7f166e0e05674fffe40e5ac0d630446dc6e65af54c015976429d520dd3b71b40d1ac918c093f1470c35cfc85d71d4b26c0bb5d30c6711e18ac154797d948391ecad034840b265ee04fa11bedf9483dca57ca5dc605d7d24f8dc3062cac9741befe49ac76d1279a402384d87c73166444d971ebf1f07567335362ced58a950609fca1ab4a8a864339c32a46b2ce2ec14ae69ed23d2c0e6dc73605f26c0d89fbfcf1287a8621078e3992ed2507838770606e51a7d81d5b6b226650df91a6be5f9d62bf9d648d9801b7a9e2b1a7b264d28b69d52596979484a324cd869c8cf51e7b472961406a57ea73b1d9071562a2d13979cfb20badfa37047f57c01ebde8374302ed3ba777fdf45018660e6595a5d1c5adbbaed414e849e910f1ac55e18c4f15559408ffc85c4697efae42a73bf69c367c32aad3367516f5089a2cb37edd9dcfb53ff73d030a2340617ee85eefe5710fd5a2303843508d5102551b39b3f894b08968aceefadb9db9b63eebd077c71bf7cd96fc512688d3f315b940f2368cca3e9ddf04288dda3a0d6f7d52ccec3d8d800f702ba54e04addbc8fc446e270a18935de77a2cdbd527e34cc543fa69bce20ad9207892c856b94cc0ed9eb66ad19e1e01b12d7f6594d8be20b535fdeb33e0af419405ec7e8d9d75ae3ddc2d9c1f35455d9e2d5c447a7155388795842f0cd83b66d0ad3228a8c720d4af4522235105bb4de7ad3fac9c27a3c2603599a4f38cdf80aeae60db48366cd98734dd169ac2eeb860e9796c822d072a0b81757e7d968c9192b99857ed7ab871715911af6e4ab88e2a7c80c8e85a45d1edee92368027f345571f594ecfd650c092ca04da4be1f02644b1359f925072605c15f169f8655b97e45ef9f05451df57084bbf889308eda35f2306913bf9964f123f171081b28bf9fa0fcb99acf3e623b7142c15255b575044f537cbace4fc7ce3e93db765d5705dbaae7f04ad25b4a753f2f091ab7ae153859649ba6297dcd0996911cdce167790eca21df4ccc82c20ef8bbf92f23cdc51ecde9072c2c661a0f4f0aa5c5d6a1be32fdc5a6bb241a85a2af4a30d2b08ca64e056cf3ab7e2590ef9b7c9a994b1740df4c0ca9b17bf8df3a2f1dc570391ee9f1d133bf9dd00df4e8a2fe642e9262cc4def6810ef12551d4b1a80d6a9cf9deb5f3d324f042602c927986bcb381a7c38841352a7a00edda9c910bac7b6dc32ae180ff9657421fefb6cff760a9ac118eabd419c51ee97b60630cb1f67db90dbbf0a0e3265637ec418e9aaf87b524c9841f4e33597ca83001317cc6bdf5ae5068caf03813d5bcec54640c150411863531fa817d388859fee652981c9d364c165fd909a9a95ba167dbf293236ab8ada2487750d7bdd28d56ac96108c9f9e970db356941430f82fd938aa73bb78fd1f724c4d7d912c94209d8f5ee56317b575f0c7025d5bb82f92958d6d9e245e5ff035e1eadd731f26f303a346acb0219a48b3b3253a74265f73d5df42299fdd0f38b3d282a40a91c99653ae1d2bb8cb06772e83caf13a3bfb80465dd96a35d81a43d860ae6326fbcdb76334dcd79baa0db93df5ab3581e2c6a1a3b03ad22ab09f074d43d88fe1dadf8eaff977ebac0efb6b9acaee954e85474cf1a66ce582307414459f4da9393b13d0f05db3e8ab5ff5ffdd58ae9ccffb42d6ed02ee200ffc3d1da296c0ea4a87e3ac0dace62f10f050f3765b75abb61dcbd8cb5e43688a86959ba7ad43370399fdad81bfe33e52abfdc09b46a79b5668f9cc24a5bfd5289c21502306ae6660aedceb15fcefbf9fd19d5976c39142b55dd9791d1a7247231b7c8be54e81b0dd5f6655463de0608eb609dad1896780262d82bdd0d43cb0be7df0b0bf439fc85869f3279ff6cecee932cf4c1505bf61347d538ff8f4a30dd61529709211b3a74ca5ed3c28a088cd0d4304220d3c40053360b2af11712e93a0453fbf2d4ae96cff1cf9852e96532cae82b430f6ec61ebcadab8e06efd84a6d2eff721975fa8e5175d776d9dc55714f2edcc6ef2fa9220ce297e73fc82d639a45fe09dc3659ae4c649fb30b08a94facc8a6a01478317bf81a2c9029cc47bde90b99d6181222f8e70d50647382f6bf55f0740a257984e275d59d1eaef105992c507d0c744ba94daf5d2102ace552285921e4b72b9edf7e67a356bc8407a0805c3b157d38a70440e7b3db6d7606fb28fe4596792eabe572b5a3801cd3039d004ca4764ac2249da3e3ef9bbd86a66e4c9505c14fd6416d8b4f85198cc604a698a46e65142996283508ec99df11f56d907248b8a1938956f0f5f7c3883ca963fac2c6d333a04f719b4245954b553571edeb43b8ef37352855e925f8fcf6571c0f309bdba670379916c7d9371", 0xbd0}], 0x1}}, {{&(0x7f0000001a40)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000001c00)=[{&(0x7f0000001a80)="2301df29ca56b5d6898a186fc24893d4ce3c8925aafc510f4355a06de94da6eaa57ebfd00a828fef2f026ed6cb413819bb6ea621b6081afb42437273990c5b57d61e0158edd6672e84afd230313db0ef3835bcd3eb525d81f4da71bad7d4c5c1d7ff4336ed66267196ee23975677a46cded8d9120288c6bbad00fdbdb2b26384eed8fc10aeafc6c2e8c492f9da6221d4e04d2bff7604a7e9fc495aba301a69b192a2fcd08ab1fc77415b7151ba3c776a766be85d1fd0c07bbe8d9cfde69491740babb69547c6d7c93ef54d4a8b77f619ca", 0xd1}, {&(0x7f0000003c80)="1c69b5cb466630fe176c1896eb1b299a045dd859fb02ea7757f7bc6ae67b1c86e8a9875fb569d6ea2b6326bef9d9cbdc5196383f88f80dd33d43f345b72f3dcfa355e472263f08e6ff2929769e72a337661a21738243251256737dc9880b81f3bb30404a6ca5aed71e6825abb22d422a1af394cea38b7ec18532f0bf9480309785d7867276bda0e9413c2c25dde5160a4533c068f1fd6b4de668906eef552951817f76ed1ed51307723a2dd9daea1516d1be9518ed6bc0da5b493b5fb4dc28f8b654a7e36c2ee6975b", 0xc9}, {&(0x7f0000001b80)="c28c82c0be7f9a753a5e62623c533405611513d630342923cea28b9e08029225564d6d81d07b74a4a82cc5c93b68f47b3a34fd02317293371e5c41424b0c8dc8631675cc92d2814f42b0de", 0x4b}, {&(0x7f0000003d80)="6ebf505606d58b9e16fcf6b8b042ed7c47a924890bfd55e6e9d01cbbf570340f0b8ea98235577354ed3d1438ab677891a39734d224b14b800bd7938956480a32685f5dcc69ce7d75cc3cb5559b9cdba3642ce63d0fda7cc89155fee787", 0x5d}], 0x4, &(0x7f0000003e40)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x1a1}}, @ip_retopts={{0x18, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @end]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1000}}], 0x48}}, {{&(0x7f0000003ec0)={0x2, 0x4e20, @remote}, 0x10, &(0x7f0000004140)=[{&(0x7f0000003f00)="0e6d7f0b4d99a98994f4f23fdce6fe7acd4d6739c6f2d5ed085e521512ec0eee44d3097e2749e368a3ccde21168294193b14e28a49254d9932dcf1ea61d53c4a33335b94b20f3b6a98e8ab1338019dd984ec548051415393ba3d9c91ab7ead4d6b832f8b45c12f864fef470753c883e74bb668187c5995b46f407d7d754e6274d5649342dbccbb42fe434e50d2add44f06762c8d5b", 0x95}, {&(0x7f0000003fc0)="059e71db280ac647e4a5c1c81856db426ea2e164155bda4b9f65ca486f5506168aab26bfb3ba5d63da21648cd7763493af4cbbee5590f9ea3328a0540031865732393184d77a71ceaff75a398af2344f35e3e6b8a0a0132bc0aaa406dedba92a2a4318c67ff3bceff10c421fbc65", 0x6e}, {&(0x7f0000004040)="f85928adf79c987ca5", 0x9}, {&(0x7f0000004080)="0dc2ed59a8f11c451eb775f20cea5cd3410239cbead5d5d06ca8637e316be1649c176d04e1f2f746b7be3c09b66e295228e0bf", 0x33}, {&(0x7f00000040c0)="6c3251b0efdc5f205eed782fe5d21da81569743111a34996c29c4de05b1d54115d3e512f9cad340df7427b9d45a0464edcdf679ae3416f195b6ad5dc5e93ca897acb354b45f22089b20fdcc6d1a7c583a74501c28d1aafd7f4d4dc52053971", 0x5f}], 0x5, &(0x7f00000041c0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x80}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x4}}, @ip_retopts={{0x78, 0x0, 0x7, {[@ssrr={0x89, 0xf, 0xca, [@multicast2, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @timestamp={0x44, 0x20, 0xd7, 0x0, 0x1, [0x1, 0x2, 0x1089, 0x6, 0x16e4, 0x5, 0x5]}, @timestamp_addr={0x44, 0x2c, 0xa, 0x1, 0x8, [{@empty, 0x4}, {@private=0xa010101, 0x400}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@multicast1, 0x8}, {@multicast2, 0x1}]}, @generic={0x88, 0xd, "5c57dbaa1f6924c15cd171"}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x7}}], 0xc0}}], 0x6, 0x4000000) 433.739784ms ago: executing program 4 (id=4897): r0 = accept$unix(0xffffffffffffffff, &(0x7f00000004c0), &(0x7f0000000580)=0x6e) getpeername$unix(r0, &(0x7f00000005c0)=@abs, &(0x7f0000000680)=0x6e) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="20000000520001002000000000070000000000000c00dd1936618b8e831fa244227105c7e54b087e7d40db14580526f8fde9be5f690d07a2a76ac3e57e4ca620f31980b9b6e7ed86c6bdcfaf422434947b2b60356993346610c14a51e407d2180cc010b59caee215a40220cc37487236baabc57176bfeb11fb14fe487d3b6c44f993d1f5a202cf3420783481055d3f8b08b50c87191077285d1e6e59bc1418c1c169", @ANYRES16=r1], 0x20}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r2, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0100000004001000ffff00000b00000001000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32, @ANYBLOB="000000000000eff40000000000005c1f7aa4a011e08ff1348a3da8cdc04adc1b9274f7f5dce7eebea0ac83d23347ebee0c352e71dc4a4645228efc8086aa936a3c7f098a52ffe8171b2b7e12f83062d9bc56391de1492070765b97316b852dc5528650573fb885259ab0d1d5b9328050579cf4346dbedb6def76bfdd91e68d29b3f3da72c2e0b890dca9433c96f4a8ad8a603f70df60c99803ff08b4911bba7ed5e18af66647dbb5"], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, r3, 0x600}, 0x38) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_emit_ethernet(0x1f, &(0x7f0000001240)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb2011aa006b370b6388f52de303b71d0c3ce7b6"], 0x0) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000040)=0x2, 0x4) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f00000000c0)) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getpeername(r5, 0x0, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000480)="b11430c100"/16, 0x10) socket$rxrpc(0x21, 0x2, 0x2) r7 = accept$alg(r6, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f00000009c0)=[{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000240)="3f5e97", 0x3}], 0x1, &(0x7f0000000640)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x20000000}], 0x1, 0x24000040) recvmmsg(r7, &(0x7f0000001b00)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001480)=""/194, 0x34000}], 0x1}, 0x4}], 0x1, 0x2120, 0x0) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCDELRT(r8, 0x890c, &(0x7f0000000f00)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x6, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={'nr', 0x0}, 0x2, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) setsockopt$WPAN_SECURITY(r4, 0x0, 0x1, &(0x7f0000000000), 0x0) sendmsg$802154_dgram(r4, &(0x7f0000000540)={&(0x7f00000003c0)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000400)={&(0x7f00000006c0)="cd62aa1a2c5cd7ecb03d9bb63e4b46e147db694de1af077daaf1529c86be71d45c050474f11ea3a0e31d31de6d74cb0f43658ce4656debc0bf128d3b9d75d6c72380d245b48fb12507d40b0819269b21efc58a61e4f37d246b230dbb08ba2b5f3fc4", 0x62}}, 0x0) 396.712772ms ago: executing program 0 (id=4898): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'geneve0\x00'}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000100)={{r0}, &(0x7f0000000000), &(0x7f0000000040)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) 233.134558ms ago: executing program 0 (id=4899): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0x8}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x5, 0x2, 0x6}}}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000880) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)=@newtfilter={0x68, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x4, 0xf}, {}, {0xffe0, 0xd}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_EMATCHES={0x34, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0x0, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x3, 0x6e4, 0xc}, {0x4, 0x80000000, 0x3, 0x1, 0xf, 0x1}}}]}]}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x0) 142.148251ms ago: executing program 1 (id=4900): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000940)=ANY=[@ANYBLOB="a0010000100001000000000002000000fe880000000000000000000000000101ac1414bb00000000000000000000000000000000001a00000a00ff8064000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000003c000000ac141441000000000000000000000000000000000000000000010000000000000000000000000000fdffffffffffffff0001000000000000000000000000000000000000000000000000000000000000fdffffffffffffff00000000000000000000000800000000000200000000000000000000000000000200000000000000000000000a"], 0x1a0}}, 0x0) 129.117362ms ago: executing program 0 (id=4901): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000ec0)=@newlink={0x40, 0x10, 0x401, 0x0, 0x6500, {0x0, 0x0, 0x0, 0x0, 0x21, 0x20}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r2}, @IFLA_HSR_SLAVE2={0x8, 0x2, r3}]}}}]}, 0x40}}, 0x0) 120.660874ms ago: executing program 3 (id=4902): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20004015}, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0xd, 0x20000000000000bb, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb714000008"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000200025a727bd7000fddbdf250a0000cdff0000010200010008000600000000000c001400f6d6c464bf1bb96b"], 0x30}, 0x1, 0x0, 0x0, 0x4040090}, 0x80) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x3, 0x0, 0x0, 0x0, 0x2000004, 0x0, 0x0, 0x1f00, 0x39, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x6, 0x200008, 0x5, 0x20003}, 0x10}, 0x94) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a600000000000000500000014000500200100000000000000000300000000001c00090008000000", @ANYRES32=r1], 0x4c}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket(0x400000000010, 0x3, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e", 0x8b}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29de8d9d", 0xd1}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede33131", 0x93}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e5372751cd23cc88571f540aa75255a73b8c9cdc2e75edf622add4302f913d9", 0xb2}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000004c00)="e24fc801dffdf37981a92f7f4005844301258a0ec141f1ec014bd9d03d1db52a75dfb8e04daddc3fac31adda350235262d9e1b8e20d406b97372033032d7623ff84bbf544a91c12eb644b323e9653fd76852c025e718cc91d9e9e274a7ed2dc15d8efec8d11a7983cdc8f3c39dbf764fc28873b760c435743929653c359ee706dcf2658403b25fbf3382f179562dc64883887ead6a916ef430ee4f67e21a3f01a3a35627bfb2f6ba204da0280c9f2fb5443879616a431884af82606286c4760a9ef4aa264e0000137f28dbe594332062120a76b565165987eef46c1d523f0fba98cd51f14537e313952f76574e3137aa1b41ae8e16f4087ddbaa7de98ca609a1b01b64ab10613204e4d18f376138fe7735ffb2fa09843922ce5a365e1e84286f09c432e0f521be13182256dcf534e03efb1735e55a8dce53e32ac669207d21e3b79414a8e61204f7c4173f2381e4c5e6cce12f6bae60d5bff199d5da50e40f87efbcec332173caba740a1b12c915bccf04940399b9a72a7dca4b8c7d46a2c444f6c7e30cf1f811a4a31cabb9b512a949105e2aa4081a3d613ad9ae4cf209d684e4b27c204bc5a395da552b8638df42d4c3522b64eaf11c988fce5634757ed41b39c338aea3ed2171e86fd34cde22dc3519edd2108641f3c3d4ca2016524b8f7d67e80ef5474d0a4a157eca9e5c0c5fcd7f459f64e91effe3bbcdcf9aba5704952cf0b82b1b0d4533a9c7ddc914bc7dfd8eea591be5806408191e3cca1cd6101f575b7c7206cd219b9f379fc3d03c3c867e5c36a8fcc75e86988a1897876b5a3bb2b3e102a742ebaeb50e08096c1990fa8d8755c187f86213f3cfc322f7997da73594e30f68a1da5768201916dfd52711ad79caae751260cc054dda58307f4031aebc75514795e6d7ae7725c27f7bc8f1e2115603e1f8b18517a74ddd901752a194cfb37535c949f4a5eefc98b231e03fd7a5d7643817567c7fbdcad37365a1a063c11bfd7e6474e9608391f3f3ebcd97a3ad7a9873d8615a9a4dac09ebc528b9277f71d5c2e6012645c643764319941206e6957987b5423b3864e6acb89c0e0371d66c5e16dfd920305cf5dc39ea0d48cea652236f3492f5b60a2a648e8ac61bf13811a81be593e430f504d0fe3d38222acd10e188605410900c55f203e0f6d553cf4e7cdfdfdbf4b60ee166c8be15757c6042f7f7b0c0c75932f795b075ba4116f1336622bafc47e58206255af610b3a7e88fed94a1c4a8b29e7e379b084431d5e059c0d0342678ef5b2ad08d10be3b48e4a1d0de16e8ca0175e1453fa15f8086f7b93d15e5f0769d56cbcec255fd1e82c43a61d50b893a8e7bc84c7cc1b9cffbc4d8f8d703d1ca879acf93e82f35a534665bd5a5a9e13e35ed00d796b830c45f87ba6c90857d05774506611c940e391752237af000473cfff41236801a9e78c48206e03e2a4b1c9164eb1f8cfb71d1559d3b5650327868ef87906b5a0e05470b0655f51090a57a65895608866ac0e008c44898ea0fa968ae510b561b8ebb9f0a38c2572f93aa6a8f5aaab1ff62ad761af234379adfc397c186a99bbecd534266358c5e053de4698e37fb0c512d72492c6f0d18e686c21665224d23fb6b15670e235a96bab63d63df51624f73d78fc38e0c8956882ebbbe0207f3b13be74b70ef29e64912cac49dd90a7f4d5fd09bec08dcb8413578f9e4456079c3673ffd33b366d4a203af63f25ba792a722a4d36749c6724e0b37cfd71761f3ff122861e362aab7a26a8c8090b65ab080535fa912d5b58a9b65410b94acc42396796e35a308cac7594439f4ed2afc8cc4676159751d9ce63ff894a7cad95b375f852d9bd493719ab9bac41cd9ec817b835628a6a9f4869fc9ce72ea3fc7119341ceaf23e85f7a990b7eeb35ef2ef2c84f6fafa0c186a0b2490c72cfe2ce7607634e0d651e4c87514a177300f4f3b762e386cc1522e9b859fb9297329a73b89b8a97184864823d1829fe7a6bf30c69f24b61338e3f341e05e3f70ec6cd6f3544652f69ade293dc896836632271cde36ebb6f515dc8d13121def9d2911ed0d19f2fc31a12b1de3b43dbfb32c0df664c85d4b978f3a41b43546844c8581590dade2db066d5a948a386438232b0be334232800fd164aac8047a96b85356820597a0ef21b2df300a8ef2a08155b7a8eb7793e5ec768db868432c9d65cd748369f24909862131553af695be43c95f2e65a9ef1f8fbad3d03bee4640639c0351c6ed58113b86ec0530aff32f4e4b786285ce72afd6dce83b3a82f58a0bc62735e3402848690d2865438c81f174588e6046ba95935ec0dfbbbb87dda17d8fdcf07b8322bdf18b1421293ead6a8b38119724c9c122f457f85129cbd50338a7e3194418c00ed91cd39878f7753477a17856281ae743c8dcdfc7d5c7142348f9fae4f7767f2c89c394c3fd5d8f261bde3b2055ccddf05c36643e21ec542a62be492501b470813fcedf01c876da0e1e822c3867f32951053f2963b5d1f90e713df0b2c526f36e685b4153d4ae4e8c607df1308c84e500c0bd9fe80dc3cf28187a39fd09643afb25eaa9411f3ce6304dc8bfd02afc9a6bad59887a1cad44a1f613a0779059a90248f09e357af291b1cce42cb9ac766dac70e599c1bbba4a58715adf2426a865eb1e0b80f10602db39c400b45131700490a9c38345022acc79851c2368bc7d191bc1f995722c564198669a68c971f60779e6983508a7c8077cdc7677d9a8b70b8fd1183f57cbc2d653ef6e96110c0c6730be7add59392b4082a6478447cc307d35512dfb2c4e27122b9749eeed9b5a5906f99ee57d7b565822bd4d78aed8f1567409a59ae77b3a1552a5cdb1558ff3ffd2b4cd0e141fce5ad11de5509c6dac5858bbb222bc403e3a307294afbe9633e162bfc5231284f58d475ef19cc1012cb4a81bd26e7e24509ecb5bd859a04a8e39f373188fc58573a52bf8a5de50aa082a4ad28202d01da2f0c7d3a6d1d3b9c3dab9d3ad9a663af4894904236632514d668e5f5016a350ae5accae2902cb9cba8d5262abc4e934329f410739831d447b798bb1da19bd3c98e90f43e54b8911ab9da8d594c9d0617396a53469ec2eb6ca0843ffd39e65b79bf856c755d8fda71b66e16cba537adac14de21a16a379513555d13ee6e021e6bb1cb5db35a7cb0162c3dbf631e8b6b42cc98fba74396971be184b910dbf0fbc29c0e45acfe59c789a134bcc01f7c3b2513d4ef988e7f66e5002d9ee8766870b9502d173953b78b654f020349b7af7845462822a6c78a63416606a265389216f141ca8269a11f18edf1d11de7f11906b787a0189a4fe5a55bb0f78c25319583b5f81c4ad25dd4544d35a2f8afce5b8a117b16104c45997f9ad31421414006f158881e9c7f553f3b7364e274bff39236720d67346e8270b2fd6b5b33c0cece3251b62ec09c709ad1adee626e43a54356b803adf23e45ddbe2bbade69974ca43c3f2246389612398a5247678299995592002f369b0a779ffa60d0785edecab597cb6fa11e2ce68d5e956c5fe95c12ce24cb334a2d1fe9e63491b7d85d58ba4150df6c42f29223eaa607837fee3c71667d7c4a69d5bd2a88e548429e4630c59c38689a52cbc9099f303d680c053cce1a0b24c17a918f7dd08a9348a414e30c8c91e9680facb185914018e1c5a090cd00578c837d9f69e49eae3e45326b679678cca81ca20cf3bfa8e4e548dc446d168382695319ea9fdc14bf29c2b15e2acb925f7db4723f6b382efcbdb10f00837278564a2d0e0da63b755206bdf69faba7e5d7406ec324ca089729a68ca29cbccd17256cb465b91e718b3b64429b8a8e70a72d85b470d85f4b8169ebc74809334db04384c3c2887f09374e60cb3d5c93f3ce5077bcea293b37215ba345f6a30b1d6e08c1cf7024b65ecac5063e177d9af7f687a35c377871d87b00fe7c453199e5c0588a49bf9981651f57468bb37d1812cce02cf1a6df234cf50aabb65959fb7863384d46cbf43600aeb2858a8bea733eec75bcf02f2dfc0c2df6b6c0f807236e67cf6e7253a6f0582cad219daad67c91b8c2f38ad91a9db3bc284f6301f28ad3d1ade08cfc4a8b63268de502d7b4cad5973ce2867a534e576789fe2bd60b15da33d7a5a5e728f6e5ab7052c4636439258979a804bf67aec5546343d7cbee90b4be9d5ef0775d64bfade2daae18d7de4240dd1d88ff3816f2d5c871174b3b48e9fab898abd4cd2df8cb1c3cfff889594a3f08cb935031edbe34aab3433ffd50263a406deef158bbabfa2ec70e79c761d95fcfbef0800c95413068b3789c6b12de5ebe9b414e65ce4f86a6bbccd5ec8e4e220f8ad07255abbaef719ebe1e5d066db4dd1f639cb156c34755eb14053824a1003e97ee54e8dab35f441ee563d80d3163a7b8f71d4f17e240cfae9f2e50c164cf373bb174f5dadafe2430a17be757e30f251d5d60863526a8f46addb932c8170c4a383348c5441aa353e5f1181482d4d0cc0e5d2809c11ee1fac29230c907926c2d3fa55298ae9835c46218650421497d060d15a4194c4d7382a886333375098156a9f0fd6b1d0d94933bb6f285fe51d4aa3037739f143ba20f9b326565f6db49787d1aeb30055ce588dd3c008c0bc1a08935c991067d63003b68b9e2db95360d8aaf2103bb5142c590bb799b268488febc7414b9ae8e108ca4ab4f031adbb9fbe4631c29adb14fb9726df3c6192a3e81b6c34d68e15ee309503ccc1ab240d4ce3c9a099cd7f8782eea9bd1c7005582b9c1fe08030b47958865723652fed003c90703e07f9f1782e33f3bf3d0b83691cd5970fb4af65afa2244bff41e93fa24c33c26c43c93c33a2144aac437a4ab2b4f498104278ec5f2cd38de61eb8b436f5a9dbc3d8b2405ff0598cbcaa964377f61daaf935c42e0db4567520cfee195da1c6090d62031dd0865b2f5aa88be1746a761e3a64b78de338b8996136bbd6b859eb730aa8ab1f68bb5a02b713d8b303ab2ef1e5433d225b0dd485d40a049a1953b488df5314fdbc1c654132498838043c35c7b168e786b0f35a04ec4417968c5561c45735cc09163e8fdbbe67a4c04d672948037e957968c6bf672668d1f6369475d4a238f46af939dbca37cc96ae88b152c1b8b524883e296e5e915a928e9a54268c28e14a85c87fe3bde0e9175dd2eb2645852464ddeae29aefc01d05ef668914829f340f6b14a7bc0f2ce4114f1bef1e2afc37583670a900c58affc6c55bb69e737e5fd02322536ec1e4249f8cca7171394d97c930656beb437ea1b7ac8f6b69d8c1499371deeff7608dde446d4a50f29ce015c655885fcc090aeed40d52390ef952c6b9f937197718aae27fe924c419d1468b45bc0e88688425c3a451dac67f29460fce27a5b753f60b244c1832e9b485e321e8d8d4f547eda56680d9d01aa6d4d7881ab760f926157315a3fcb4d7f9653b91270fc43637420215c71274e4effaf6b67fea48c05393272e288e103e28d26eb39fcb9afdef67686485e90e605b45d2f36a39b4973426f843c2db1e861c67d7c2ca2b8e92ca98ad1297d3fd913258081fff78d981097a2c22b0a9d881f649582e49fd9baaaa89d0d7091f9cfeb8bec3c9b7dfb85e53bee2fb051ff0f7d57ef4af134a7ca9ab91271411a0c95be1af414689425f985faa808a2520c96403788d71af4314023af7a2761ee7ba7e135edfaa51f9f89caa784d853886c147d11f3ccab318250aa65d366396b5dfcda0dda9f8cca5ad6815252ebc061c47f871785e0b3edbdcfb2d74c6fa3eaabaf9f3", 0x1000}, {0x0}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33f", 0xee}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91566b7f1725f3", 0x1b}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x90}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r3, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, 0x0}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 1 (id=4903): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100ffffffff00000000010000000c0005006c010000000000000c000200ff7f000024000000400007800c00018008000100", @ANYRES32=r2, @ANYBLOB="0c00018008000100", @ANYRES32=r2], 0x6c}}, 0x4004800) kernel console output (not intermixed with test programs): screwing up backlog [ 410.807595][T17266] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3876'. [ 410.831329][T17270] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3876'. [ 410.840580][T17266] netem: unknown loss type 4 [ 410.852861][T17266] netem: change failed [ 410.966614][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.486454][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.506855][T17276] netlink: 'syz.4.3878': attribute type 3 has an invalid length. [ 411.656234][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 411.790657][T17281] sit1: entered allmulticast mode [ 411.812334][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.068041][T17289] vlan3: entered promiscuous mode [ 412.095922][T17289] bridge0: entered promiscuous mode [ 412.106216][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 412.238928][T17302] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3887'. [ 412.274804][T17298] ipvlan3: entered promiscuous mode [ 412.306358][T17298] ipvlan3: entered allmulticast mode [ 412.323676][T17307] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3887'. [ 412.343127][T17298] gretap0: entered allmulticast mode [ 412.349310][T17307] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3887'. [ 412.399667][T17293] vxcan2: entered allmulticast mode [ 412.468959][T17300] gre0 speed is unknown, defaulting to 1000 [ 412.935736][T17328] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3892'. [ 412.951305][T17328] netlink: 'syz.1.3892': attribute type 1 has an invalid length. [ 412.962036][T17327] gre0 speed is unknown, defaulting to 1000 [ 412.984803][T17324] ipvlan3: left promiscuous mode [ 413.380198][T17344] tipc: Started in network mode [ 413.391424][T17344] tipc: Node identity fe800000000000000000000300000013, cluster identity 4711 [ 413.408754][T17344] tipc: Enabling of bearer rejected, failed to enable media [ 413.804245][T17354] vlan2: entered promiscuous mode [ 413.809994][T17354] bond0: entered promiscuous mode [ 413.815065][T17354] bond_slave_0: entered promiscuous mode [ 413.847832][T17354] bond_slave_1: entered promiscuous mode [ 413.915108][T17356] netlink: 'syz.2.3904': attribute type 1 has an invalid length. [ 414.136260][T17356] 8021q: adding VLAN 0 to HW filter on device bond3 [ 414.153027][T17373] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 414.162005][T17373] netlink: 100 bytes leftover after parsing attributes in process `syz.1.3908'. [ 414.190178][T17375] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3906'. [ 414.362431][T17377] gre0 speed is unknown, defaulting to 1000 [ 414.576088][T17395] SET target dimension over the limit! [ 414.614056][T17398] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3917'. [ 414.685388][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6050 ms [ 414.694376][ C0] lec:lec_tx_timeout: lec0 [ 414.699480][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 414.702173][T17398] vlan2: entered allmulticast mode [ 414.722377][T17398] bridge0: entered allmulticast mode [ 414.759844][T17398] erspan0: left allmulticast mode [ 414.779871][T17398] bridge0: port 1(erspan0) entered blocking state [ 414.794171][T17398] bridge0: port 1(erspan0) entered disabled state [ 414.832222][T17398] erspan0: entered allmulticast mode [ 414.856100][T17398] erspan0: entered promiscuous mode [ 414.863316][T17398] bridge0: port 1(erspan0) entered blocking state [ 414.870080][T17398] bridge0: port 1(erspan0) entered forwarding state [ 414.924057][T17402] bridge0: port 2(bond1) entered blocking state [ 414.979384][T17402] bridge0: port 2(bond1) entered disabled state [ 415.027163][T17402] bond1: entered allmulticast mode [ 415.050899][T17402] bond1: entered promiscuous mode [ 415.381431][T17434] netlink: 'syz.1.3930': attribute type 1 has an invalid length. [ 415.577954][ T3532] net_ratelimit: 10 callbacks suppressed [ 415.577986][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.596406][T17428] nbd8: detected capacity change from 0 to 4671 [ 415.611043][ T5841] block nbd8: Receive control failed (result -32) [ 415.613529][T16221] block nbd8: Send control failed (result -32) [ 415.620569][ T5831] block nbd8: Receive control failed (result -32) [ 415.654031][T16221] block nbd8: Request send failed, requeueing [ 415.699465][ T1625] block nbd8: Dead connection, failed to find a fallback [ 415.707258][ T1625] block nbd8: shutting down sockets [ 415.712807][ T1625] blk_print_req_error: 138 callbacks suppressed [ 415.712829][ T1625] I/O error, dev nbd8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.732818][ T1625] buffer_io_error: 138 callbacks suppressed [ 415.732837][ T1625] Buffer I/O error on dev nbd8, logical block 0, async page read [ 415.755560][T16221] I/O error, dev nbd8, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.757094][T17435] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 415.765277][T16221] Buffer I/O error on dev nbd8, logical block 1, async page read [ 415.766649][T16221] I/O error, dev nbd8, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.793257][T16221] Buffer I/O error on dev nbd8, logical block 2, async page read [ 415.804753][T16221] I/O error, dev nbd8, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.819019][T16221] Buffer I/O error on dev nbd8, logical block 3, async page read [ 415.827381][T16221] I/O error, dev nbd8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.837279][T16221] Buffer I/O error on dev nbd8, logical block 0, async page read [ 415.846465][T16221] I/O error, dev nbd8, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.856086][T16221] Buffer I/O error on dev nbd8, logical block 1, async page read [ 415.864396][T16221] I/O error, dev nbd8, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.874585][T16221] Buffer I/O error on dev nbd8, logical block 2, async page read [ 415.885829][T16221] I/O error, dev nbd8, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.897676][T16221] Buffer I/O error on dev nbd8, logical block 3, async page read [ 415.914240][T17439] veth3: entered promiscuous mode [ 415.926512][T17439] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 415.934323][T16221] I/O error, dev nbd8, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.946322][T16221] Buffer I/O error on dev nbd8, logical block 0, async page read [ 415.954310][T16221] I/O error, dev nbd8, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 415.965089][T16221] Buffer I/O error on dev nbd8, logical block 1, async page read [ 415.974475][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 415.984926][T17451] __nla_validate_parse: 3 callbacks suppressed [ 415.984949][T17451] netlink: 65051 bytes leftover after parsing attributes in process `syz.4.3935'. [ 415.992222][T16221] ldm_validate_partition_table(): Disk read failed. [ 416.009686][T16221] Dev nbd8: unable to read RDB block 0 [ 416.017516][T16221] nbd8: unable to read partition table [ 416.077908][T16221] ldm_validate_partition_table(): Disk read failed. [ 416.093167][T17451] syzkaller1: entered promiscuous mode [ 416.096246][T16221] Dev nbd8: unable to read RDB block 0 [ 416.115488][T17451] syzkaller1: entered allmulticast mode [ 416.127276][T16221] nbd8: unable to read partition table [ 416.227059][T17462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3940'. [ 416.241827][T17462] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3940'. [ 416.253690][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.372281][T17462] syzkaller0: entered promiscuous mode [ 416.386413][T17462] syzkaller0: entered allmulticast mode [ 416.413114][T17474] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3943'. [ 416.485030][ T30] audit: type=1804 audit(1775199259.043:6): pid=17477 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3945" name="/newroot/148/cgroup.controllers" dev="tmpfs" ino=776 res=1 errno=0 [ 416.507994][ T30] audit: type=1800 audit(1775199259.053:7): pid=17477 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3945" name="cgroup.controllers" dev="tmpfs" ino=776 res=0 errno=0 [ 416.545692][T17477] bridge0: port 1(erspan0) entered disabled state [ 416.551609][T17478] netlink: 116 bytes leftover after parsing attributes in process `syz.0.3945'. [ 416.604257][ T9977] gre0 speed is unknown, defaulting to 1000 [ 416.616569][ T9977] syz1: Port: 1 Link DOWN [ 416.629405][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 416.713048][T17485] netlink: 'syz.3.3947': attribute type 3 has an invalid length. [ 416.736121][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.011115][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.070516][ T103] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 417.247925][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.386227][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 417.866193][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.048661][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 418.398855][T17478] geneve0: entered promiscuous mode [ 418.409862][ T9976] gre0 speed is unknown, defaulting to 1000 [ 418.416695][T17487] tipc: MTU too low for tipc bearer [ 418.457264][ T103] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.488125][ T103] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.509771][T17500] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3952'. [ 418.529327][ T103] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.547583][ T103] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.700645][T17503] gre0 speed is unknown, defaulting to 1000 [ 418.718210][T17513] 8021q: VLANs not supported on gre0 [ 418.738891][T17500] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3952'. [ 419.151802][T17518] netlink: 'syz.4.3956': attribute type 1 has an invalid length. [ 419.189316][T17522] FAULT_INJECTION: forcing a failure. [ 419.189316][T17522] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.217518][T17518] bond3: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 419.226689][T17522] CPU: 1 UID: 0 PID: 17522 Comm: syz.3.3957 Not tainted syzkaller #0 PREEMPT(full) [ 419.226786][T17522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 419.226800][T17522] Call Trace: [ 419.226808][T17522] [ 419.226818][T17522] dump_stack_lvl+0xe8/0x150 [ 419.226852][T17522] should_fail_ex+0x412/0x560 [ 419.226888][T17522] _copy_from_user+0x2d/0xb0 [ 419.226914][T17522] ___sys_sendmsg+0x1c6/0x360 [ 419.226949][T17522] ? __pfx____sys_sendmsg+0x10/0x10 [ 419.227013][T17522] ? __fget_files+0x2a/0x420 [ 419.227031][T17522] ? __fget_files+0x3a0/0x420 [ 419.227061][T17522] __x64_sys_sendmsg+0x1bd/0x2a0 [ 419.227092][T17522] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 419.227129][T17522] ? __pfx_ksys_write+0x10/0x10 [ 419.227165][T17522] do_syscall_64+0x14d/0xf80 [ 419.227186][T17522] ? trace_irq_disable+0x3b/0x150 [ 419.227203][T17522] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.227221][T17522] ? clear_bhb_loop+0x40/0x90 [ 419.227243][T17522] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.227260][T17522] RIP: 0033:0x7f09b7d9c819 [ 419.227279][T17522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 419.227294][T17522] RSP: 002b:00007f09b8bec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 419.227315][T17522] RAX: ffffffffffffffda RBX: 00007f09b8015fa0 RCX: 00007f09b7d9c819 [ 419.227328][T17522] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 419.227351][T17522] RBP: 00007f09b8bec090 R08: 0000000000000000 R09: 0000000000000000 [ 419.227363][T17522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.227374][T17522] R13: 00007f09b8016038 R14: 00007f09b8015fa0 R15: 00007ffee7c1d4b8 [ 419.227403][T17522] [ 419.357105][T17528] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3959'. [ 419.538741][T17534] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3960'. [ 419.646745][T17534] macsec1: entered promiscuous mode [ 419.673383][T17534] macvlan0: entered promiscuous mode [ 419.721550][T17542] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3963'. [ 419.951777][T17549] bond0: entered promiscuous mode [ 419.995556][T17549] bond_slave_0: entered promiscuous mode [ 420.017378][T17549] bond_slave_1: entered promiscuous mode [ 420.023324][T17549] mac80211_hwsim hwsim50 wlan1: entered promiscuous mode [ 420.071612][T17549] team0: entered promiscuous mode [ 420.092739][T17549] team_slave_0: entered promiscuous mode [ 420.105772][T17549] team_slave_1: entered promiscuous mode [ 420.111704][T17549] dummy0: entered promiscuous mode [ 420.122126][T17549] batadv0: entered promiscuous mode [ 420.128638][T17549] debugfs: 'hsr1' already exists in 'hsr' [ 420.134418][T17549] Cannot create hsr debugfs directory [ 420.220648][T17550] gre0 speed is unknown, defaulting to 1000 [ 420.367117][T17569] tipc: Enabling of bearer rejected, failed to enable media [ 420.445387][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 420.453864][ C0] lec:lec_tx_timeout: lec0 [ 420.458711][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 420.597907][T17560] gre0 speed is unknown, defaulting to 1000 [ 420.837465][ T3532] net_ratelimit: 9 callbacks suppressed [ 420.837485][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.059468][T17576] nbd9: detected capacity change from 0 to 8127 [ 421.074330][ T5841] block nbd9: Receive control failed (result -104) [ 421.082392][ T5831] block nbd9: Receive control failed (result -32) [ 421.132895][T17591] netlink: 'syz.1.3977': attribute type 1 has an invalid length. [ 421.166965][ T9976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.216208][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 421.324896][T17602] __nla_validate_parse: 3 callbacks suppressed [ 421.324928][T17602] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3980'. [ 421.412858][T17597] veth5: entered promiscuous mode [ 421.446234][T17597] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 421.479685][T17601] netlink: 65051 bytes leftover after parsing attributes in process `syz.3.3979'. [ 421.499146][T17602] vlan3: entered promiscuous mode [ 421.556650][T17601] syzkaller1: entered promiscuous mode [ 421.563122][T17601] syzkaller1: entered allmulticast mode [ 421.820092][T17619] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3984'. [ 421.977062][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.207638][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.251666][T17637] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.346785][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.815508][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.006414][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.140998][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 423.392957][T17661] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap2 [ 423.445794][ T29] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 423.476751][T17664] Cannot find del_set index 1536 as target [ 423.529639][T17669] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3996'. [ 423.540080][T17670] netlink: 'syz.3.3995': attribute type 39 has an invalid length. [ 423.833938][ T3532] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 423.902117][T17683] netlink: 'syz.2.4000': attribute type 10 has an invalid length. [ 423.916757][ T29] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 424.025086][T17683] team0: Port device dummy0 added [ 424.331931][T17711] netlink: 212320 bytes leftover after parsing attributes in process `syz.0.4008'. [ 424.484306][T17715] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4009'. [ 424.657095][T17723] Cannot find del_set index 1536 as target [ 424.724802][T17731] netlink: 'syz.3.4012': attribute type 39 has an invalid length. [ 424.735251][T17730] netlink: 176 bytes leftover after parsing attributes in process `syz.2.4013'. [ 424.855163][ T499] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 424.870290][ T499] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 424.878354][T17740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4018'. [ 424.915722][T11200] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 424.915801][T17740] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4018'. [ 424.948074][T17740] netlink: 'syz.3.4018': attribute type 15 has an invalid length. [ 425.118170][T17749] netlink: 'syz.0.4021': attribute type 1 has an invalid length. [ 425.164452][T17749] 8021q: adding VLAN 0 to HW filter on device bond2 [ 425.207333][T17749] bond2: (slave geneve2): making interface the new active one [ 425.219198][T17749] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 425.358079][T17759] gre0 speed is unknown, defaulting to 1000 [ 425.885962][ T5887] net_ratelimit: 8 callbacks suppressed [ 425.885983][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.205448][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 426.214119][ C0] lec:lec_tx_timeout: lec0 [ 426.216281][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.220147][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 426.366433][ T9976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.476032][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.816176][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 426.984184][T17693] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 427.238145][T17779] netlink: 'syz.2.4032': attribute type 5 has an invalid length. [ 427.250810][T17779] netlink: 3657 bytes leftover after parsing attributes in process `syz.2.4032'. [ 427.263433][T17779] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4032'. [ 427.277744][T17777] vxcan4: entered allmulticast mode [ 427.395888][T17775] nbd10: detected capacity change from 0 to 1179711 [ 427.405661][ T9976] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.415553][ T5831] block nbd10: Receive control failed (result -104) [ 427.415805][ T5841] block nbd10: Receive control failed (result -32) [ 427.552755][T17788] gre0 speed is unknown, defaulting to 1000 [ 427.564292][T17795] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4037'. [ 427.606894][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 427.946072][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.138409][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.254863][T17825] bond3: entered promiscuous mode [ 428.262259][T17829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4046'. [ 428.289251][T17825] 8021q: adding VLAN 0 to HW filter on device bond3 [ 428.321308][T17825] netlink: 'syz.1.4046': attribute type 13 has an invalid length. [ 428.338335][T17825] netlink: 'syz.1.4046': attribute type 17 has an invalid length. [ 428.445860][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.457947][T17838] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4046'. [ 428.471461][T17837] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4050'. [ 428.497938][T17839] netlink: 'syz.0.4049': attribute type 6 has an invalid length. [ 428.912087][T17856] netlink: 'syz.0.4054': attribute type 39 has an invalid length. [ 428.925742][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 429.052134][T17859] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 429.215110][T17865] gre0 speed is unknown, defaulting to 1000 [ 429.324402][T17874] netlink: 'syz.3.4060': attribute type 3 has an invalid length. [ 429.344726][T17876] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4059'. [ 429.516931][T17876] can: request_module (can-proto-4) failed. [ 429.652315][T17853] Cannot find del_set index 1536 as target [ 429.789630][T17890] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4063'. [ 429.861147][T17891] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4064'. [ 430.268936][T17907] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4070'. [ 430.786014][T17917] gre0 speed is unknown, defaulting to 1000 [ 430.926372][ T12] net_ratelimit: 8 callbacks suppressed [ 430.926396][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.009000][T17929] netlink: 'syz.0.4077': attribute type 1 has an invalid length. [ 431.022368][T17930] netlink: 'syz.2.4074': attribute type 10 has an invalid length. [ 431.123651][T17929] 8021q: adding VLAN 0 to HW filter on device bond3 [ 431.180449][T17933] bond3: (slave gretap1): making interface the new active one [ 431.190481][T17933] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 431.234166][T17935] netlink: 'syz.3.4078': attribute type 1 has an invalid length. [ 431.242212][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 431.242286][ C0] lec:lec_tx_timeout: lec0 [ 431.251448][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 431.306306][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.318260][T17935] bond5: entered promiscuous mode [ 431.323821][T17935] 8021q: adding VLAN 0 to HW filter on device bond5 [ 431.409905][T17939] bond5: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 431.469707][T17949] netlink: 'syz.0.4082': attribute type 1 has an invalid length. [ 431.478277][T17939] bond5: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 431.507995][T17939] bond5: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 431.569012][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.619775][T17942] bond5: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 431.665513][T17942] bond5: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 431.771094][T17951] bond4: (slave ip6gretap2): Enslaving as a backup interface with an up link [ 431.807954][T17954] veth3: entered promiscuous mode [ 431.831984][T17954] bond4: (slave veth3): Enslaving as a backup interface with a down link [ 431.899003][T17953] bond4: entered promiscuous mode [ 431.904938][T17953] 8021q: adding VLAN 0 to HW filter on device bond4 [ 431.966255][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.975113][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.985157][T17957] 8021q: adding VLAN 0 to HW filter on device bond4 [ 432.007692][T17957] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 432.060205][T17975] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 432.062783][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.106708][T17957] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 432.264954][T17982] __nla_validate_parse: 6 callbacks suppressed [ 432.264977][T17982] netlink: 71 bytes leftover after parsing attributes in process `syz.3.4091'. [ 432.274855][T17959] bond4: (slave wireguard0): The slave device specified does not support setting the MAC address [ 432.294584][T17959] bond4: (slave wireguard0): Error -95 calling set_mac_address [ 432.425183][ T3551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.612723][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.808627][T17997] netlink: 'syz.1.4098': attribute type 1 has an invalid length. [ 432.851863][T18003] SET target dimension over the limit! [ 432.937526][T17997] 8021q: adding VLAN 0 to HW filter on device bond5 [ 433.013635][T18006] ipvlan2: entered promiscuous mode [ 433.054030][T18006] ipvlan2: entered allmulticast mode [ 433.077431][T18006] gretap0: entered allmulticast mode [ 433.117105][T18008] bond5: (slave geneve2): making interface the new active one [ 433.128808][T18008] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 433.206432][T18015] bond0: (slave macvlan0): Opening slave failed [ 433.226102][ T3551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.313530][ T3532] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.323045][ T3532] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.388918][ T3532] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.400015][ T3532] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 433.448824][T18031] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4108'. [ 433.503188][T18024] sctp: [Deprecated]: syz.0.4106 (pid 18024) Use of struct sctp_assoc_value in delayed_ack socket option. [ 433.503188][T18024] Use struct sctp_sack_info instead [ 433.606071][T18031] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4108'. [ 433.615444][T18031] netlink: 580 bytes leftover after parsing attributes in process `syz.3.4108'. [ 433.636276][T18024] sctp: [Deprecated]: syz.0.4106 (pid 18024) Use of struct sctp_assoc_value in delayed_ack socket option. [ 433.636276][T18024] Use struct sctp_sack_info instead [ 433.728573][T18024] netlink: 43 bytes leftover after parsing attributes in process `syz.0.4106'. [ 434.268692][T18053] netlink: 'syz.0.4115': attribute type 33 has an invalid length. [ 434.276706][T18053] netlink: 152 bytes leftover after parsing attributes in process `syz.0.4115'. [ 434.352287][T18048] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4115'. [ 434.385424][T18048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4115'. [ 434.394823][T18048] netlink: 'syz.0.4115': attribute type 11 has an invalid length. [ 434.795038][T18048] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4115'. [ 434.829450][T18072] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4122'. [ 434.856827][T18048] netlink: 'syz.0.4115': attribute type 11 has an invalid length. [ 434.863286][T18072] netlink: 'syz.3.4122': attribute type 4 has an invalid length. [ 434.914671][T18074] netlink: 'syz.3.4122': attribute type 4 has an invalid length. [ 435.184920][T18082] gre0 speed is unknown, defaulting to 1000 [ 435.205782][T18086] vlan3: entered allmulticast mode [ 435.543668][T18104] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 435.653562][T18098] bond4: (slave veth3): Enslaving as a backup interface with a down link [ 435.956052][T18118] vlan2: entered promiscuous mode [ 435.969734][ T3532] net_ratelimit: 12 callbacks suppressed [ 435.969757][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.985645][T18118] batadv0: entered promiscuous mode [ 436.255402][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 436.263942][ C0] lec:lec_tx_timeout: lec0 [ 436.269365][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 436.295061][T18136] validate_nla: 1 callbacks suppressed [ 436.295085][T18136] netlink: 'syz.3.4145': attribute type 27 has an invalid length. [ 436.366345][T18140] Cannot find del_set index 1536 as target [ 436.408171][T18136] gretap1: left promiscuous mode [ 436.448776][T18136] veth5: left promiscuous mode [ 436.482283][T18146] netlink: 'syz.1.4147': attribute type 39 has an invalid length. [ 436.499053][T18136] veth9: left promiscuous mode [ 436.568355][T18136] bond5: left promiscuous mode [ 436.577663][T18136] ipvlan2: left promiscuous mode [ 436.582847][T18136] ipvlan2: left allmulticast mode [ 436.615852][T18136] gretap0: left allmulticast mode [ 436.651518][ T3532] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.680445][ T3532] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.718992][ T3532] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.728701][ T3532] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 436.761312][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.839736][T18159] 8021q: adding VLAN 0 to HW filter on device bond0 [ 436.855830][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 436.870879][T18159] 8021q: adding VLAN 0 to HW filter on device team0 [ 436.899623][T18159] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 436.996872][T18174] team0: Device vlan2 is already an upper device of the team interface [ 437.057671][T18168] nbd11: detected capacity change from 0 to 2097215 [ 437.068386][ T5831] block nbd11: Receive control failed (result -104) [ 437.078216][ T5841] block nbd11: Receive control failed (result -32) [ 437.094124][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.095560][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 437.319883][T18184] gre0 speed is unknown, defaulting to 1000 [ 437.383381][T18191] Cannot find del_set index 1536 as target [ 437.466194][T18197] netlink: 'syz.3.4160': attribute type 39 has an invalid length. [ 437.642554][T18211] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 437.729997][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 437.778038][T18202] __nla_validate_parse: 13 callbacks suppressed [ 437.778061][T18202] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4162'. [ 437.824596][T18217] FAULT_INJECTION: forcing a failure. [ 437.824596][T18217] name failslab, interval 1, probability 0, space 0, times 0 [ 437.838781][T18217] CPU: 1 UID: 0 PID: 18217 Comm: syz.4.4165 Not tainted syzkaller #0 PREEMPT(full) [ 437.838810][T18217] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 437.838823][T18217] Call Trace: [ 437.838832][T18217] [ 437.838841][T18217] dump_stack_lvl+0xe8/0x150 [ 437.838875][T18217] should_fail_ex+0x412/0x560 [ 437.838911][T18217] should_failslab+0xa8/0x100 [ 437.838941][T18217] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 437.838966][T18217] ? xfrm_add_sa+0x2956/0x4230 [ 437.839001][T18217] kmemdup_noprof+0x2b/0x70 [ 437.839029][T18217] xfrm_add_sa+0x2956/0x4230 [ 437.839066][T18217] ? __pfx_xfrm_add_sa+0x10/0x10 [ 437.839092][T18217] ? apparmor_capable+0x126/0x170 [ 437.839123][T18217] ? __nla_parse+0x40/0x60 [ 437.839151][T18217] xfrm_user_rcv_msg+0x7ae/0xc40 [ 437.839186][T18217] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 437.839255][T18217] ? __pfx___mutex_trylock_common+0x10/0x10 [ 437.839290][T18217] ? rcu_is_watching+0x15/0xb0 [ 437.839318][T18217] ? trace_contention_end+0x3d/0x150 [ 437.839340][T18217] ? __mutex_lock+0x319/0x1300 [ 437.839369][T18217] netlink_rcv_skb+0x232/0x4b0 [ 437.839395][T18217] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 437.839426][T18217] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 437.839467][T18217] ? netlink_deliver_tap+0x2e/0x1b0 [ 437.839489][T18217] ? netlink_deliver_tap+0x2e/0x1b0 [ 437.839516][T18217] xfrm_netlink_rcv+0x79/0x90 [ 437.839545][T18217] netlink_unicast+0x80f/0x9b0 [ 437.839577][T18217] ? __pfx_netlink_unicast+0x10/0x10 [ 437.839609][T18217] ? netlink_sendmsg+0x650/0xb40 [ 437.839631][T18217] ? skb_put+0x11b/0x210 [ 437.839662][T18217] netlink_sendmsg+0x813/0xb40 [ 437.839697][T18217] ? __pfx_netlink_sendmsg+0x10/0x10 [ 437.839732][T18217] ? aa_sock_msg_perm+0xf1/0x1b0 [ 437.839764][T18217] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 437.839792][T18217] ____sys_sendmsg+0x972/0x9f0 [ 437.839830][T18217] ? __pfx_____sys_sendmsg+0x10/0x10 [ 437.839868][T18217] ? import_iovec+0x73/0xa0 [ 437.839897][T18217] ___sys_sendmsg+0x2a5/0x360 [ 437.839930][T18217] ? __pfx____sys_sendmsg+0x10/0x10 [ 437.839998][T18217] ? __fget_files+0x2a/0x420 [ 437.840016][T18217] ? __fget_files+0x3a0/0x420 [ 437.840043][T18217] __x64_sys_sendmsg+0x1bd/0x2a0 [ 437.840074][T18217] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 437.840121][T18217] ? __pfx_ksys_write+0x10/0x10 [ 437.840158][T18217] do_syscall_64+0x14d/0xf80 [ 437.840176][T18217] ? trace_irq_disable+0x3b/0x150 [ 437.840194][T18217] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.840215][T18217] ? clear_bhb_loop+0x40/0x90 [ 437.840239][T18217] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.840258][T18217] RIP: 0033:0x7f197a99c819 [ 437.840278][T18217] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.840295][T18217] RSP: 002b:00007f197b8de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 437.840318][T18217] RAX: ffffffffffffffda RBX: 00007f197ac15fa0 RCX: 00007f197a99c819 [ 437.840333][T18217] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 437.840346][T18217] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 437.840358][T18217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.840370][T18217] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 437.840404][T18217] [ 438.177691][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.185875][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.207052][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.257868][T18222] netlink: 'syz.4.4167': attribute type 1 has an invalid length. [ 438.274445][T18223] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4166'. [ 438.530246][T18236] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 438.576548][T18237] netlink: 'syz.1.4172': attribute type 1 has an invalid length. [ 438.585117][T18227] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 438.615239][T18240] Cannot find del_set index 1536 as target [ 438.634985][T18227] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 438.667974][T18244] Cannot find del_set index 1536 as target [ 438.707008][T18233] bond5: (slave gretap1): making interface the new active one [ 438.717374][T18233] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 438.728179][T18250] netlink: 'syz.3.4173': attribute type 39 has an invalid length. [ 438.793153][T18256] netlink: 'syz.2.4176': attribute type 1 has an invalid length. [ 438.797353][T18252] netlink: 'syz.0.4174': attribute type 39 has an invalid length. [ 438.882776][T18253] veth7: entered promiscuous mode [ 438.932137][T18259] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4177'. [ 438.937250][T18253] bond6: (slave veth7): Enslaving as a backup interface with a down link [ 438.941576][T18259] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4177'. [ 439.061249][T18256] 8021q: adding VLAN 0 to HW filter on device bond5 [ 439.151933][T18263] netlink: 'syz.3.4178': attribute type 3 has an invalid length. [ 439.182907][T18257] bond5: (slave gretap1): making interface the new active one [ 439.196300][T18257] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 439.407022][T18268] gre0 speed is unknown, defaulting to 1000 [ 439.462677][T18278] netlink: 'syz.2.4184': attribute type 3 has an invalid length. [ 440.296942][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.303491][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.420654][T18309] Cannot find del_set index 1536 as target [ 440.421225][T18319] veth5: entered promiscuous mode [ 440.446777][T18319] bond5: (slave veth5): Enslaving as a backup interface with a down link [ 440.835768][T18335] netlink: 80 bytes leftover after parsing attributes in process `syz.2.4196'. [ 440.939354][T18342] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4202'. [ 440.997346][T18343] lo: left allmulticast mode [ 441.030215][T18343] tunl0: left allmulticast mode [ 441.058435][T18343] gre0: left allmulticast mode [ 441.068045][T18343] gretap0: left allmulticast mode [ 441.082084][T18343] erspan0: left allmulticast mode [ 441.092449][T18343] ip_vti0: left allmulticast mode [ 441.098450][T18332] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4196'. [ 441.101952][T18343] ip6_vti0: left allmulticast mode [ 441.118107][T18343] sit0: left allmulticast mode [ 441.130833][T18343] ip6tnl0: left allmulticast mode [ 441.139136][T18343] ip6gre0: left allmulticast mode [ 441.147380][T18343] syz_tun: left allmulticast mode [ 441.156154][T18343] ip6gretap0: left allmulticast mode [ 441.167190][T18343] vcan0: left allmulticast mode [ 441.173797][T18343] bond0: left allmulticast mode [ 441.189184][T18343] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.197602][T18343] team0: left allmulticast mode [ 441.202519][T18343] dummy0: left allmulticast mode [ 441.208594][T18343] 8021q: adding VLAN 0 to HW filter on device team0 [ 441.218646][T18343] nlmon0: left allmulticast mode [ 441.224841][T18343] caif0: left allmulticast mode [ 441.231151][T18343] net_ratelimit: 9 callbacks suppressed [ 441.231169][T18343] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 441.255892][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.285397][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 441.293655][ C0] lec:lec_tx_timeout: lec0 [ 441.295906][T18355] team0: Port device dummy0 added [ 441.298533][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 441.326571][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.412840][T18358] Cannot find del_set index 1536 as target [ 441.490122][T18362] validate_nla: 5 callbacks suppressed [ 441.490145][T18362] netlink: 'syz.4.4206': attribute type 39 has an invalid length. [ 441.589135][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.845688][T18370] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4211'. [ 441.879046][T18370] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4211'. [ 441.899298][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 441.902817][T18370] netlink: 580 bytes leftover after parsing attributes in process `syz.3.4211'. [ 442.060396][T18380] FAULT_INJECTION: forcing a failure. [ 442.060396][T18380] name failslab, interval 1, probability 0, space 0, times 0 [ 442.074753][T18380] CPU: 0 UID: 0 PID: 18380 Comm: syz.4.4216 Not tainted syzkaller #0 PREEMPT(full) [ 442.074790][T18380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 442.074802][T18380] Call Trace: [ 442.074810][T18380] [ 442.074820][T18380] dump_stack_lvl+0xe8/0x150 [ 442.074855][T18380] should_fail_ex+0x412/0x560 [ 442.074890][T18380] should_failslab+0xa8/0x100 [ 442.074919][T18380] __kmalloc_node_track_caller_noprof+0xeb/0x7b0 [ 442.074945][T18380] ? xfrm_add_sa+0x2956/0x4230 [ 442.074979][T18380] kmemdup_noprof+0x2b/0x70 [ 442.075006][T18380] xfrm_add_sa+0x2956/0x4230 [ 442.075045][T18380] ? __pfx_xfrm_add_sa+0x10/0x10 [ 442.075070][T18380] ? apparmor_capable+0x126/0x170 [ 442.075099][T18380] ? __nla_parse+0x40/0x60 [ 442.075126][T18380] xfrm_user_rcv_msg+0x7ae/0xc40 [ 442.075159][T18380] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 442.075229][T18380] ? __pfx___mutex_trylock_common+0x10/0x10 [ 442.075261][T18380] ? rcu_is_watching+0x15/0xb0 [ 442.075289][T18380] ? trace_contention_end+0x3d/0x150 [ 442.075310][T18380] ? __mutex_lock+0x319/0x1300 [ 442.075337][T18380] netlink_rcv_skb+0x232/0x4b0 [ 442.075360][T18380] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 442.075388][T18380] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 442.075425][T18380] ? netlink_deliver_tap+0x2e/0x1b0 [ 442.075446][T18380] ? netlink_deliver_tap+0x2e/0x1b0 [ 442.075469][T18380] xfrm_netlink_rcv+0x79/0x90 [ 442.075497][T18380] netlink_unicast+0x80f/0x9b0 [ 442.075527][T18380] ? __pfx_netlink_unicast+0x10/0x10 [ 442.075548][T18380] ? netlink_sendmsg+0x650/0xb40 [ 442.075567][T18380] ? skb_put+0x11b/0x210 [ 442.075594][T18380] netlink_sendmsg+0x813/0xb40 [ 442.075627][T18380] ? __pfx_netlink_sendmsg+0x10/0x10 [ 442.075653][T18380] ? aa_sock_msg_perm+0xf1/0x1b0 [ 442.075682][T18380] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 442.075708][T18380] ____sys_sendmsg+0x972/0x9f0 [ 442.075745][T18380] ? __pfx_____sys_sendmsg+0x10/0x10 [ 442.075791][T18380] ? import_iovec+0x73/0xa0 [ 442.075819][T18380] ___sys_sendmsg+0x2a5/0x360 [ 442.075851][T18380] ? __pfx____sys_sendmsg+0x10/0x10 [ 442.075915][T18380] ? __fget_files+0x2a/0x420 [ 442.075932][T18380] ? __fget_files+0x3a0/0x420 [ 442.075957][T18380] __x64_sys_sendmsg+0x1bd/0x2a0 [ 442.075985][T18380] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 442.076023][T18380] ? __pfx_ksys_write+0x10/0x10 [ 442.076059][T18380] do_syscall_64+0x14d/0xf80 [ 442.076078][T18380] ? trace_irq_disable+0x3b/0x150 [ 442.076095][T18380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.076116][T18380] ? clear_bhb_loop+0x40/0x90 [ 442.076142][T18380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.076162][T18380] RIP: 0033:0x7f197a99c819 [ 442.076182][T18380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 442.076199][T18380] RSP: 002b:00007f197b8de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 442.076221][T18380] RAX: ffffffffffffffda RBX: 00007f197ac15fa0 RCX: 00007f197a99c819 [ 442.076236][T18380] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 442.076249][T18380] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 442.076262][T18380] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.076275][T18380] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 442.076309][T18380] [ 442.425893][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.763661][T18404] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.856014][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.908721][T18412] __nla_validate_parse: 1 callbacks suppressed [ 442.908742][T18412] netlink: 156 bytes leftover after parsing attributes in process `syz.4.4224'. [ 442.958227][T18394] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4220'. [ 443.003097][T18422] netlink: 'syz.0.4228': attribute type 3 has an invalid length. [ 443.039513][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.386478][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.584821][T18442] macsec1: entered promiscuous mode [ 443.593277][T18442] macvlan0: entered promiscuous mode [ 443.763073][T18453] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4239'. [ 443.773021][T18453] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4239'. [ 443.803973][T18451] netlink: 'syz.2.4239': attribute type 8 has an invalid length. [ 443.954474][T18465] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4243'. [ 443.964747][T18465] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4243'. [ 444.235666][T18475] netlink: 'syz.4.4248': attribute type 1 has an invalid length. [ 444.318821][T18485] Cannot find del_set index 1536 as target [ 444.348298][T18475] bond6: entered promiscuous mode [ 444.376398][T18475] 8021q: adding VLAN 0 to HW filter on device bond6 [ 444.429026][T18490] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4253'. [ 444.453297][T18496] netlink: 'syz.0.4251': attribute type 39 has an invalid length. [ 444.487311][T18489] 8021q: adding VLAN 0 to HW filter on device bond6 [ 444.497266][T18489] bond6: (slave wireguard0): The slave device specified does not support setting the MAC address [ 444.525718][T18489] bond6: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 444.551742][T18489] bond6: (slave wireguard0): making interface the new active one [ 444.553017][T18484] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4252'. [ 444.561989][T18489] wireguard0: entered promiscuous mode [ 444.576907][T18489] bond6: (slave wireguard0): Enslaving as an active interface with an up link [ 444.758991][T18508] netlink: 'syz.1.4260': attribute type 1 has an invalid length. [ 444.781173][T18511] IPv6: NLM_F_REPLACE set, but no existing node found! [ 444.811048][T18512] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4261'. [ 444.840879][T18512] syzkaller0: entered promiscuous mode [ 444.846697][T18512] syzkaller0: entered allmulticast mode [ 444.856783][T18514] SET target dimension over the limit! [ 445.023980][T18521] SET target dimension over the limit! [ 445.071602][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4266'. [ 445.120836][T18526] netlink: 'syz.2.4267': attribute type 3 has an invalid length. [ 445.153453][T18526] netlink: 'syz.2.4267': attribute type 3 has an invalid length. [ 445.491238][T18558] ipvlan2: entered promiscuous mode [ 445.503865][T18558] ipvlan2: entered allmulticast mode [ 445.511570][T18558] gretap0: entered allmulticast mode [ 445.542519][T18563] netlink: 'syz.3.4278': attribute type 1 has an invalid length. [ 445.659898][T18563] 8021q: adding VLAN 0 to HW filter on device bond6 [ 445.806568][T18573] sctp: [Deprecated]: syz.1.4282 (pid 18573) Use of struct sctp_assoc_value in delayed_ack socket option. [ 445.806568][T18573] Use struct sctp_sack_info instead [ 445.891834][T18581] FAULT_INJECTION: forcing a failure. [ 445.891834][T18581] name failslab, interval 1, probability 0, space 0, times 0 [ 445.906252][T18581] CPU: 1 UID: 0 PID: 18581 Comm: syz.1.4284 Not tainted syzkaller #0 PREEMPT(full) [ 445.906282][T18581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 445.906293][T18581] Call Trace: [ 445.906301][T18581] [ 445.906310][T18581] dump_stack_lvl+0xe8/0x150 [ 445.906344][T18581] should_fail_ex+0x412/0x560 [ 445.906377][T18581] should_failslab+0xa8/0x100 [ 445.906403][T18581] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 445.906426][T18581] ? __alloc_skb+0x186/0x7d0 [ 445.906447][T18581] ? __alloc_skb+0x1d0/0x7d0 [ 445.906466][T18581] ? __local_bh_enable_ip+0xd0/0x130 [ 445.906496][T18581] __alloc_skb+0x1d0/0x7d0 [ 445.906533][T18581] ? netlink_ack_tlv_len+0x6c/0x210 [ 445.906561][T18581] netlink_ack+0x146/0xa50 [ 445.906581][T18581] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 445.906602][T18581] ? ref_tracker_free+0x693/0x840 [ 445.906621][T18581] ? __copy_skb_header+0xa3/0x4a0 [ 445.906651][T18581] ? __pfx_ref_tracker_free+0x10/0x10 [ 445.906682][T18581] netlink_rcv_skb+0x2b6/0x4b0 [ 445.906706][T18581] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 445.906730][T18581] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 445.906765][T18581] ? netlink_deliver_tap+0x2e/0x1b0 [ 445.906796][T18581] netlink_unicast+0x80f/0x9b0 [ 445.906826][T18581] ? __pfx_netlink_unicast+0x10/0x10 [ 445.906849][T18581] ? netlink_sendmsg+0x650/0xb40 [ 445.906870][T18581] ? skb_put+0x11b/0x210 [ 445.906899][T18581] netlink_sendmsg+0x813/0xb40 [ 445.906930][T18581] ? __pfx_netlink_sendmsg+0x10/0x10 [ 445.906958][T18581] ? aa_sock_msg_perm+0xf1/0x1b0 [ 445.906990][T18581] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 445.907016][T18581] ____sys_sendmsg+0x972/0x9f0 [ 445.907055][T18581] ? __pfx_____sys_sendmsg+0x10/0x10 [ 445.907092][T18581] ? import_iovec+0x73/0xa0 [ 445.907127][T18581] ___sys_sendmsg+0x2a5/0x360 [ 445.907161][T18581] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.907225][T18581] ? __fget_files+0x2a/0x420 [ 445.907243][T18581] ? __fget_files+0x3a0/0x420 [ 445.907273][T18581] __x64_sys_sendmsg+0x1bd/0x2a0 [ 445.907303][T18581] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 445.907340][T18581] ? __pfx_ksys_write+0x10/0x10 [ 445.907375][T18581] do_syscall_64+0x14d/0xf80 [ 445.907394][T18581] ? trace_irq_disable+0x3b/0x150 [ 445.907410][T18581] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.907431][T18581] ? clear_bhb_loop+0x40/0x90 [ 445.907455][T18581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.907475][T18581] RIP: 0033:0x7f7937b9c819 [ 445.907495][T18581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.907510][T18581] RSP: 002b:00007f7938a33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 445.907540][T18581] RAX: ffffffffffffffda RBX: 00007f7937e15fa0 RCX: 00007f7937b9c819 [ 445.907554][T18581] RDX: 00000000040008c0 RSI: 0000200000000280 RDI: 0000000000000003 [ 445.907565][T18581] RBP: 00007f7938a33090 R08: 0000000000000000 R09: 0000000000000000 [ 445.907577][T18581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 445.907589][T18581] R13: 00007f7937e16038 R14: 00007f7937e15fa0 R15: 00007fff8bf63e28 [ 445.907621][T18581] [ 446.315611][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 446.323865][ C0] lec:lec_tx_timeout: lec0 [ 446.329424][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 446.466066][T18576] nbd12: detected capacity change from 0 to 4294967359 [ 446.484849][ T5841] block nbd12: Receive control failed (result -104) [ 446.485186][ T5831] block nbd12: Receive control failed (result -32) [ 446.517645][T18595] netlink: 'syz.2.4290': attribute type 1 has an invalid length. [ 446.523029][T18589] SET target dimension over the limit! [ 446.605644][ T5942] net_ratelimit: 12 callbacks suppressed [ 446.605676][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.677010][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.861979][T18613] Cannot find del_set index 1536 as target [ 446.893898][ T5831] Bluetooth: hci2: link tx timeout [ 446.902820][ T5831] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 446.924531][T18620] netlink: 'syz.3.4299': attribute type 39 has an invalid length. [ 447.021922][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.083672][T18627] tipc: Started in network mode [ 447.090234][T18627] tipc: Node identity fe800000000000000400000000000013, cluster identity 4711 [ 447.103828][T18627] tipc: Enabling of bearer rejected, failed to enable media [ 447.326860][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.433053][T18643] ip6tnl1: entered promiscuous mode [ 447.508011][T18632] gre0 speed is unknown, defaulting to 1000 [ 447.649848][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.817529][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.910300][T18670] netlink: 'syz.3.4316': attribute type 1 has an invalid length. [ 447.997358][ T3532] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 448.115803][T18680] __nla_validate_parse: 15 callbacks suppressed [ 448.115828][T18680] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4315'. [ 448.186152][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.217979][ T30] audit: type=1804 audit(1775199290.783:8): pid=18681 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.4315" name="/newroot/207/memory.events" dev="tmpfs" ino=1072 res=1 errno=0 [ 448.241633][ T30] audit: type=1800 audit(1775199290.783:9): pid=18681 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4315" name="memory.events" dev="tmpfs" ino=1072 res=0 errno=0 [ 448.264085][ T30] audit: type=1804 audit(1775199290.793:10): pid=18681 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.4315" name="/newroot/207/memory.events" dev="tmpfs" ino=1072 res=1 errno=0 [ 448.616375][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.690401][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.928194][ T5831] Bluetooth: hci2: command 0x0405 tx timeout [ 448.978430][ T3532] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.674353][T18670] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 449.676009][T18673] tap0: tun_chr_ioctl cmd 1074025677 [ 449.690070][T18673] tap0: linktype set to 778 [ 449.700648][T18678] tipc: Enabling of bearer rejected, failed to enable media [ 449.787215][T18686] netlink: 'syz.4.4318': attribute type 1 has an invalid length. [ 449.799815][T18685] netlink: 'syz.0.4319': attribute type 1 has an invalid length. [ 449.812962][T18685] netlink: 'syz.0.4319': attribute type 2 has an invalid length. [ 449.826540][T18685] netlink: 'syz.0.4319': attribute type 1 has an invalid length. [ 449.851758][T18685] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4319'. [ 449.911745][T18686] 8021q: adding VLAN 0 to HW filter on device bond8 [ 449.926142][T18688] bond8: entered allmulticast mode [ 449.950499][T18685] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4319'. [ 449.970715][T18693] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 449.978221][T18693] IPv6: NLM_F_CREATE should be set when creating new route [ 450.246877][T18705] netlink: 'syz.1.4326': attribute type 1 has an invalid length. [ 450.260746][T18707] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4327'. [ 450.377323][T18707] vlan2: entered promiscuous mode [ 450.436548][T18705] veth9: entered promiscuous mode [ 450.456827][T18705] bond7: (slave veth9): Enslaving as a backup interface with a down link [ 450.869460][T18735] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4337'. [ 450.878912][T18735] netlink: 'syz.2.4337': attribute type 1 has an invalid length. [ 451.069818][T18745] Cannot find del_set index 1536 as target [ 451.169965][ T11] block nbd9: Connection timed out, retrying (0/2 alive) [ 451.177432][ T11] block nbd9: Connection timed out, retrying (0/2 alive) [ 451.184650][ T11] block nbd9: Connection timed out, retrying (0/2 alive) [ 451.192126][T10152] block nbd9: Dead connection, failed to find a fallback [ 451.199379][T10152] block nbd9: shutting down sockets [ 451.204971][T10152] blk_print_req_error: 123 callbacks suppressed [ 451.204993][T10152] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.221139][ T11] block nbd9: Connection timed out, retrying (0/2 alive) [ 451.228521][T10152] buffer_io_error: 122 callbacks suppressed [ 451.228537][T10152] Buffer I/O error on dev nbd9, logical block 1, async page read [ 451.244379][T10152] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.254053][T10152] Buffer I/O error on dev nbd9, logical block 0, async page read [ 451.262340][T10152] I/O error, dev nbd9, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.273106][T10152] Buffer I/O error on dev nbd9, logical block 3, async page read [ 451.281014][T10152] I/O error, dev nbd9, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.290685][T10152] Buffer I/O error on dev nbd9, logical block 2, async page read [ 451.298681][T16221] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.308325][T16221] Buffer I/O error on dev nbd9, logical block 0, async page read [ 451.320733][T16221] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.347678][T16221] Buffer I/O error on dev nbd9, logical block 1, async page read [ 451.379936][T16221] I/O error, dev nbd9, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.437966][T16221] Buffer I/O error on dev nbd9, logical block 2, async page read [ 451.468112][T18762] FAULT_INJECTION: forcing a failure. [ 451.468112][T18762] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 451.491243][T16221] I/O error, dev nbd9, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.495043][T18764] xt_TCPMSS: Only works on TCP SYN packets [ 451.525761][T16221] Buffer I/O error on dev nbd9, logical block 3, async page read [ 451.554514][T18762] CPU: 1 UID: 0 PID: 18762 Comm: syz.4.4345 Not tainted syzkaller #0 PREEMPT(full) [ 451.554545][T18762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 451.554557][T18762] Call Trace: [ 451.554566][T18762] [ 451.554575][T18762] dump_stack_lvl+0xe8/0x150 [ 451.554610][T18762] should_fail_ex+0x412/0x560 [ 451.554648][T18762] _copy_from_user+0x2d/0xb0 [ 451.554674][T18762] ___sys_sendmsg+0x1c6/0x360 [ 451.554708][T18762] ? __pfx____sys_sendmsg+0x10/0x10 [ 451.554773][T18762] ? __fget_files+0x2a/0x420 [ 451.554792][T18762] ? __fget_files+0x3a0/0x420 [ 451.554822][T18762] __x64_sys_sendmsg+0x1bd/0x2a0 [ 451.554851][T18762] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 451.554887][T18762] ? __pfx_ksys_write+0x10/0x10 [ 451.554921][T18762] do_syscall_64+0x14d/0xf80 [ 451.554940][T18762] ? trace_irq_disable+0x3b/0x150 [ 451.554957][T18762] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.554977][T18762] ? clear_bhb_loop+0x40/0x90 [ 451.555002][T18762] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.555022][T18762] RIP: 0033:0x7f197a99c819 [ 451.555041][T18762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 451.555059][T18762] RSP: 002b:00007f197b8de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 451.555082][T18762] RAX: ffffffffffffffda RBX: 00007f197ac15fa0 RCX: 00007f197a99c819 [ 451.555096][T18762] RDX: 0000000000000700 RSI: 0000200000000240 RDI: 0000000000000003 [ 451.555109][T18762] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 451.555122][T18762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 451.555134][T18762] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 451.555166][T18762] [ 451.595530][T16221] I/O error, dev nbd9, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 451.845853][ T5942] net_ratelimit: 11 callbacks suppressed [ 451.845876][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.908452][ T5942] IPVS: starting estimator thread 0... [ 451.959786][T18779] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 451.976185][T18779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 452.028432][T18775] IPVS: using max 24 ests per chain, 57600 per kthread [ 452.031119][T16221] Buffer I/O error on dev nbd9, logical block 0, async page read [ 452.043474][T18787] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4354'. [ 452.050358][T16221] I/O error, dev nbd9, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 452.085445][T16221] Buffer I/O error on dev nbd9, logical block 1, async page read [ 452.102927][T18790] vlan3: entered promiscuous mode [ 452.109053][T16221] ldm_validate_partition_table(): Disk read failed. [ 452.125368][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 452.133543][ C0] lec:lec_tx_timeout: lec0 [ 452.138647][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 452.141679][T18792] Cannot find del_set index 1536 as target [ 452.164347][T18790] bond0: entered promiscuous mode [ 452.173998][T16221] Dev nbd9: unable to read RDB block 0 [ 452.181684][T18790] bond_slave_0: entered promiscuous mode [ 452.194290][T18790] bond_slave_1: entered promiscuous mode [ 452.201204][T16221] nbd9: unable to read partition table [ 452.216732][T18798] SET target dimension over the limit! [ 452.228638][T18801] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4355'. [ 452.249438][T18801] nbd: illegal input index -1113835520 [ 452.267676][T16221] ldm_validate_partition_table(): Disk read failed. [ 452.335959][T16221] Dev nbd9: unable to read RDB block 0 [ 452.349898][T16221] nbd9: unable to read partition table [ 452.446388][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 452.458336][ T3551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.605959][ T5831] Bluetooth: hci5: command 0x0406 tx timeout [ 452.687432][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 452.771964][T18827] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4366'. [ 452.886905][T18788] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 452.899555][T18788] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 452.918098][T18838] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4370'. [ 452.924589][T18840] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4371'. [ 452.937926][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.016605][T18842] syzkaller0: entered promiscuous mode [ 453.022285][T18842] syzkaller0: entered allmulticast mode [ 453.405613][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.451799][T18865] __nla_validate_parse: 1 callbacks suppressed [ 453.451820][T18865] netlink: 2120 bytes leftover after parsing attributes in process `syz.4.4380'. [ 453.518698][T18865] mac80211_hwsim hwsim46 wlan1: left allmulticast mode [ 453.576772][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.596117][T18865] netlink: 'syz.4.4380': attribute type 10 has an invalid length. [ 453.630473][T18865] mac80211_hwsim hwsim46 wlan1: entered promiscuous mode [ 453.662813][T18865] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 453.816498][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.858407][T18884] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 453.965907][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.081052][T18894] SET target dimension over the limit! [ 454.228832][T18904] netlink: 'syz.4.4397': attribute type 3 has an invalid length. [ 454.242534][T18903] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4395'. [ 454.282595][T18903] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4395'. [ 454.320613][T18903] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4395'. [ 454.496308][T18911] netlink: 7 bytes leftover after parsing attributes in process `syz.2.4400'. [ 454.665911][T11205] IPVS: starting estimator thread 0... [ 454.672639][T18931] netlink: 'syz.2.4407': attribute type 1 has an invalid length. [ 454.721884][T18931] 8021q: adding VLAN 0 to HW filter on device bond6 [ 454.761820][T18932] IPVS: using max 27 ests per chain, 64800 per kthread [ 454.814786][T18936] bond6: (slave veth5): Enslaving as an active interface with a down link [ 454.879930][T18931] netlink: 'syz.2.4407': attribute type 1 has an invalid length. [ 454.920002][T18931] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 454.933637][T18931] bond6: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 455.110953][T18952] netlink: 'syz.0.4414': attribute type 3 has an invalid length. [ 455.214086][T18959] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4417'. [ 455.314297][T18966] netlink: 'syz.4.4420': attribute type 10 has an invalid length. [ 455.350512][T18966] 8021q: adding VLAN 0 to HW filter on device team0 [ 455.385688][T18966] team0: entered promiscuous mode [ 455.390798][T18966] team_slave_0: entered promiscuous mode [ 455.406083][T18966] team_slave_1: entered promiscuous mode [ 455.412055][T18966] dummy0: entered promiscuous mode [ 455.419683][T18966] bond0: (slave team0): Enslaving as an active interface with an up link [ 455.604260][T18984] xt_HMARK: proto mask must be zero with L3 mode [ 455.634483][T18984] xt_cgroup: xt_cgroup: no path or classid specified [ 455.640200][T18989] FAULT_INJECTION: forcing a failure. [ 455.640200][T18989] name failslab, interval 1, probability 0, space 0, times 0 [ 455.659032][T18989] CPU: 1 UID: 0 PID: 18989 Comm: syz.4.4430 Not tainted syzkaller #0 PREEMPT(full) [ 455.659062][T18989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 455.659076][T18989] Call Trace: [ 455.659085][T18989] [ 455.659095][T18989] dump_stack_lvl+0xe8/0x150 [ 455.659130][T18989] should_fail_ex+0x412/0x560 [ 455.659169][T18989] should_failslab+0xa8/0x100 [ 455.659196][T18989] ? skb_clone+0x212/0x3a0 [ 455.659225][T18989] kmem_cache_alloc_noprof+0x87/0x650 [ 455.659247][T18989] ? __netlink_lookup+0xc6/0x8b0 [ 455.659281][T18989] skb_clone+0x212/0x3a0 [ 455.659311][T18989] __netlink_deliver_tap+0x404/0x850 [ 455.659346][T18989] ? netlink_deliver_tap+0x2e/0x1b0 [ 455.659372][T18989] netlink_deliver_tap+0x19c/0x1b0 [ 455.659409][T18989] netlink_unicast+0x7e3/0x9b0 [ 455.659442][T18989] ? __pfx_netlink_unicast+0x10/0x10 [ 455.659466][T18989] ? netlink_sendmsg+0x650/0xb40 [ 455.659488][T18989] ? skb_put+0x11b/0x210 [ 455.659517][T18989] netlink_sendmsg+0x813/0xb40 [ 455.659553][T18989] ? __pfx_netlink_sendmsg+0x10/0x10 [ 455.659582][T18989] ? aa_sock_msg_perm+0xf1/0x1b0 [ 455.659616][T18989] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 455.659642][T18989] ____sys_sendmsg+0x972/0x9f0 [ 455.659681][T18989] ? __pfx_____sys_sendmsg+0x10/0x10 [ 455.659720][T18989] ? import_iovec+0x73/0xa0 [ 455.659746][T18989] ___sys_sendmsg+0x2a5/0x360 [ 455.659780][T18989] ? __pfx____sys_sendmsg+0x10/0x10 [ 455.659842][T18989] ? __fget_files+0x2a/0x420 [ 455.659860][T18989] ? __fget_files+0x3a0/0x420 [ 455.659886][T18989] __x64_sys_sendmsg+0x1bd/0x2a0 [ 455.659915][T18989] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 455.659950][T18989] ? __pfx_ksys_write+0x10/0x10 [ 455.659985][T18989] do_syscall_64+0x14d/0xf80 [ 455.660004][T18989] ? trace_irq_disable+0x3b/0x150 [ 455.660020][T18989] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.660039][T18989] ? clear_bhb_loop+0x40/0x90 [ 455.660065][T18989] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.660084][T18989] RIP: 0033:0x7f197a99c819 [ 455.660103][T18989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.660119][T18989] RSP: 002b:00007f197b8de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 455.660140][T18989] RAX: ffffffffffffffda RBX: 00007f197ac15fa0 RCX: 00007f197a99c819 [ 455.660153][T18989] RDX: 0000000000040000 RSI: 0000200000000740 RDI: 0000000000000005 [ 455.660165][T18989] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 455.660176][T18989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.660187][T18989] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 455.660220][T18989] [ 455.941130][T18990] SET target dimension over the limit! [ 456.079321][T18993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4432'. [ 456.105988][T18997] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4433'. [ 456.304374][T19001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4435'. [ 456.314012][T19001] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4435'. [ 456.439170][T19012] SET target dimension over the limit! [ 456.526102][T19017] IPv6: NLM_F_REPLACE set, but no existing node found! [ 456.568616][T19014] xt_CT: You must specify a L4 protocol and not use inversions on it [ 456.956843][T19041] macvlan0: left allmulticast mode [ 456.975881][T19041] netlink: 'syz.4.4453': attribute type 2 has an invalid length. [ 457.088795][ T5942] net_ratelimit: 10 callbacks suppressed [ 457.088819][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.146764][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.165560][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 457.173795][ C0] lec:lec_tx_timeout: lec0 [ 457.178823][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 457.366904][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 457.568012][T10152] block nbd10: Connection timed out, retrying (0/2 alive) [ 457.575838][T10152] block nbd10: Connection timed out, retrying (0/2 alive) [ 457.583626][T10152] block nbd10: Connection timed out, retrying (0/2 alive) [ 457.592277][T18754] block nbd10: Dead connection, failed to find a fallback [ 457.602546][T18754] block nbd10: shutting down sockets [ 457.609505][T10152] block nbd10: Connection timed out, retrying (0/2 alive) [ 457.617591][T18754] blk_print_req_error: 123 callbacks suppressed [ 457.617616][T18754] I/O error, dev nbd10, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.637048][T18754] buffer_io_error: 122 callbacks suppressed [ 457.637068][T18754] Buffer I/O error on dev nbd10, logical block 1, async page read [ 457.646072][T19068] gre0 speed is unknown, defaulting to 1000 [ 457.658531][T18754] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.668932][T18754] Buffer I/O error on dev nbd10, logical block 0, async page read [ 457.677728][T18754] I/O error, dev nbd10, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.688574][T18754] Buffer I/O error on dev nbd10, logical block 3, async page read [ 457.697395][T18754] I/O error, dev nbd10, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.708119][T18754] Buffer I/O error on dev nbd10, logical block 2, async page read [ 457.716964][T16597] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.728994][ T5831] Bluetooth: hci4: command 0x0406 tx timeout [ 457.739447][T16597] Buffer I/O error on dev nbd10, logical block 0, async page read [ 457.749078][T16597] I/O error, dev nbd10, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.765838][T16597] Buffer I/O error on dev nbd10, logical block 1, async page read [ 457.772246][T19078] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 457.784140][T16597] I/O error, dev nbd10, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.784180][T16597] Buffer I/O error on dev nbd10, logical block 2, async page read [ 457.784228][T16597] I/O error, dev nbd10, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.784254][T16597] Buffer I/O error on dev nbd10, logical block 3, async page read [ 457.784313][T16597] I/O error, dev nbd10, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.784340][T16597] Buffer I/O error on dev nbd10, logical block 0, async page read [ 457.784381][T16597] I/O error, dev nbd10, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 457.784407][T16597] Buffer I/O error on dev nbd10, logical block 1, async page read [ 457.785068][T16597] ldm_validate_partition_table(): Disk read failed. [ 458.029349][T16597] Dev nbd10: unable to read RDB block 0 [ 458.051587][T16597] nbd10: unable to read partition table [ 458.072052][T16597] ldm_validate_partition_table(): Disk read failed. [ 458.079671][T16597] Dev nbd10: unable to read RDB block 0 [ 458.093708][T16597] nbd10: unable to read partition table [ 458.135958][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.328346][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.357097][T19084] netlink: 'syz.3.4465': attribute type 10 has an invalid length. [ 458.373178][T19084] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 458.546017][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.642568][T19109] __nla_validate_parse: 14 callbacks suppressed [ 458.642603][T19109] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4473'. [ 458.733057][T19109] vlan3: entered promiscuous mode [ 458.764776][T19119] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4477'. [ 458.896860][T19130] netlink: 'syz.3.4477': attribute type 2 has an invalid length. [ 459.167339][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.214310][T19134] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4479'. [ 459.266792][T19123] syzkaller1: entered promiscuous mode [ 459.273650][T19123] syzkaller1: entered allmulticast mode [ 459.449811][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.487252][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.497179][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.572277][T19154] netlink: 'syz.1.4485': attribute type 10 has an invalid length. [ 459.623406][T19154] netlink: 'syz.1.4485': attribute type 10 has an invalid length. [ 459.671991][T19154] team0: Port device dummy0 removed [ 459.726443][T19154] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 459.767925][T19157] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4485'. [ 459.795398][T19160] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4487'. [ 459.810843][T19157] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4485'. [ 459.811020][T19160] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4487'. [ 460.058619][T19166] xt_hashlimit: size too large, truncated to 1048576 [ 460.171194][T19169] syzkaller1: entered promiscuous mode [ 460.199061][T19169] syzkaller1: entered allmulticast mode [ 460.407263][T19175] SET target dimension over the limit! [ 460.584061][T19180] IPv6: NLM_F_REPLACE set, but no existing node found! [ 460.729988][T19182] gre0 speed is unknown, defaulting to 1000 [ 460.736893][T19183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4494'. [ 460.876790][T19188] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4496'. [ 461.413304][T19202] Bluetooth: MGMT ver 1.23 [ 461.442273][T19202] netlink: 'syz.0.4501': attribute type 4 has an invalid length. [ 461.475803][T19202] netlink: 'syz.0.4501': attribute type 4 has an invalid length. [ 461.649546][T19211] ipvlan3: entered promiscuous mode [ 461.654837][T19211] ipvlan3: entered allmulticast mode [ 461.698883][T19211] gretap0: entered allmulticast mode [ 462.021288][T19223] netlink: 'syz.2.4506': attribute type 1 has an invalid length. [ 462.177130][T19229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4507'. [ 462.185370][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 462.194215][ C0] lec:lec_tx_timeout: lec0 [ 462.199018][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 462.286286][ T5942] net_ratelimit: 9 callbacks suppressed [ 462.286310][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.337576][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.409097][T19230] bond7: (slave veth7): Enslaving as a backup interface with a down link [ 462.525731][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.705468][T19241] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.786000][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.834025][T19244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.843523][T19244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.868285][T19244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.886067][T19244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.905869][T19244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.461231][T19269] batadv0: entered promiscuous mode [ 463.467676][T19269] debugfs: 'hsr1' already exists in 'hsr' [ 463.473785][T19269] Cannot create hsr debugfs directory [ 464.095776][T19286] __nla_validate_parse: 4 callbacks suppressed [ 464.095798][T19286] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4527'. [ 464.119038][T19286] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4527'. [ 464.143616][T19286] team0: Device vlan0 is already an upper device of the team interface [ 464.152993][T19280] nbd13: detected capacity change from 0 to 137438953535 [ 464.162600][T16221] block nbd13: Send control failed (result -32) [ 464.162645][ T5841] block nbd13: Receive control failed (result -104) [ 464.162783][ T5831] block nbd13: Receive control failed (result -32) [ 464.211039][T16221] block nbd13: Request send failed, requeueing [ 464.225764][ T1625] block nbd13: Dead connection, failed to find a fallback [ 464.233631][ T1625] block nbd13: shutting down sockets [ 464.239678][ T1625] blk_print_req_error: 123 callbacks suppressed [ 464.239697][ T1625] I/O error, dev nbd13, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 464.265408][ T1625] buffer_io_error: 122 callbacks suppressed [ 464.265425][ T1625] Buffer I/O error on dev nbd13, logical block 1, async page read [ 464.280274][T16221] I/O error, dev nbd13, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 464.290664][T16221] Buffer I/O error on dev nbd13, logical block 2, async page read [ 464.299277][T16221] I/O error, dev nbd13, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 464.310161][T16221] Buffer I/O error on dev nbd13, logical block 3, async page read [ 464.443661][T19294] vlan3: entered promiscuous mode [ 464.676211][T19307] SET target dimension over the limit! [ 464.684548][T19308] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4536'. [ 464.710023][T19308] xfrm0: left allmulticast mode [ 464.736847][T19310] IPv6: NLM_F_REPLACE set, but no existing node found! [ 464.791879][T19314] netlink: 'syz.0.4539': attribute type 11 has an invalid length. [ 464.878812][T19318] netlink: 332 bytes leftover after parsing attributes in process `syz.3.4541'. [ 464.894710][T19318] netlink: 'syz.3.4541': attribute type 9 has an invalid length. [ 464.912836][T19318] netlink: 108 bytes leftover after parsing attributes in process `syz.3.4541'. [ 464.937846][T19318] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4541'. [ 464.975289][T19325] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4544'. [ 465.108778][T19334] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4546'. [ 465.318781][T19344] netlink: 'syz.3.4550': attribute type 13 has an invalid length. [ 465.331321][T19344] netlink: 'syz.3.4550': attribute type 17 has an invalid length. [ 465.585246][T19344] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.611930][T19344] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.666397][T19350] gre0 speed is unknown, defaulting to 1000 [ 465.752258][T19362] x_tables: duplicate underflow at hook 4 [ 465.769274][T19364] x_tables: duplicate underflow at hook 4 [ 465.894769][T19366] nbd: nbd1 already in use [ 465.912744][T19369] netlink: 'syz.4.4559': attribute type 1 has an invalid length. [ 466.170516][T19373] netlink: 'syz.1.4560': attribute type 10 has an invalid length. [ 466.198014][T19373] bond0: (slave dummy0): Releasing backup interface [ 466.220091][T19373] team0: Port device dummy0 added [ 466.830795][T19395] netlink: 'syz.0.4568': attribute type 1 has an invalid length. [ 467.044371][T19404] veth7: entered promiscuous mode [ 467.057407][T19404] bond6: (slave veth7): Enslaving as a backup interface with a down link [ 467.059519][T19407] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4571'. [ 467.174469][T19412] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4573'. [ 467.185855][ T1625] block nbd11: Connection timed out, retrying (0/2 alive) [ 467.194309][ T1625] block nbd11: Connection timed out, retrying (0/2 alive) [ 467.202676][T13473] block nbd11: Dead connection, failed to find a fallback [ 467.205403][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 467.215604][T13473] block nbd11: shutting down sockets [ 467.219095][ C0] lec:lec_tx_timeout: lec0 [ 467.224754][T13473] I/O error, dev nbd11, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.229873][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 467.240126][ T1625] block nbd11: Connection timed out, retrying (0/2 alive) [ 467.253385][ T1625] block nbd11: Connection timed out, retrying (0/2 alive) [ 467.261118][T13473] Buffer I/O error on dev nbd11, logical block 0, async page read [ 467.269701][T13473] I/O error, dev nbd11, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.279575][T13473] Buffer I/O error on dev nbd11, logical block 3, async page read [ 467.287791][T13473] I/O error, dev nbd11, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.298578][T13473] Buffer I/O error on dev nbd11, logical block 2, async page read [ 467.306800][T13473] I/O error, dev nbd11, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.317202][T13473] Buffer I/O error on dev nbd11, logical block 1, async page read [ 467.325821][T16537] I/O error, dev nbd11, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.335688][T16537] Buffer I/O error on dev nbd11, logical block 0, async page read [ 467.344238][T16537] I/O error, dev nbd11, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.354192][T16537] Buffer I/O error on dev nbd11, logical block 1, async page read [ 467.362441][T16537] I/O error, dev nbd11, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 467.362965][ T3509] net_ratelimit: 1043 callbacks suppressed [ 467.362980][ T3509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.372350][T16537] Buffer I/O error on dev nbd11, logical block 2, async page read [ 467.395068][T16537] ldm_validate_partition_table(): Disk read failed. [ 467.402366][T16537] Dev nbd11: unable to read RDB block 0 [ 467.408703][T16537] nbd11: unable to read partition table [ 467.429430][T16537] ldm_validate_partition_table(): Disk read failed. [ 467.488490][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.498886][T16537] Dev nbd11: unable to read RDB block 0 [ 467.516069][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.533459][T16537] nbd11: unable to read partition table [ 467.704377][T19433] SET target dimension over the limit! [ 467.736511][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.824209][T19437] FAULT_INJECTION: forcing a failure. [ 467.824209][T19437] name failslab, interval 1, probability 0, space 0, times 0 [ 467.848626][T19437] CPU: 1 UID: 0 PID: 19437 Comm: syz.2.4583 Not tainted syzkaller #0 PREEMPT(full) [ 467.848657][T19437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 467.848670][T19437] Call Trace: [ 467.848679][T19437] [ 467.848688][T19437] dump_stack_lvl+0xe8/0x150 [ 467.848724][T19437] should_fail_ex+0x412/0x560 [ 467.848760][T19437] should_failslab+0xa8/0x100 [ 467.848787][T19437] ? skb_clone+0x212/0x3a0 [ 467.848816][T19437] kmem_cache_alloc_noprof+0x87/0x650 [ 467.848838][T19437] ? __netlink_lookup+0xc6/0x8b0 [ 467.848872][T19437] skb_clone+0x212/0x3a0 [ 467.848905][T19437] __netlink_deliver_tap+0x404/0x850 [ 467.848944][T19437] ? netlink_deliver_tap+0x2e/0x1b0 [ 467.848970][T19437] netlink_deliver_tap+0x19c/0x1b0 [ 467.848995][T19437] netlink_unicast+0x7e3/0x9b0 [ 467.849028][T19437] ? __pfx_netlink_unicast+0x10/0x10 [ 467.849052][T19437] ? netlink_sendmsg+0x650/0xb40 [ 467.849074][T19437] ? skb_put+0x11b/0x210 [ 467.849103][T19437] netlink_sendmsg+0x813/0xb40 [ 467.849139][T19437] ? __pfx_netlink_sendmsg+0x10/0x10 [ 467.849168][T19437] ? aa_sock_msg_perm+0xf1/0x1b0 [ 467.849201][T19437] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 467.849228][T19437] ____sys_sendmsg+0x972/0x9f0 [ 467.849267][T19437] ? __pfx_____sys_sendmsg+0x10/0x10 [ 467.849306][T19437] ? import_iovec+0x73/0xa0 [ 467.849344][T19437] ___sys_sendmsg+0x2a5/0x360 [ 467.849378][T19437] ? __pfx____sys_sendmsg+0x10/0x10 [ 467.849448][T19437] ? __fget_files+0x2a/0x420 [ 467.849467][T19437] ? __fget_files+0x3a0/0x420 [ 467.849499][T19437] __x64_sys_sendmsg+0x1bd/0x2a0 [ 467.849530][T19437] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 467.849568][T19437] ? __pfx_ksys_write+0x10/0x10 [ 467.849605][T19437] do_syscall_64+0x14d/0xf80 [ 467.849624][T19437] ? trace_irq_disable+0x3b/0x150 [ 467.849649][T19437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.849670][T19437] ? clear_bhb_loop+0x40/0x90 [ 467.849695][T19437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.849715][T19437] RIP: 0033:0x7fd73579c819 [ 467.849736][T19437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.849753][T19437] RSP: 002b:00007fd7365e0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 467.849776][T19437] RAX: ffffffffffffffda RBX: 00007fd735a15fa0 RCX: 00007fd73579c819 [ 467.849789][T19437] RDX: 0000000000000700 RSI: 0000200000000240 RDI: 0000000000000003 [ 467.849802][T19437] RBP: 00007fd7365e0090 R08: 0000000000000000 R09: 0000000000000000 [ 467.849814][T19437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.849827][T19437] R13: 00007fd735a16038 R14: 00007fd735a15fa0 R15: 00007fff52076908 [ 467.849862][T19437] [ 467.869843][T19443] FAULT_INJECTION: forcing a failure. [ 467.869843][T19443] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 467.975610][ T5841] Bluetooth: hci1: command 0x0406 tx timeout [ 467.982206][T19443] CPU: 0 UID: 0 PID: 19443 Comm: syz.1.4585 Not tainted syzkaller #0 PREEMPT(full) [ 467.982232][T19443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 467.982244][T19443] Call Trace: [ 467.982252][T19443] [ 467.982261][T19443] dump_stack_lvl+0xe8/0x150 [ 467.982292][T19443] should_fail_ex+0x412/0x560 [ 467.982335][T19443] prepare_alloc_pages+0x22a/0x650 [ 467.982366][T19443] __alloc_frozen_pages_noprof+0x12f/0x380 [ 467.982393][T19443] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 467.982420][T19443] ? __pfx_policy_nodemask+0x10/0x10 [ 467.982454][T19443] alloc_pages_mpol+0x232/0x4a0 [ 467.982483][T19443] vma_alloc_folio_noprof+0xea/0x210 [ 467.982509][T19443] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 467.982543][T19443] do_wp_page+0x1204/0x5a00 [ 467.982591][T19443] ? __pfx_do_wp_page+0x10/0x10 [ 467.982613][T19443] ? do_raw_spin_lock+0x12b/0x2f0 [ 467.982635][T19443] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 467.982665][T19443] handle_mm_fault+0x1520/0x3310 [ 467.982705][T19443] ? handle_mm_fault+0xee/0x3310 [ 467.982739][T19443] ? __pfx_handle_mm_fault+0x10/0x10 [ 467.982765][T19443] ? follow_page_pte+0xd7f/0x1450 [ 467.982792][T19443] ? __pfx_follow_page_pte+0x10/0x10 [ 467.982822][T19443] __get_user_pages+0x165b/0x29d0 [ 467.982879][T19443] __gup_longterm_locked+0xdcf/0x1630 [ 467.982917][T19443] ? sanity_check_pinned_pages+0x1212/0x12d0 [ 467.982950][T19443] gup_fast_fallback+0x1d82/0x22e0 [ 467.983008][T19443] ? __pfx_gup_fast_fallback+0x10/0x10 [ 467.983040][T19443] ? pin_user_pages_fast+0x4d/0xb0 [ 467.983068][T19443] iov_iter_extract_pages+0x37b/0x5f0 [ 467.983098][T19443] extract_iter_to_sg+0xe62/0x2520 [ 467.983132][T19443] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 467.983168][T19443] ? __asan_memset+0x22/0x50 [ 467.983189][T19443] af_alg_get_rsgl+0x436/0x810 [ 467.983227][T19443] skcipher_recvmsg+0x3a3/0x1140 [ 467.983266][T19443] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 467.983285][T19443] ? aa_sock_msg_perm+0xf1/0x1b0 [ 467.983320][T19443] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 467.983340][T19443] ? security_socket_recvmsg+0x7e/0x2c0 [ 467.983360][T19443] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 467.983380][T19443] sock_recvmsg+0x172/0x1b0 [ 467.983404][T19443] ____sys_recvmsg+0x1e6/0x4a0 [ 467.983438][T19443] ? __pfx_____sys_recvmsg+0x10/0x10 [ 467.983479][T19443] ? import_iovec+0x73/0xa0 [ 467.983503][T19443] ___sys_recvmsg+0x215/0x590 [ 467.983524][T19443] ? get_pid_task+0x20/0x1f0 [ 467.983547][T19443] ? __pfx____sys_recvmsg+0x10/0x10 [ 467.983597][T19443] ? __fget_files+0x3a0/0x420 [ 467.983625][T19443] __x64_sys_recvmsg+0x1ba/0x2a0 [ 467.983652][T19443] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 467.983686][T19443] ? __pfx_ksys_write+0x10/0x10 [ 467.983718][T19443] do_syscall_64+0x14d/0xf80 [ 467.983735][T19443] ? trace_irq_disable+0x3b/0x150 [ 467.983750][T19443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.983768][T19443] ? clear_bhb_loop+0x40/0x90 [ 467.983790][T19443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 467.983807][T19443] RIP: 0033:0x7f7937b9c819 [ 467.983826][T19443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.983840][T19443] RSP: 002b:00007f7938a33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 467.983860][T19443] RAX: ffffffffffffffda RBX: 00007f7937e15fa0 RCX: 00007f7937b9c819 [ 467.983873][T19443] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000005 [ 467.983885][T19443] RBP: 00007f7938a33090 R08: 0000000000000000 R09: 0000000000000000 [ 467.983896][T19443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 467.983907][T19443] R13: 00007f7937e16038 R14: 00007f7937e15fa0 R15: 00007fff8bf63e28 [ 467.983937][T19443] [ 468.088771][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.540351][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.578961][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.605943][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.656204][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 468.662736][T19457] xt_connbytes: Forcing CT accounting to be enabled [ 468.866637][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 469.011073][T19475] netlink: 'syz.2.4598': attribute type 1 has an invalid length. [ 469.042229][T19473] xt_CT: You must specify a L4 protocol and not use inversions on it [ 469.055539][T19475] 8021q: adding VLAN 0 to HW filter on device bond8 [ 469.077086][T19480] tipc: Enabling of bearer rejected, failed to enable media [ 469.115189][T19482] bond8: (slave geneve3): making interface the new active one [ 469.123810][T19484] FAULT_INJECTION: forcing a failure. [ 469.123810][T19484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.137146][T19482] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 469.196466][T19484] CPU: 1 UID: 0 PID: 19484 Comm: syz.4.4600 Not tainted syzkaller #0 PREEMPT(full) [ 469.196497][T19484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 469.196509][T19484] Call Trace: [ 469.196518][T19484] [ 469.196526][T19484] dump_stack_lvl+0xe8/0x150 [ 469.196561][T19484] should_fail_ex+0x412/0x560 [ 469.196598][T19484] _copy_to_user+0x31/0xb0 [ 469.196625][T19484] simple_read_from_buffer+0xe1/0x170 [ 469.196660][T19484] proc_fail_nth_read+0x1bb/0x230 [ 469.196694][T19484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.196726][T19484] ? rw_verify_area+0x2a6/0x4d0 [ 469.196749][T19484] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.196779][T19484] vfs_read+0x20c/0xa70 [ 469.196799][T19484] ? fdget_pos+0x246/0x320 [ 469.196820][T19484] ? __pfx___mutex_lock+0x10/0x10 [ 469.196842][T19484] ? __pfx_vfs_read+0x10/0x10 [ 469.196865][T19484] ? __fget_files+0x2a/0x420 [ 469.196888][T19484] ? __fget_files+0x3a0/0x420 [ 469.196906][T19484] ? __fget_files+0x2a/0x420 [ 469.196933][T19484] ksys_read+0x150/0x270 [ 469.196957][T19484] ? __pfx_ksys_read+0x10/0x10 [ 469.196991][T19484] do_syscall_64+0x14d/0xf80 [ 469.197010][T19484] ? trace_irq_disable+0x3b/0x150 [ 469.197027][T19484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.197045][T19484] ? clear_bhb_loop+0x40/0x90 [ 469.197067][T19484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.197085][T19484] RIP: 0033:0x7f197a95d04e [ 469.197104][T19484] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 469.197120][T19484] RSP: 002b:00007f197b8ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 469.197141][T19484] RAX: ffffffffffffffda RBX: 00007f197b8de6c0 RCX: 00007f197a95d04e [ 469.197155][T19484] RDX: 000000000000000f RSI: 00007f197b8de0a0 RDI: 0000000000000006 [ 469.197167][T19484] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 469.197179][T19484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.197190][T19484] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 469.197223][T19484] [ 469.218402][T19488] __nla_validate_parse: 4 callbacks suppressed [ 469.218422][T19488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4602'. [ 469.760147][T19514] FAULT_INJECTION: forcing a failure. [ 469.760147][T19514] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 469.776692][T19514] CPU: 1 UID: 0 PID: 19514 Comm: syz.4.4611 Not tainted syzkaller #0 PREEMPT(full) [ 469.776722][T19514] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 469.776734][T19514] Call Trace: [ 469.776743][T19514] [ 469.776752][T19514] dump_stack_lvl+0xe8/0x150 [ 469.776787][T19514] should_fail_ex+0x412/0x560 [ 469.776824][T19514] _copy_to_user+0x31/0xb0 [ 469.776852][T19514] simple_read_from_buffer+0xe1/0x170 [ 469.776887][T19514] proc_fail_nth_read+0x1bb/0x230 [ 469.776920][T19514] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.776953][T19514] ? rw_verify_area+0x2a6/0x4d0 [ 469.776975][T19514] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 469.777006][T19514] vfs_read+0x20c/0xa70 [ 469.777026][T19514] ? fdget_pos+0x246/0x320 [ 469.777051][T19514] ? __pfx___mutex_lock+0x10/0x10 [ 469.777073][T19514] ? __pfx_vfs_read+0x10/0x10 [ 469.777097][T19514] ? __fget_files+0x2a/0x420 [ 469.777121][T19514] ? __fget_files+0x3a0/0x420 [ 469.777138][T19514] ? __fget_files+0x2a/0x420 [ 469.777168][T19514] ksys_read+0x150/0x270 [ 469.777193][T19514] ? __pfx_ksys_read+0x10/0x10 [ 469.777230][T19514] do_syscall_64+0x14d/0xf80 [ 469.777248][T19514] ? trace_irq_disable+0x3b/0x150 [ 469.777266][T19514] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.777286][T19514] ? clear_bhb_loop+0x40/0x90 [ 469.777311][T19514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.777331][T19514] RIP: 0033:0x7f197a95d04e [ 469.777351][T19514] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 469.777368][T19514] RSP: 002b:00007f197b8ddfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 469.777390][T19514] RAX: ffffffffffffffda RBX: 00007f197b8de6c0 RCX: 00007f197a95d04e [ 469.777405][T19514] RDX: 000000000000000f RSI: 00007f197b8de0a0 RDI: 0000000000000005 [ 469.777417][T19514] RBP: 00007f197b8de090 R08: 0000000000000000 R09: 0000000000000000 [ 469.777429][T19514] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 469.777441][T19514] R13: 00007f197ac16038 R14: 00007f197ac15fa0 R15: 00007ffe190d3b98 [ 469.777475][T19514] [ 470.286059][T19534] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4615'. [ 470.329804][T19529] gre0 speed is unknown, defaulting to 1000 [ 470.447414][T19540] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4619'. [ 470.477083][T19543] netlink: 'syz.3.4620': attribute type 32 has an invalid length. [ 470.699657][T19550] netlink: 'syz.3.4620': attribute type 1 has an invalid length. [ 470.782078][T19553] netlink: 'syz.1.4621': attribute type 3 has an invalid length. [ 470.832754][T19550] 8021q: adding VLAN 0 to HW filter on device bond7 [ 470.861876][T19558] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 471.035796][T19564] netlink: 65051 bytes leftover after parsing attributes in process `syz.1.4623'. [ 471.096966][T19566] SET target dimension over the limit! [ 471.102462][T19564] syzkaller1: entered promiscuous mode [ 471.102495][T19564] syzkaller1: entered allmulticast mode [ 471.341079][T19574] netlink: 'syz.0.4626': attribute type 1 has an invalid length. [ 471.497102][T19580] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4628'. [ 471.515419][T19580] netlink: 'syz.4.4628': attribute type 7 has an invalid length. [ 471.533745][T19580] netlink: 'syz.4.4628': attribute type 8 has an invalid length. [ 471.545084][T19580] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4628'. [ 471.562433][T19574] veth9: entered promiscuous mode [ 471.579347][T19574] bond7: (slave veth9): Enslaving as a backup interface with a down link [ 471.738414][T19589] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4630'. [ 471.951354][T19596] netlink: 'syz.1.4633': attribute type 1 has an invalid length. [ 472.034924][T19596] bond8: (slave veth11): Enslaving as a backup interface with a down link [ 472.255380][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 472.263844][ C0] lec:lec_tx_timeout: lec0 [ 472.269982][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 472.497923][ T3509] net_ratelimit: 18 callbacks suppressed [ 472.497947][ T3509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.687307][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.726414][ T3509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.925944][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.962737][T19632] gre0 speed is unknown, defaulting to 1000 [ 473.108377][ T5841] Bluetooth: hci3: command 0x0406 tx timeout [ 473.169233][T19638] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.178799][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.221542][T19638] netlink: 'syz.0.4648': attribute type 4 has an invalid length. [ 473.245695][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.266822][ T3509] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.290688][T19643] netlink: 'syz.0.4648': attribute type 4 has an invalid length. [ 473.352977][T19641] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 473.388051][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.626711][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.955158][T19696] netlink: 152 bytes leftover after parsing attributes in process `syz.3.4659'. [ 474.975952][T19696] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4659'. [ 475.023150][T19696] team0: Device vlan2 is already an upper device of the team interface [ 475.184044][T19703] syzkaller1: entered promiscuous mode [ 475.198752][T19703] syzkaller1: entered allmulticast mode [ 475.302047][T19709] syzkaller1: entered promiscuous mode [ 475.315781][T19709] syzkaller1: entered allmulticast mode [ 475.732509][T19731] netlink: 180 bytes leftover after parsing attributes in process `syz.0.4673'. [ 475.734133][T19727] gre0 speed is unknown, defaulting to 1000 [ 475.893637][T19733] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4674'. [ 475.930366][T19733] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4674'. [ 475.994980][T19738] netlink: 'syz.2.4676': attribute type 1 has an invalid length. [ 476.216067][T19746] netlink: 'syz.0.4677': attribute type 3 has an invalid length. [ 476.431278][T19750] netlink: 332 bytes leftover after parsing attributes in process `syz.2.4679'. [ 476.441603][T19750] netlink: 'syz.2.4679': attribute type 9 has an invalid length. [ 476.450189][T19750] netlink: 108 bytes leftover after parsing attributes in process `syz.2.4679'. [ 476.538071][T19758] No such timeout policy "syz1" [ 476.543156][T19750] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4679'. [ 476.770907][T13473] block nbd12: Connection timed out, retrying (0/2 alive) [ 476.778384][T13473] block nbd12: Connection timed out, retrying (0/2 alive) [ 476.786130][T19415] block nbd12: Dead connection, failed to find a fallback [ 476.793381][T19415] block nbd12: shutting down sockets [ 476.798886][T19772] xfrm0: entered promiscuous mode [ 476.798912][T19772] xfrm0: entered allmulticast mode [ 476.810156][T13473] block nbd12: Connection timed out, retrying (0/2 alive) [ 476.818384][T19415] blk_print_req_error: 126 callbacks suppressed [ 476.818406][T19415] I/O error, dev nbd12, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.838573][T13473] block nbd12: Connection timed out, retrying (0/2 alive) [ 476.849975][T19415] buffer_io_error: 125 callbacks suppressed [ 476.849992][T19415] Buffer I/O error on dev nbd12, logical block 0, async page read [ 476.864139][T19415] I/O error, dev nbd12, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.873890][T19415] Buffer I/O error on dev nbd12, logical block 3, async page read [ 476.882026][T19415] I/O error, dev nbd12, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.892809][T19415] Buffer I/O error on dev nbd12, logical block 2, async page read [ 476.901452][T19415] I/O error, dev nbd12, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.911287][T19415] Buffer I/O error on dev nbd12, logical block 1, async page read [ 476.919758][T16598] I/O error, dev nbd12, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.930066][T16598] Buffer I/O error on dev nbd12, logical block 0, async page read [ 476.938061][T16598] I/O error, dev nbd12, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.949827][T16598] Buffer I/O error on dev nbd12, logical block 1, async page read [ 476.958409][T16598] I/O error, dev nbd12, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.968616][T16598] Buffer I/O error on dev nbd12, logical block 2, async page read [ 476.976736][T16598] I/O error, dev nbd12, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.986949][T16598] Buffer I/O error on dev nbd12, logical block 3, async page read [ 476.994991][T16598] I/O error, dev nbd12, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 477.005257][T16598] Buffer I/O error on dev nbd12, logical block 0, async page read [ 477.014162][T16598] I/O error, dev nbd12, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 477.024628][T16598] Buffer I/O error on dev nbd12, logical block 1, async page read [ 477.033856][T16598] ldm_validate_partition_table(): Disk read failed. [ 477.041330][T16598] Dev nbd12: unable to read RDB block 0 [ 477.047752][T16598] nbd12: unable to read partition table [ 477.117271][T16598] ldm_validate_partition_table(): Disk read failed. [ 477.124475][T16598] Dev nbd12: unable to read RDB block 0 [ 477.162347][T16598] nbd12: unable to read partition table [ 477.261548][T19780] gre0 speed is unknown, defaulting to 1000 [ 477.285672][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 477.293991][ C0] lec:lec_tx_timeout: lec0 [ 477.298908][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 477.313452][T19793] netlink: 'syz.4.4693': attribute type 1 has an invalid length. [ 477.424216][T19793] 8021q: adding VLAN 0 to HW filter on device bond9 [ 477.502485][T19798] bond9: (slave geneve2): making interface the new active one [ 477.517902][T19798] bond9: (slave geneve2): Enslaving as an active interface with an up link [ 477.532995][T19799] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4694'. [ 477.546066][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.576935][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.600076][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.622630][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.709929][T19810] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4699'. [ 477.729303][ T12] net_ratelimit: 23 callbacks suppressed [ 477.729325][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.743575][T11200] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.767793][T19813] ipvlan4: entered promiscuous mode [ 477.773335][T19813] ipvlan4: entered allmulticast mode [ 477.851289][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.894462][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.963461][T19795] gre0 speed is unknown, defaulting to 1000 [ 478.046062][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.113367][T19826] netlink: 'syz.3.4704': attribute type 2 has an invalid length. [ 478.128379][T19826] netlink: 'syz.3.4704': attribute type 9 has an invalid length. [ 478.146284][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.173257][T19820] veth7: entered allmulticast mode [ 478.197132][T19820] bond10: (slave veth7): Enslaving as an active interface with an up link [ 478.259554][T19824] bond10 (unregistering): (slave veth7): Releasing backup interface [ 478.271986][T19824] bond10 (unregistering): Released all slaves [ 478.367121][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.625131][T19848] FAULT_INJECTION: forcing a failure. [ 478.625131][T19848] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 478.651515][T19848] CPU: 1 UID: 0 PID: 19848 Comm: syz.1.4712 Not tainted syzkaller #0 PREEMPT(full) [ 478.651547][T19848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 478.651559][T19848] Call Trace: [ 478.651568][T19848] [ 478.651578][T19848] dump_stack_lvl+0xe8/0x150 [ 478.651612][T19848] should_fail_ex+0x412/0x560 [ 478.651649][T19848] prepare_alloc_pages+0x22a/0x650 [ 478.651684][T19848] __alloc_frozen_pages_noprof+0x12f/0x380 [ 478.651714][T19848] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 478.651744][T19848] ? __pfx_policy_nodemask+0x10/0x10 [ 478.651781][T19848] alloc_pages_mpol+0x232/0x4a0 [ 478.651814][T19848] vma_alloc_folio_noprof+0xea/0x210 [ 478.651843][T19848] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 478.651879][T19848] do_wp_page+0x1204/0x5a00 [ 478.651932][T19848] ? __pfx_do_wp_page+0x10/0x10 [ 478.651956][T19848] ? do_raw_spin_lock+0x12b/0x2f0 [ 478.651982][T19848] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 478.652013][T19848] handle_mm_fault+0x1520/0x3310 [ 478.652055][T19848] ? handle_mm_fault+0xee/0x3310 [ 478.652092][T19848] ? __pfx_handle_mm_fault+0x10/0x10 [ 478.652121][T19848] ? follow_page_pte+0xd7f/0x1450 [ 478.652159][T19848] ? __pfx_follow_page_pte+0x10/0x10 [ 478.652189][T19848] __get_user_pages+0x165b/0x29d0 [ 478.652262][T19848] __gup_longterm_locked+0xdcf/0x1630 [ 478.652307][T19848] ? sanity_check_pinned_pages+0x1212/0x12d0 [ 478.652344][T19848] gup_fast_fallback+0x1d82/0x22e0 [ 478.652409][T19848] ? __pfx_gup_fast_fallback+0x10/0x10 [ 478.652445][T19848] ? pin_user_pages_fast+0x4d/0xb0 [ 478.652476][T19848] iov_iter_extract_pages+0x37b/0x5f0 [ 478.652510][T19848] extract_iter_to_sg+0xe62/0x2520 [ 478.652549][T19848] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 478.652587][T19848] ? __asan_memset+0x22/0x50 [ 478.652610][T19848] af_alg_get_rsgl+0x436/0x810 [ 478.652653][T19848] skcipher_recvmsg+0x3a3/0x1140 [ 478.652697][T19848] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 478.652719][T19848] ? aa_sock_msg_perm+0xf1/0x1b0 [ 478.652753][T19848] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 478.652774][T19848] ? security_socket_recvmsg+0x7e/0x2c0 [ 478.652798][T19848] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 478.652822][T19848] sock_recvmsg+0x172/0x1b0 [ 478.652849][T19848] ____sys_recvmsg+0x1e6/0x4a0 [ 478.652886][T19848] ? __pfx_____sys_recvmsg+0x10/0x10 [ 478.652927][T19848] ? import_iovec+0x73/0xa0 [ 478.652953][T19848] ___sys_recvmsg+0x215/0x590 [ 478.652977][T19848] ? get_pid_task+0x20/0x1f0 [ 478.653004][T19848] ? __pfx____sys_recvmsg+0x10/0x10 [ 478.653061][T19848] ? __fget_files+0x3a0/0x420 [ 478.653093][T19848] __x64_sys_recvmsg+0x1ba/0x2a0 [ 478.653125][T19848] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 478.653165][T19848] ? __pfx_ksys_write+0x10/0x10 [ 478.653202][T19848] do_syscall_64+0x14d/0xf80 [ 478.653230][T19848] ? trace_irq_disable+0x3b/0x150 [ 478.653248][T19848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.653268][T19848] ? clear_bhb_loop+0x40/0x90 [ 478.653294][T19848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.653314][T19848] RIP: 0033:0x7f7937b9c819 [ 478.653335][T19848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 478.653352][T19848] RSP: 002b:00007f7938a33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 478.653374][T19848] RAX: ffffffffffffffda RBX: 00007f7937e15fa0 RCX: 00007f7937b9c819 [ 478.653389][T19848] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000005 [ 478.653402][T19848] RBP: 00007f7938a33090 R08: 0000000000000000 R09: 0000000000000000 [ 478.653415][T19848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.653428][T19848] R13: 00007f7937e16038 R14: 00007f7937e15fa0 R15: 00007fff8bf63e28 [ 478.653462][T19848] [ 479.121485][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.247806][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.366605][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.441679][T19865] RDS: rds_bind could not find a transport for ::ffff:10.1.1.2, load rds_tcp or rds_rdma? [ 479.757173][T19881] tipc: Enabling of bearer rejected, failed to enable media [ 479.879176][T19886] netlink: 'syz.0.4724': attribute type 10 has an invalid length. [ 480.023652][T19895] __nla_validate_parse: 5 callbacks suppressed [ 480.023676][T19895] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4729'. [ 480.120826][T19900] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4731'. [ 480.131577][T19900] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4731'. [ 480.156293][T19892] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4728'. [ 480.177235][T19900] team0: Device vlan0 is already an upper device of the team interface [ 480.194007][T19896] gre0 speed is unknown, defaulting to 1000 [ 480.253699][T19902] netlink: 'syz.1.4732': attribute type 10 has an invalid length. [ 480.638878][T19909] vlan3: entered promiscuous mode [ 480.695062][T19917] netlink: 'syz.2.4739': attribute type 9 has an invalid length. [ 481.101948][T19924] gre0 speed is unknown, defaulting to 1000 [ 481.507507][T19931] nbd14: detected capacity change from 0 to 2064447 [ 481.540155][ T5841] block nbd14: Receive control failed (result -32) [ 481.540155][ T5831] block nbd14: Receive control failed (result -104) [ 481.781164][T19949] netlink: 'syz.3.4750': attribute type 1 has an invalid length. [ 481.896931][T19958] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4751'. [ 481.937328][T19962] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4754'. [ 481.984606][T19963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4751'. [ 481.998785][T19949] bond8: entered promiscuous mode [ 482.018501][T19966] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4755'. [ 482.026008][T19949] 8021q: adding VLAN 0 to HW filter on device bond8 [ 482.068633][T19955] 8021q: adding VLAN 0 to HW filter on device bond8 [ 482.083276][T19955] bond8: (slave wireguard0): The slave device specified does not support setting the MAC address [ 482.095659][T19955] bond8: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 482.108812][ T5841] block nbd15: Receive control failed (result -1) [ 482.128773][T19955] bond8: (slave wireguard0): making interface the new active one [ 482.137652][T19955] wireguard0: entered promiscuous mode [ 482.146373][T19955] bond8: (slave wireguard0): Enslaving as an active interface with an up link [ 482.188174][T19958] erspan0: entered promiscuous mode [ 482.195625][T19958] macvtap1: entered promiscuous mode [ 482.206990][T19958] macvtap1: entered allmulticast mode [ 482.212905][T19958] erspan0: entered allmulticast mode [ 482.225010][T19961] dummy0: left promiscuous mode [ 482.231010][T19961] dummy0: left allmulticast mode [ 482.239556][T19961] team0: Port device dummy0 removed [ 482.305410][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 482.314360][ C0] lec:lec_tx_timeout: lec0 [ 482.320304][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 482.389997][T19971] SET target dimension over the limit! [ 482.525584][ C1] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 482.740398][ T12] net_ratelimit: 15 callbacks suppressed [ 482.740422][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.861474][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.087403][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.257875][ T5942] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.435863][ T3551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.806339][T11205] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.815435][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.831349][T20040] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4787'. [ 483.865949][ T3551] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.882565][T20041] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4787'. [ 484.016570][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.070235][T20050] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.097574][T20048] syzkaller1: entered promiscuous mode [ 484.103115][T20048] syzkaller1: entered allmulticast mode [ 484.352211][T20064] ipvlan3: entered promiscuous mode [ 484.382600][T20064] ipvlan3: entered allmulticast mode [ 484.500024][T20074] SET target dimension over the limit! [ 484.889232][T20087] : renamed from veth0_to_bond [ 485.271900][T20121] __nla_validate_parse: 3 callbacks suppressed [ 485.271921][T20121] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4818'. [ 485.436739][T20128] gre0 speed is unknown, defaulting to 1000 [ 485.458654][T20132] FAULT_INJECTION: forcing a failure. [ 485.458654][T20132] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 485.462209][T20135] netlink: 'syz.0.4823': attribute type 4 has an invalid length. [ 485.495766][T20132] CPU: 0 UID: 0 PID: 20132 Comm: syz.3.4820 Not tainted syzkaller #0 PREEMPT(full) [ 485.495795][T20132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 485.495807][T20132] Call Trace: [ 485.495816][T20132] [ 485.495824][T20132] dump_stack_lvl+0xe8/0x150 [ 485.495858][T20132] should_fail_ex+0x412/0x560 [ 485.495893][T20132] prepare_alloc_pages+0x22a/0x650 [ 485.495928][T20132] __alloc_frozen_pages_noprof+0x12f/0x380 [ 485.495957][T20132] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 485.495987][T20132] ? __pfx_policy_nodemask+0x10/0x10 [ 485.496024][T20132] alloc_pages_mpol+0x232/0x4a0 [ 485.496056][T20132] vma_alloc_folio_noprof+0xea/0x210 [ 485.496084][T20132] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 485.496121][T20132] do_wp_page+0x1204/0x5a00 [ 485.496173][T20132] ? __pfx_do_wp_page+0x10/0x10 [ 485.496199][T20132] ? do_raw_spin_lock+0x12b/0x2f0 [ 485.496223][T20132] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 485.496255][T20132] handle_mm_fault+0x1520/0x3310 [ 485.496299][T20132] ? handle_mm_fault+0xee/0x3310 [ 485.496345][T20132] ? __pfx_handle_mm_fault+0x10/0x10 [ 485.496375][T20132] ? follow_page_pte+0xd7f/0x1450 [ 485.496404][T20132] ? __pfx_follow_page_pte+0x10/0x10 [ 485.496435][T20132] __get_user_pages+0x165b/0x29d0 [ 485.496498][T20132] __gup_longterm_locked+0xdcf/0x1630 [ 485.496541][T20132] ? sanity_check_pinned_pages+0x1212/0x12d0 [ 485.496578][T20132] gup_fast_fallback+0x1d82/0x22e0 [ 485.496641][T20132] ? __pfx_gup_fast_fallback+0x10/0x10 [ 485.496677][T20132] ? pin_user_pages_fast+0x4d/0xb0 [ 485.496708][T20132] iov_iter_extract_pages+0x37b/0x5f0 [ 485.496741][T20132] extract_iter_to_sg+0xe62/0x2520 [ 485.496778][T20132] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 485.496816][T20132] ? __asan_memset+0x22/0x50 [ 485.496837][T20132] af_alg_get_rsgl+0x436/0x810 [ 485.496878][T20132] skcipher_recvmsg+0x3a3/0x1140 [ 485.496920][T20132] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 485.496942][T20132] ? aa_sock_msg_perm+0xf1/0x1b0 [ 485.496973][T20132] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 485.496994][T20132] ? security_socket_recvmsg+0x7e/0x2c0 [ 485.497018][T20132] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 485.497040][T20132] sock_recvmsg+0x172/0x1b0 [ 485.497064][T20132] ____sys_recvmsg+0x1e6/0x4a0 [ 485.497102][T20132] ? __pfx_____sys_recvmsg+0x10/0x10 [ 485.497146][T20132] ? import_iovec+0x73/0xa0 [ 485.497172][T20132] ___sys_recvmsg+0x215/0x590 [ 485.497197][T20132] ? get_pid_task+0x20/0x1f0 [ 485.497221][T20132] ? __pfx____sys_recvmsg+0x10/0x10 [ 485.497276][T20132] ? __fget_files+0x3a0/0x420 [ 485.497313][T20132] __x64_sys_recvmsg+0x1ba/0x2a0 [ 485.497344][T20132] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 485.497382][T20132] ? __pfx_ksys_write+0x10/0x10 [ 485.497417][T20132] do_syscall_64+0x14d/0xf80 [ 485.497435][T20132] ? trace_irq_disable+0x3b/0x150 [ 485.497452][T20132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.497471][T20132] ? clear_bhb_loop+0x40/0x90 [ 485.497495][T20132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 485.497515][T20132] RIP: 0033:0x7f09b7d9c819 [ 485.497534][T20132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 485.497550][T20132] RSP: 002b:00007f09b8bec028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 485.497572][T20132] RAX: ffffffffffffffda RBX: 00007f09b8015fa0 RCX: 00007f09b7d9c819 [ 485.497586][T20132] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000005 [ 485.497599][T20132] RBP: 00007f09b8bec090 R08: 0000000000000000 R09: 0000000000000000 [ 485.497611][T20132] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 485.497622][T20132] R13: 00007f09b8016038 R14: 00007f09b8015fa0 R15: 00007ffee7c1d4b8 [ 485.497656][T20132] [ 485.691548][T20136] netlink: 'syz.0.4823': attribute type 4 has an invalid length. [ 486.045946][T20141] syzkaller0: create flow: hash 3946617527 index 1 [ 486.095984][ T9977] syzkaller0: tun_net_xmit 76 [ 486.285746][ T9977] syzkaller0: tun_net_xmit 76 [ 486.400464][T20156] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4831'. [ 486.505029][T20138] syzkaller0: delete flow: hash 3946617527 index 2 [ 486.545806][ T9977] syzkaller0: tun_net_xmit 76 [ 486.626486][T20159] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4832'. [ 486.806685][T20174] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4835'. [ 487.335436][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 487.343697][ C0] lec:lec_tx_timeout: lec0 [ 487.349223][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 488.017105][ T103] net_ratelimit: 18 callbacks suppressed [ 488.017128][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.456865][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.526708][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.587992][T20159] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 488.611339][T20174] vlan3: entered promiscuous mode [ 488.636750][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.855996][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.988099][T20207] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4843'. [ 489.056477][T20207] 8021q: adding VLAN 0 to HW filter on device bond9 [ 489.126875][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.177293][T20216] netlink: 'syz.1.4845': attribute type 2 has an invalid length. [ 489.194879][T20216] netlink: 'syz.1.4845': attribute type 2 has an invalid length. [ 489.276223][T20216] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4845'. [ 489.486067][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.567387][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.636477][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.747126][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.774961][T20241] netlink: 'syz.4.4853': attribute type 1 has an invalid length. [ 489.814154][T20241] 8021q: adding VLAN 0 to HW filter on device bond10 [ 489.895287][T20244] tipc: Enabling of bearer rejected, failed to enable media [ 489.998806][T20239] syzkaller1: entered promiscuous mode [ 490.004460][T20239] syzkaller1: entered allmulticast mode [ 490.401225][T20261] netlink: 'syz.1.4861': attribute type 1 has an invalid length. [ 490.453541][T20266] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4861'. [ 490.587908][T20261] bond9: (slave gretap1): making interface the new active one [ 490.597659][T20261] bond9: (slave gretap1): Enslaving as an active interface with an up link [ 490.618941][T20261] macvlan2: entered promiscuous mode [ 490.624768][T20261] macvlan2: entered allmulticast mode [ 490.632095][T20261] bond9: entered promiscuous mode [ 490.638453][T20261] gretap1: entered promiscuous mode [ 490.644850][T20261] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 490.653790][T20261] bond9: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 490.675979][T20261] bond9: left promiscuous mode [ 490.686214][T20261] gretap1: left promiscuous mode [ 490.902818][T20277] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4865'. [ 490.932048][T20277] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4865'. [ 491.010092][T20282] IPv6: Can't replace route, no match found [ 491.116929][T20291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4871'. [ 491.158937][T20293] gre0 speed is unknown, defaulting to 1000 [ 491.283912][ T5942] IPVS: starting estimator thread 0... [ 491.376177][T20303] IPVS: using max 29 ests per chain, 69600 per kthread [ 491.507881][T20311] netlink: 'syz.0.4878': attribute type 1 has an invalid length. [ 491.522478][T20312] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4877'. [ 491.571184][T20311] 8021q: adding VLAN 0 to HW filter on device bond9 [ 492.029008][T20334] netlink: 'syz.3.4885': attribute type 1 has an invalid length. [ 492.128769][T20334] 8021q: adding VLAN 0 to HW filter on device bond10 [ 492.203363][T20340] bond10: (slave geneve3): making interface the new active one [ 492.227224][T20340] bond10: (slave geneve3): Enslaving as an active interface with an up link [ 492.241626][ T49] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.251959][ T49] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.292404][ T49] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.321008][ T49] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 492.347676][T20339] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4887'. [ 492.423140][T20347] gre0 speed is unknown, defaulting to 1000 [ 492.473464][T20352] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4890'. [ 492.518196][T20354] netlink: 'syz.2.4891': attribute type 3 has an invalid length. [ 492.771253][T20356] gre0 speed is unknown, defaulting to 1000 [ 493.068918][ T1109] net_ratelimit: 2068 callbacks suppressed [ 493.068942][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.117717][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.356081][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 493.362971][T20383] netlink: 176 bytes leftover after parsing attributes in process `syz.1.4900'. [ 493.405371][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6050 ms [ 493.413631][ C0] lec:lec_tx_timeout: lec0 [ 493.418751][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 493.474875][T20387] [ 493.477264][T20387] ====================================================== [ 493.484285][T20387] WARNING: possible circular locking dependency detected [ 493.491579][T20387] syzkaller #0 Not tainted [ 493.496115][T20387] ------------------------------------------------------ [ 493.503366][T20387] syz.1.4903/20387 is trying to acquire lock: [ 493.509435][T20387] ffff888079a6b818 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb6/0x300 [ 493.518329][T20387] [ 493.518329][T20387] but task is already holding lock: [ 493.525794][T20387] ffff88802909d1e0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 493.535211][T20387] [ 493.535211][T20387] which lock already depends on the new lock. [ 493.535211][T20387] [ 493.545626][T20387] [ 493.545626][T20387] the existing dependency chain (in reverse order) is: [ 493.554737][T20387] [ 493.554737][T20387] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 493.562750][T20387] __mutex_lock+0x19f/0x1300 [ 493.568000][T20387] elevator_change+0x1b3/0x450 [ 493.573402][T20387] elevator_set_none+0xb5/0x140 [ 493.578966][T20387] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 493.585311][T20387] nbd_start_device+0x17f/0xb10 [ 493.590726][T20387] nbd_genl_connect+0x165b/0x1cf0 [ 493.596286][T20387] genl_family_rcv_msg_doit+0x22a/0x330 [ 493.602367][T20387] genl_rcv_msg+0x61c/0x7a0 [ 493.607419][T20387] netlink_rcv_skb+0x232/0x4b0 [ 493.612938][T20387] genl_rcv+0x28/0x40 [ 493.617542][T20387] netlink_unicast+0x80f/0x9b0 [ 493.622851][T20387] netlink_sendmsg+0x813/0xb40 [ 493.628148][T20387] ____sys_sendmsg+0x972/0x9f0 [ 493.633507][T20387] ___sys_sendmsg+0x2a5/0x360 [ 493.638716][T20387] __x64_sys_sendmsg+0x1bd/0x2a0 [ 493.644186][T20387] do_syscall_64+0x14d/0xf80 [ 493.649315][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.655752][T20387] [ 493.655752][T20387] -> #5 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 493.664735][T20387] blk_alloc_queue+0x546/0x680 [ 493.670498][T20387] __blk_mq_alloc_disk+0x197/0x390 [ 493.676693][T20387] nbd_dev_add+0x499/0xb50 [ 493.681960][T20387] nbd_init+0x168/0x1f0 [ 493.686744][T20387] do_one_initcall+0x250/0x8d0 [ 493.692044][T20387] do_initcall_level+0x104/0x190 [ 493.697508][T20387] do_initcalls+0x59/0xa0 [ 493.702468][T20387] kernel_init_freeable+0x2a6/0x3e0 [ 493.708228][T20387] kernel_init+0x1d/0x1d0 [ 493.713655][T20387] ret_from_fork+0x51e/0xb90 [ 493.718916][T20387] ret_from_fork_asm+0x1a/0x30 [ 493.724316][T20387] [ 493.724316][T20387] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 493.731891][T20387] fs_reclaim_acquire+0x71/0x100 [ 493.737370][T20387] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 493.743714][T20387] __alloc_skb+0x1d0/0x7d0 [ 493.748746][T20387] __ip6_append_data+0x2a44/0x3c50 [ 493.754383][T20387] ip6_append_data+0x10f/0x280 [ 493.759676][T20387] rawv6_sendmsg+0x12d3/0x18e0 [ 493.764985][T20387] ____sys_sendmsg+0x80a/0x9f0 [ 493.770282][T20387] ___sys_sendmsg+0x2a5/0x360 [ 493.775664][T20387] __x64_sys_sendmsg+0x1bd/0x2a0 [ 493.781221][T20387] do_syscall_64+0x14d/0xf80 [ 493.786338][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.792753][T20387] [ 493.792753][T20387] -> #3 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 493.800670][T20387] lock_sock_nested+0x41/0x100 [ 493.805957][T20387] inet_shutdown+0x6a/0x390 [ 493.810987][T20387] nbd_mark_nsock_dead+0x2e9/0x560 [ 493.816635][T20387] recv_work+0x1c7f/0x1d90 [ 493.821580][T20387] process_scheduled_works+0xb6e/0x18c0 [ 493.827651][T20387] worker_thread+0xa53/0xfc0 [ 493.832770][T20387] kthread+0x388/0x470 [ 493.837459][T20387] ret_from_fork+0x51e/0xb90 [ 493.842577][T20387] ret_from_fork_asm+0x1a/0x30 [ 493.847963][T20387] [ 493.847963][T20387] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 493.855612][T20387] __mutex_lock+0x19f/0x1300 [ 493.860727][T20387] nbd_queue_rq+0x37b/0x1100 [ 493.866013][T20387] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 493.872094][T20387] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 493.878952][T20387] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 493.885467][T20387] blk_mq_run_hw_queue+0x348/0x4f0 [ 493.891109][T20387] blk_mq_dispatch_list+0xd16/0xe10 [ 493.896932][T20387] blk_mq_flush_plug_list+0x48d/0x570 [ 493.902972][T20387] __blk_flush_plug+0x3ed/0x4d0 [ 493.908485][T20387] __submit_bio+0x28d/0x580 [ 493.913802][T20387] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 493.920854][T20387] block_read_full_folio+0x599/0x830 [ 493.926697][T20387] filemap_read_folio+0x137/0x3b0 [ 493.932253][T20387] do_read_cache_folio+0x358/0x590 [ 493.937999][T20387] read_part_sector+0xb6/0x2b0 [ 493.943321][T20387] adfspart_check_ICS+0xa5/0xa40 [ 493.948791][T20387] bdev_disk_changed+0x7ba/0x1550 [ 493.954349][T20387] blkdev_get_whole+0x380/0x510 [ 493.959779][T20387] bdev_open+0x31e/0xd30 [ 493.964729][T20387] blkdev_open+0x470/0x610 [ 493.969771][T20387] do_dentry_open+0x785/0x14e0 [ 493.975072][T20387] vfs_open+0x3b/0x340 [ 493.979747][T20387] path_openat+0x2e08/0x3860 [ 493.984952][T20387] do_file_open+0x23e/0x4a0 [ 493.989981][T20387] do_sys_openat2+0x113/0x200 [ 493.995283][T20387] __x64_sys_openat+0x138/0x170 [ 494.000670][T20387] do_syscall_64+0x14d/0xf80 [ 494.005805][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.012243][T20387] [ 494.012243][T20387] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 494.019485][T20387] __mutex_lock+0x19f/0x1300 [ 494.024727][T20387] nbd_queue_rq+0xc6/0x1100 [ 494.029772][T20387] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 494.035928][T20387] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 494.042817][T20387] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 494.049678][T20387] blk_mq_run_hw_queue+0x348/0x4f0 [ 494.055407][T20387] blk_mq_dispatch_list+0xd16/0xe10 [ 494.061162][T20387] blk_mq_flush_plug_list+0x48d/0x570 [ 494.067072][T20387] __blk_flush_plug+0x3ed/0x4d0 [ 494.072540][T20387] __submit_bio+0x28d/0x580 [ 494.077592][T20387] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 494.083757][T20387] block_read_full_folio+0x599/0x830 [ 494.089581][T20387] filemap_read_folio+0x137/0x3b0 [ 494.095140][T20387] do_read_cache_folio+0x358/0x590 [ 494.100792][T20387] read_part_sector+0xb6/0x2b0 [ 494.106179][T20387] adfspart_check_ICS+0xa5/0xa40 [ 494.111646][T20387] bdev_disk_changed+0x7ba/0x1550 [ 494.117284][T20387] blkdev_get_whole+0x380/0x510 [ 494.122669][T20387] bdev_open+0x31e/0xd30 [ 494.127528][T20387] blkdev_open+0x470/0x610 [ 494.132657][T20387] do_dentry_open+0x785/0x14e0 [ 494.138069][T20387] vfs_open+0x3b/0x340 [ 494.142731][T20387] path_openat+0x2e08/0x3860 [ 494.147934][T20387] do_file_open+0x23e/0x4a0 [ 494.152983][T20387] do_sys_openat2+0x113/0x200 [ 494.158201][T20387] __x64_sys_openat+0x138/0x170 [ 494.163599][T20387] do_syscall_64+0x14d/0xf80 [ 494.169029][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.175661][T20387] [ 494.175661][T20387] -> #0 (set->srcu){.+.+}-{0:0}: [ 494.183036][T20387] __lock_acquire+0x15a5/0x2cf0 [ 494.188546][T20387] lock_sync+0x9d/0x120 [ 494.193696][T20387] __synchronize_srcu+0xca/0x300 [ 494.199173][T20387] elevator_switch+0x1e8/0x7a0 [ 494.204587][T20387] elevator_change+0x2cc/0x450 [ 494.209991][T20387] elevator_set_default+0x36c/0x430 [ 494.215919][T20387] blk_register_queue+0x366/0x430 [ 494.221505][T20387] __add_disk+0x677/0xd50 [ 494.226375][T20387] add_disk_fwnode+0xfb/0x480 [ 494.231581][T20387] nbd_dev_add+0x72c/0xb50 [ 494.236910][T20387] nbd_genl_connect+0x962/0x1cf0 [ 494.242558][T20387] genl_family_rcv_msg_doit+0x22a/0x330 [ 494.248846][T20387] genl_rcv_msg+0x61c/0x7a0 [ 494.253918][T20387] netlink_rcv_skb+0x232/0x4b0 [ 494.259776][T20387] genl_rcv+0x28/0x40 [ 494.264813][T20387] netlink_unicast+0x80f/0x9b0 [ 494.270190][T20387] netlink_sendmsg+0x813/0xb40 [ 494.275567][T20387] ____sys_sendmsg+0x972/0x9f0 [ 494.280862][T20387] ___sys_sendmsg+0x2a5/0x360 [ 494.286247][T20387] __x64_sys_sendmsg+0x1bd/0x2a0 [ 494.291712][T20387] do_syscall_64+0x14d/0xf80 [ 494.296835][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.303253][T20387] [ 494.303253][T20387] other info that might help us debug this: [ 494.303253][T20387] [ 494.313568][T20387] Chain exists of: [ 494.313568][T20387] set->srcu --> &q->q_usage_counter(io)#49 --> &q->elevator_lock [ 494.313568][T20387] [ 494.327317][T20387] Possible unsafe locking scenario: [ 494.327317][T20387] [ 494.334775][T20387] CPU0 CPU1 [ 494.340168][T20387] ---- ---- [ 494.345547][T20387] lock(&q->elevator_lock); [ 494.350145][T20387] lock(&q->q_usage_counter(io)#49); [ 494.358044][T20387] lock(&q->elevator_lock); [ 494.365163][T20387] sync(set->srcu); [ 494.369097][T20387] [ 494.369097][T20387] *** DEADLOCK *** [ 494.369097][T20387] [ 494.377500][T20387] 6 locks held by syz.1.4903/20387: [ 494.382700][T20387] #0: ffffffff8fc38910 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 494.390936][T20387] #1: ffffffff8fc38748 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 494.399923][T20387] #2: ffff88804a26f1d0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xe7/0x480 [ 494.410308][T20387] #3: ffff88802909d270 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x115/0x430 [ 494.420241][T20387] #4: ffff88802909ccd8 (&q->q_usage_counter(queue)#52){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 494.431128][T20387] #5: ffff88802909d1e0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 494.441140][T20387] [ 494.441140][T20387] stack backtrace: [ 494.447119][T20387] CPU: 0 UID: 0 PID: 20387 Comm: syz.1.4903 Not tainted syzkaller #0 PREEMPT(full) [ 494.447138][T20387] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 494.447148][T20387] Call Trace: [ 494.447156][T20387] [ 494.447164][T20387] dump_stack_lvl+0xe8/0x150 [ 494.447186][T20387] print_circular_bug+0x2e1/0x300 [ 494.447212][T20387] check_noncircular+0x12e/0x150 [ 494.447236][T20387] __lock_acquire+0x15a5/0x2cf0 [ 494.447256][T20387] ? check_path+0x21/0x40 [ 494.447279][T20387] ? lockdep_unlock+0x5d/0xd0 [ 494.447295][T20387] ? __lock_acquire+0x146e/0x2cf0 [ 494.447314][T20387] ? __synchronize_srcu+0xb6/0x300 [ 494.447332][T20387] lock_sync+0x9d/0x120 [ 494.447350][T20387] ? __synchronize_srcu+0xb6/0x300 [ 494.447368][T20387] __synchronize_srcu+0xca/0x300 [ 494.447386][T20387] ? do_raw_spin_lock+0x12b/0x2f0 [ 494.447401][T20387] ? __pfx___synchronize_srcu+0x10/0x10 [ 494.447422][T20387] ? read_tsc+0x9/0x20 [ 494.447438][T20387] ? ktime_get_mono_fast_ns+0x2af/0x2d0 [ 494.447455][T20387] ? synchronize_srcu+0x20d/0x270 [ 494.447473][T20387] elevator_switch+0x1e8/0x7a0 [ 494.447491][T20387] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 494.447512][T20387] elevator_change+0x2cc/0x450 [ 494.447530][T20387] ? do_raw_spin_unlock+0xf5/0x210 [ 494.447546][T20387] elevator_set_default+0x36c/0x430 [ 494.447565][T20387] ? __pfx_elevator_set_default+0x10/0x10 [ 494.447586][T20387] ? disk_register_independent_access_ranges+0x2db/0x380 [ 494.447604][T20387] ? blk_crypto_sysfs_register+0x11c/0x170 [ 494.447621][T20387] blk_register_queue+0x366/0x430 [ 494.447644][T20387] __add_disk+0x677/0xd50 [ 494.447667][T20387] ? down_read+0x272/0x2e0 [ 494.447684][T20387] add_disk_fwnode+0xfb/0x480 [ 494.447707][T20387] nbd_dev_add+0x72c/0xb50 [ 494.447726][T20387] ? __pfx_nbd_dev_add+0x10/0x10 [ 494.447749][T20387] ? bpf_lsm_capable+0x9/0x20 [ 494.447770][T20387] ? security_capable+0x7e/0x2c0 [ 494.447794][T20387] nbd_genl_connect+0x962/0x1cf0 [ 494.447811][T20387] ? __pfx___nla_validate_parse+0x10/0x10 [ 494.447831][T20387] ? __pfx_nbd_genl_connect+0x10/0x10 [ 494.447849][T20387] ? rcu_is_watching+0x15/0xb0 [ 494.447869][T20387] ? trace_kmalloc+0x2a/0x110 [ 494.447887][T20387] ? __nla_parse+0x40/0x60 [ 494.447903][T20387] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 494.447925][T20387] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 494.447949][T20387] genl_family_rcv_msg_doit+0x22a/0x330 [ 494.447978][T20387] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 494.448004][T20387] ? __lock_acquire+0x6b5/0x2cf0 [ 494.448024][T20387] genl_rcv_msg+0x61c/0x7a0 [ 494.448046][T20387] ? __pfx_genl_rcv_msg+0x10/0x10 [ 494.448066][T20387] ? __pfx_nbd_genl_connect+0x10/0x10 [ 494.448083][T20387] ? __lock_acquire+0x6b5/0x2cf0 [ 494.448104][T20387] netlink_rcv_skb+0x232/0x4b0 [ 494.448121][T20387] ? __pfx_genl_rcv_msg+0x10/0x10 [ 494.448141][T20387] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 494.448162][T20387] ? down_read+0x272/0x2e0 [ 494.448176][T20387] ? genl_rcv+0xd/0x40 [ 494.448195][T20387] genl_rcv+0x28/0x40 [ 494.448215][T20387] netlink_unicast+0x80f/0x9b0 [ 494.448232][T20387] ? __pfx_netlink_unicast+0x10/0x10 [ 494.448248][T20387] ? netlink_sendmsg+0x650/0xb40 [ 494.448263][T20387] ? skb_put+0x11b/0x210 [ 494.448283][T20387] netlink_sendmsg+0x813/0xb40 [ 494.448302][T20387] ? __pfx_netlink_sendmsg+0x10/0x10 [ 494.448320][T20387] ? aa_sock_msg_perm+0xf1/0x1b0 [ 494.448343][T20387] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 494.448361][T20387] ____sys_sendmsg+0x972/0x9f0 [ 494.448384][T20387] ? __pfx_____sys_sendmsg+0x10/0x10 [ 494.448407][T20387] ? import_iovec+0x73/0xa0 [ 494.448424][T20387] ___sys_sendmsg+0x2a5/0x360 [ 494.448445][T20387] ? __pfx____sys_sendmsg+0x10/0x10 [ 494.448467][T20387] ? futex_wake+0x4ac/0x580 [ 494.448495][T20387] ? __fget_files+0x2a/0x420 [ 494.448509][T20387] ? __fget_files+0x3a0/0x420 [ 494.448525][T20387] __x64_sys_sendmsg+0x1bd/0x2a0 [ 494.448545][T20387] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 494.448567][T20387] ? rcu_is_watching+0x15/0xb0 [ 494.448591][T20387] do_syscall_64+0x14d/0xf80 [ 494.448605][T20387] ? trace_irq_disable+0x3b/0x150 [ 494.448619][T20387] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.448633][T20387] ? clear_bhb_loop+0x40/0x90 [ 494.448649][T20387] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.448664][T20387] RIP: 0033:0x7f7937b9c819 [ 494.448679][T20387] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.448693][T20387] RSP: 002b:00007f7938a33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 494.448710][T20387] RAX: ffffffffffffffda RBX: 00007f7937e15fa0 RCX: 00007f7937b9c819 [ 494.448721][T20387] RDX: 0000000004004800 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 494.448732][T20387] RBP: 00007f7937c32c91 R08: 0000000000000000 R09: 0000000000000000 [ 494.448742][T20387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 494.448751][T20387] R13: 00007f7937e16038 R14: 00007f7937e15fa0 R15: 00007fff8bf63e28 [ 494.448768][T20387] [ 494.941997][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 494.951784][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 494.993169][T19415] block nbd13: Connection timed out, retrying (0/2 alive) [ 495.003657][T19415] blk_print_req_error: 123 callbacks suppressed [ 495.003677][T19415] I/O error, dev nbd13, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.019820][T19415] buffer_io_error: 122 callbacks suppressed [ 495.019841][T19415] Buffer I/O error on dev nbd13, logical block 0, async page read [ 495.033997][T16221] I/O error, dev nbd13, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.044056][T16221] Buffer I/O error on dev nbd13, logical block 0, async page read [ 495.046201][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.052961][T16221] I/O error, dev nbd13, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.069945][T16221] Buffer I/O error on dev nbd13, logical block 1, async page read [ 495.078912][T16221] I/O error, dev nbd13, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.089602][T16221] Buffer I/O error on dev nbd13, logical block 2, async page read [ 495.097786][T16221] I/O error, dev nbd13, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.107692][T16221] Buffer I/O error on dev nbd13, logical block 3, async page read [ 495.115917][T16221] I/O error, dev nbd13, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.125928][T16221] Buffer I/O error on dev nbd13, logical block 0, async page read [ 495.134134][T16221] I/O error, dev nbd13, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.143974][T16221] Buffer I/O error on dev nbd13, logical block 1, async page read [ 495.152034][T16221] I/O error, dev nbd13, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.162812][T16221] Buffer I/O error on dev nbd13, logical block 2, async page read [ 495.174170][T16221] I/O error, dev nbd13, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.186219][T16221] Buffer I/O error on dev nbd13, logical block 3, async page read [ 495.194215][T16221] I/O error, dev nbd13, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 495.207984][T16221] Buffer I/O error on dev nbd13, logical block 0, async page read [ 495.216788][T16221] ldm_validate_partition_table(): Disk read failed. [ 495.223730][T16221] Dev nbd13: unable to read RDB block 0 [ 495.230097][T16221] nbd13: unable to read partition table [ 495.239034][T16221] ldm_validate_partition_table(): Disk read failed. [ 495.246125][T16221] Dev nbd13: unable to read RDB block 0 [ 495.251978][T16221] nbd13: unable to read partition table [ 495.261785][ T5841] block nbd16: Receive control failed (result -32) [ 495.261806][ T5831] block nbd16: Receive control failed (result -32) [ 495.315681][T20387] nbd16: detected capacity change from 0 to 301989951 [ 495.333274][T16221] block nbd16: Dead connection, failed to find a fallback [ 495.349119][T16221] block nbd16: shutting down sockets [ 495.361391][T16221] ldm_validate_partition_table(): Disk read failed. [ 495.368561][T16221] Dev nbd16: unable to read RDB block 0 [ 495.374466][T16221] nbd16: unable to read partition table [ 495.393973][T16221] ldm_validate_partition_table(): Disk read failed. [ 495.401491][T16221] Dev nbd16: unable to read RDB block 0 [ 495.407676][T16221] nbd16: unable to read partition table [ 495.616682][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.736397][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.946119][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.965796][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.155919][ T49] net_ratelimit: 11 callbacks suppressed [ 498.155957][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.375835][ T499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.955748][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.005580][T11205] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.066365][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.089024][ T9977] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.165387][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 499.173631][ C0] lec:lec_tx_timeout: lec0 [ 499.178675][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 499.184708][ T499] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 499.266059][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 499.475677][ T103] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.075972][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 500.126036][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.727682][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.734011][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 503.248608][ T29] net_ratelimit: 16 callbacks suppressed [ 503.248631][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.395939][ T1109] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog