last executing test programs: 10.947473593s ago: executing program 4 (id=6198): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x14}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) 10.736186647s ago: executing program 4 (id=6199): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x7, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x9}, @NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x9c}, 0x1, 0x0, 0x1600}, 0x0) 10.553132254s ago: executing program 4 (id=6201): readv(0xffffffffffffffff, &(0x7f00000004c0)=[{&(0x7f0000000380)=""/202, 0xca}], 0x1) unshare(0x2c020400) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x1, 0x0, @private1, 0x80000009}]}, &(0x7f00000002c0)=0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84d, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_RATE64={0xc, 0x4, 0xdd31e353c9fd1eb}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x404c080}, 0x4008000) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x300, r8, 0x1d}, 0x80, &(0x7f0000000080), 0x1}, 0x4008081) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f00000004c0)=0x8) poll(&(0x7f0000000040), 0x1f90e7735b5a1879, 0x9) 9.37285606s ago: executing program 4 (id=6210): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000076c07010033d433fffe800000000000000000000000000010ff020040000000000000000000000001"], 0x340a) 8.860285079s ago: executing program 4 (id=6216): r0 = socket$packet(0x11, 0x2, 0x300) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0x1, 0x58, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bind$packet(r0, &(0x7f0000000140)={0x11, 0x5, r1, 0x1, 0xd}, 0x14) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000280)={r0, &(0x7f0000000180)='\x00', 0x200000, &(0x7f00000001c0)={@align=0x8, {0x2, 0x40, 0xfffffffb, 0xfd0a}}, 0x5, &(0x7f0000000200)={@_ha_fsid}, &(0x7f0000000240)=0x8}) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f00000002c0), 0x4) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_ifreq(r3, 0x8947, &(0x7f0000000000)={'team_slave_1\x00', @ifru_hwaddr=@multicast}) ioctl$sock_ifreq(r3, 0x8991, &(0x7f0000000040)={'bond0\x00', @ifru_names='bond_slave_1\x00'}) 8.564072012s ago: executing program 4 (id=6220): openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) (async) r0 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000080)=0x14) (async) r1 = socket$inet6(0xa, 0x2, 0xc) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x10, 0xeb0, 0x7f}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={r2, 0x7}, 0x8) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000180)={r2, 0x10000, 0x20}, &(0x7f00000001c0)=0xc) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={r4, @in6={{0xa, 0x4e23, 0x8, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}}, 0xb, 0x4, 0x800, 0x3, 0x18, 0x0, 0x9}, &(0x7f00000002c0)=0x9c) (async) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000300)={r4, 0xc6f, 0x1, [0xf]}, &(0x7f0000000340)=0xa) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000380)={r5, @in6={{0xa, 0x4e23, 0x94, @local, 0x6}}, 0x6, 0xe0, 0x9, 0x3, 0x3c, 0x7f, 0x4}, &(0x7f0000000440)=0x9c) (async) r7 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000480)={r2, @in6={{0xa, 0x4e22, 0x6877, @empty, 0x84}}, 0x6, 0x3, 0x7, 0x80000001, 0x84, 0x2, 0x2}, 0x9c) (async) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r7, 0x84, 0x79, &(0x7f0000000540)={r6, 0x3, 0x562d}, 0x8) socketpair(0x25, 0x80000, 0x1000, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_NODELAY(r8, 0x84, 0x3, &(0x7f00000005c0), &(0x7f0000000600)=0x4) (async) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), r3) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r9, 0x89f8, &(0x7f0000000700)={'syztnl1\x00', &(0x7f00000006c0)={'syztnl1\x00', 0x0, 0x20, 0x40, 0x97, 0x8, {{0x6, 0x4, 0x3, 0x1, 0x18, 0x65, 0x0, 0xe3, 0x4, 0x0, @broadcast, @local, {[@end]}}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r8, 0x89f3, &(0x7f00000007c0)={'erspan0\x00', &(0x7f0000000740)={'gretap0\x00', 0x0, 0x20, 0x40, 0xfff, 0x4, {{0x10, 0x4, 0x0, 0x21, 0x40, 0x68, 0x0, 0x4, 0x2f, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@generic={0x94, 0x11, "b8f9e3aba6be80208530de5cc9bddc"}, @noop, @ssrr={0x89, 0x17, 0xdf, [@local, @dev={0xac, 0x14, 0x14, 0x10}, @dev={0xac, 0x14, 0x14, 0x10}, @multicast1, @rand_addr=0x64010101]}]}}}}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r8, &(0x7f0000000bc0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x2004008}, 0xc, &(0x7f0000000b80)={&(0x7f0000000800)={0x348, r10, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0x320, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0xbc, 0x3, 0x0, 0x1, [{0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0xbf}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0xf, 0x2, '-\xc1()\\&].-(\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0xa, 0x2, '@\x1d\xcc{*\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x7}]}, {0x8, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}, {0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x3}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x9}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_NAME={0x5, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}, @ETHTOOL_A_BITSET_BIT_NAME={0x16, 0x2, './cgroup.cpu/syz0\x00'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x4}]}]}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x80, 0x4, "54e88a32130ef9d49bcb6c9a9b98c3bce0c22d604249e0c22ecf82b89f39ad6021f8e456ab4646014241b79ce472e1c05a88e60d050d5c40ce34fd86de00b0a2e3f73dcc4ce71b48757271a577c9288c937c3c7950b419a692f61d7b5378ddcf2c376adeb050a7db033aebd7626370d318674718aab11f0bcbe2c7b9"}, @ETHTOOL_A_BITSET_VALUE={0x34, 0x4, "cc5de0e83e6adb6d5d1896d5c3ae444eeed66d55a3a1ebb0910715758b7e10e1ebaa8ba74cf3f74843794cc0c786bea0"}, @ETHTOOL_A_BITSET_VALUE={0xd5, 0x4, "01aaabaf1487aad1f750a73835778d6baea6b7a8aa88e7815b0736a5f7763a2a35f792fbfce99679e702f6cfc18285636b5fafefc7b27b0106308619fc34fd6e1addb0f8ad795b808a63e55f42d09ca74e3e96d09ae230cad7dea8c3b85300fbbda1b60585ef39c7e2b2b554ff6530c7416d930540f84c18d34e8f5f64670d7e95ee6d5153f98a875104ddd442b3dcc035cbe3d1aed9a27d3033823fb1c113e95ae8a484de1211c13cb1737f96e77c4a3fbe6d71fae47b71010da46293dd55bf089111dd1e13aa4b810d7f89c28bb899cf"}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_VALUE={0x2e, 0x4, "29f36eccb99343b101a2fd8d23109346cc1a9073a917d35b257440b4088efb84acfe369ac73a15f6f237"}, @ETHTOOL_A_BITSET_VALUE={0x12, 0x4, "d2355b4d0624aa0cf00f4f0f2a0c"}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x7d, 0x4, "bc90712b916a430f269ecc16bc8b333acf5a89e557f055370118c1ddea0e57012a9f4b668b5f8709e55c01d4c72f784cfa67cf5d0e360fa8471959ae4299daaaf37db499523be5cf9df2d54b714d3eaecdad5dae8c8dfdc9d6f6e9b06a0e73083feed20f92d556bc42f73a222a587c36b9f0ca7441177b2c61"}]}, @ETHTOOL_A_DEBUG_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x348}, 0x1, 0x0, 0x0, 0x1}, 0x4000050) (async) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000c00)) (async) setsockopt$inet_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000d00)=@ccm_128={{0x304}, "f945c7b7b6587587", "efda882609b03c5d3872df0151b09e6b", "b93284c9", "b87e8940e9f25693"}, 0x28) (async) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x4, 0x110, r9, 0xc2201000) (async) r13 = socket$netlink(0x10, 0x3, 0x8) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x8, 0x80010, r13, 0x26f66000) r14 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) sendto(r14, &(0x7f0000000d40)="cf7b9b2c5de92741363c6de85839dda4f09cb60e8f4b92dda586277e5f2900fa1b317d165ea2c11685590897581698b099f8f8931e8f077388d2672feec67a7a9273097269996ca2ae2f05b69862b6c438c61b01b6c86559cf9d2b389d2c56aab8e94a", 0x63, 0x4000001, 0x0, 0x0) (async) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000dc0)=0x9, 0x4) (async) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000e00)={r4, 0x400, 0xa6d0}, &(0x7f0000000e40)=0x8) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r9, 0x84, 0x79, &(0x7f0000000e80)={r15, 0x73f7, 0x4}, 0x8) 6.435857332s ago: executing program 0 (id=6246): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000002c0)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e1c, 0x3, 'wrr\x00', 0x5, 0x80, 0x1b}, 0x2c) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000340)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x10000055}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) r5 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x50) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000050e8850000007000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r9 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000400)=0xc) ioctl$TUNSETOWNER(0xffffffffffffffff, 0x400454cc, r10) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f00000006c0)=0xe8) sendmsg$nl_generic(r0, &(0x7f0000000e40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="8c0300001d00010025bd7000fcdbdf25120000004f020280dc08ca19467268ad077552b1907fe884201903d93cdb60c07019598d8924f9ca34776fc2f9b8995ba4fc513b46f6d98fb2ea587c904171e8ec333613b77cde56afbf7eb84ffb75a3797ffd096b664ed1f5b3a82f6cddd6e7463dd3458c85bd94e9c120d1e4a7ae08a851ad1cbf012ab7a3b1ef6b6cb6fa194f6e65844723f208fbd5d3a463f8dcfc85b6110ec3edd5ad36ce5cfe4368e5569fe1e055b27be1f7f6314e9d664550836e9c998a4d2347dc808fcd988af0bcc1bf76f497c9961d5a162c8721918eee3ef5e4cc418240dc0338f966f0909e4b0ef3828be50c7c4db451b659a352a5c6bf205dc18ff7844c0356235185c5118cd25b2a1ab7598be31b5b1f575b2a91195df77435cab82d31b143b9cdbdbd92a15d2b55f38296c11928438e45e4de075abdac6a63fb207e4c3135029f9605f15886a57223640c3f5e8be09a4052077d9e8878feb3042d5c0923bed88afda26eab937d6d38f967c30093de00c00c763704d954ac037de20f5fa139e5ff19fd8b2f639ce814501e972fe1dd208f1bbaaf37d3f4d631cd8ea4a1d7376291da2629a14758e3886d6921b4905f46e4c740b09bf508004900", @ANYRES32=r10, @ANYBLOB="ea8f83b5148c81d59942dbd3daa425ee44548f1cd33b58e6e528008782e992354e839c4962d68866153534672262615baf2e6033d8330159efc98c97aad5505341044568a6d67582adb4fc3964b8dd3abc366e985bf8704633965263a83e2b3bc2958b807a86c09acc629ff35767a057ac097cab8dcda87da5ae2298765a006bd3eb2e0eff00781d89e9877be6979092de7b160400348004003a80001b01948008008200", @ANYRES32=r11, @ANYBLOB="fb5e099fbfa31b3950c8bdd1c7fc623209ae685ef64dc95218eb607cf374105fce9296b0a52d697f2757e07cca23fd4642a30053e17ba621b4213bccdfe3352daa7234a1793a00d6a8eca308ad67e6c2a112da44bd79106d50935d96acf23e5b7da364cb1cd2f128997e8ab7905e83e4b5f3bbfb917804f7876eb0e80500000000000000bdb6b917b6441cd99c7161941dd4f7557aa53ab304cabe89b37fe5e1d6e4985fd758bedcfa2fbc071d8a8a49581625431b0a48566796e9cc4e34c6ef57e6f1299a5859b3f26c7b1dcac6e85666009945ea81f85c8d16b25f1bdb8c3dae24c5874529fe8105290e5edd23ec797f0cf2e3c673b2a14dc604001f806cafffffffffcff5f5d39d406404001780000c00c8000700000000000000"], 0x38c}, 0x1, 0x0, 0x0, 0x8002}, 0x8001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r8, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 6.06532152s ago: executing program 0 (id=6250): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x22e02, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) (async) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r2, 0x29, 0xc8, &(0x7f0000000000)=0x400, 0x4) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00b3f0ffffffffffffaaaaaaaaaaaa86dd694fd2cd00103afffe8000000000000000000000000000bbff02"], 0x4a) 5.46953033s ago: executing program 0 (id=6258): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b0000"], 0x6f4}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0xffffffffffffff14, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r3, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r7, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000600)=@newtfilter={0x60, 0x2c, 0xd27, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {}, {}, {0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x1}, {0x0, 0x0, 0x1}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x5, 0xf2ff, 0xdc7a}}}]}]}]}}]}, 0x60}}, 0x0) 5.333785965s ago: executing program 3 (id=6262): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x30, 0x3, "5fad843dc5c1efe84ced18d4422d5b0b86e8441958d3d2ea41149f1e55359af069a2a5e039ccf56f068a5a0b"}, @NFTA_TARGET_NAME={0x9, 0x1, 'SNAT\x00'}, @NFTA_TARGET_REV={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x32}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}]}]}], {0x14}}, 0x10c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000001"], 0x6c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) readv(r1, &(0x7f0000000080)=[{&(0x7f0000000280)=""/208, 0xd0}, {&(0x7f0000000040)=""/12, 0xc}], 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r1) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1400000015000103"], 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x10, 0x1c, &(0x7f0000000500)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1c00ffb0, 0x0, 0x0, 0x0, 0xfffffffe}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x0, 0xf0070000}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1000000}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x0, 0xd, 0x9, 0x0, 0x0, 0x7ff}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x2}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {0x7, 0x1, 0xb, 0x4, 0x9}, {}, {0x4, 0x0, 0x6}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x5}}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 5.126036953s ago: executing program 3 (id=6264): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c020000190001000000000000000000fc02000000000000006c0000000000000000000000000000000000000000000000000003000000000200002008000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000000000000000000000000000000000001d00000000000000000000000000000000000000000000000000000000000000dd020000000000000000000000000000000000000000000084010500ac14143b000000000000000000000000000000002b00000000000000ac14140c000000000000000000000000000000000000ff00000000000000000000000000fc0200000000000000000000000000010000000032"], 0x23c}}, 0x0) 5.014361888s ago: executing program 3 (id=6267): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000002c0)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e1c, 0x3, 'wrr\x00', 0x5, 0x80, 0x1b}, 0x2c) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000340)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x10000055}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000400)=0xc) ioctl$TUNSETOWNER(r5, 0x400454cc, r7) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f00000006c0)=0xe8) sendmsg$nl_generic(r0, &(0x7f0000000e40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="8c0300001d00010025bd7000fcdbdf25120000004f020280dc08ca19467268ad077552b1907fe884201903d93cdb60c07019598d8924f9ca34776fc2f9b8995ba4fc513b46f6d98fb2ea587c904171e8ec333613b77cde56afbf7eb84ffb75a3797ffd096b664ed1f5b3a82f6cddd6e7463dd3458c85bd94e9c120d1e4a7ae08a851ad1cbf012ab7a3b1ef6b6cb6fa194f6e65844723f208fbd5d3a463f8dcfc85b6110ec3edd5ad36ce5cfe4368e5569fe1e055b27be1f7f6314e9d664550836e9c998a4d2347dc808fcd988af0bcc1bf76f497c9961d5a162c8721918eee3ef5e4cc418240dc0338f966f0909e4b0ef3828be50c7c4db451b659a352a5c6bf205dc18ff7844c0356235185c5118cd25b2a1ab7598be31b5b1f575b2a91195df77435cab82d31b143b9cdbdbd92a15d2b55f38296c11928438e45e4de075abdac6a63fb207e4c3135029f9605f15886a57223640c3f5e8be09a4052077d9e8878feb3042d5c0923bed88afda26eab937d6d38f967c30093de00c00c763704d954ac037de20f5fa139e5ff19fd8b2f639ce814501e972fe1dd208f1bbaaf37d3f4d631cd8ea4a1d7376291da2629a14758e3886d6921b4905f46e4c740b09bf508004900", @ANYRES32=r7, @ANYBLOB="ea8f83b5148c81d59942dbd3daa425ee44548f1cd33b58e6e528008782e992354e839c4962d68866153534672262615baf2e6033d8330159efc98c97aad5505341044568a6d67582adb4fc3964b8dd3abc366e985bf8704633965263a83e2b3bc2958b807a86c09acc629ff35767a057ac097cab8dcda87da5ae2298765a006bd3eb2e0eff00781d89e9877be6979092de7b160400348004003a80001b01948008008200", @ANYRES32=r8, @ANYBLOB="fb5e099fbfa31b3950c8bdd1c7fc623209ae685ef64dc95218eb607cf374105fce9296b0a52d697f2757e07cca23fd4642a30053e17ba621b4213bccdfe3352daa7234a1793a00d6a8eca308ad67e6c2a112da44bd79106d50935d96acf23e5b7da364cb1cd2f128997e8ab7905e83e4b5f3bbfb917804f7876eb0e80500000000000000bdb6b917b6441cd99c7161941dd4f7557aa53ab304cabe89b37fe5e1d6e4985fd758bedcfa2fbc071d8a8a49581625431b0a48566796e9cc4e34c6ef57e6f1299a5859b3f26c7b1dcac6e85666009945ea81f85c8d16b25f1bdb8c3dae24c5874529fe8105290e5edd23ec797f0cf2e3c673b2a14dc604001f806cafffffffffcff5f5d39d406404001780000c00c8000700000000000000"], 0x38c}, 0x1, 0x0, 0x0, 0x8002}, 0x8001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 4.797326475s ago: executing program 1 (id=6269): r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000000)=0x1, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) (async, rerun: 32) sendmmsg$inet(r0, &(0x7f0000000500)=[{{&(0x7f0000000180)={0x2, 0x4e29, @remote}, 0x10, 0x0}}], 0x1, 0x4000000) (async, rerun: 32) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004090) (async, rerun: 32) syz_emit_ethernet(0x105, &(0x7f0000001780)=ANY=[@ANYBLOB="ffffffffffff0180c2000000080501060b6d63b25a289915672d9d97525b1c4e57c81efe5255da1fc3a02ea4ef5279b365c7bfdeff8e236b0ab533a770958114c22dc2628a463272f74c542d5c12833c44ede8ce3a9cc72e0978a30128d162ba40fd800000000000000015a815056587d7985ce2ff010000000000007404ee0fccd83cb107a1d7880f47717f186a1ec8e2be447b09aa7c8074eb6c70024cd7f28203e1651758f70c8480f98bb2b6e051cac3d410390fd0a20c53a179c6055f822ef729148f074f0bc74758fc05f7734fee23c85f76cebbf64d2d0dc91f311f382850c30cd02e2468391f16083849b92648f843ed0db8751f872c957a78eae5d925876a6ed2"], 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x10, &(0x7f0000000040)=0x3, 0x4) sendto(0xffffffffffffffff, &(0x7f00000000c0)="120000001200e7ef007b00000000", 0xe, 0x0, 0x0, 0x0) (async, rerun: 32) recvmmsg(0xffffffffffffffff, &(0x7f0000004f40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000940)=""/14, 0xe}, 0xdabc}], 0x1, 0x10022, 0x0) (rerun: 32) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000008c0)={'bridge0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000440)={'syztnl0\x00', &(0x7f0000000380)={'syztnl2\x00', r2, 0x29, 0x3, 0x8, 0xf9, 0x16, @private2, @private2, 0x40, 0x8, 0x6, 0x9e}}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001180)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000001140)={&(0x7f00000018c0)=ANY=[@ANYBLOB="80040000", @ANYRES16=r2, @ANYRESOCT=r1, @ANYRES32=r2, @ANYBLOB="0400028008080100", @ANYRES32=r2, @ANYRESDEC=r2, @ANYRES32=r3, @ANYBLOB="740202803c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r2, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000001000008000600", @ANYRES16, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000e00040062726f6164636173740000003c000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000b00040072616e646f6d000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b00000008000400e600000008000600", @ANYRES32=r2, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000500030003000000080004000b0000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r2, @ANYBLOB="4c000100240001006c625f74785f6d6574686f640000000000000000000000000000000000000000050003000500000019000400686173685f746f5f706f72745f6d617070696e670000000040000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000f000400726f756e64726f62696e0000aafe0100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000800000008000100", @ANYRES32=r2, @ANYBLOB="b800028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000800000008000600", @ANYRES32=r2, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400050000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="c0000280400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400feffffff08000600", @ANYRES32=r2, @ANYBLOB="3c00010024000100656e61626c656400000000000000000000000000000000000000000000000000050003000601ea000400040008000600", @ANYRES32=r2, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r2, @ANYRESOCT=r2, @ANYRES32=r2, @ANYBLOB="3c00028038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000050003000300000008000400faffffff080001002ae43d62118053891c3320e29c83e88f71af37a30b068977f3bd0ee3c92563b9c45ba038d38a61e19c852c283165d1cc3e79f2606bafff6fcd86abdfc2ed2ddb0ada859af3ae3c6fc1c407b36ad46aa706334777715f62179abc10a599c86020829ee1876fe20a2ea3bf10c94cba7dee26974eeb76262621976e2364cdeeb644a05c2a2e52dc501737d932543cff430482b0280171df38c6a9d504fd63a4bc7d6e38abfb4207ba75b56d81d48255815db6456940c2d053a3721b9942476b6b166cda05fec339f24f89ef6dae3d7e1b71c2c58c6c3e0ac2e39163955bbbacbcf85e6e968c8d2ba84168cfba7ed22e128f4b1697424e5e265024c7268e07e3cc1aa57da25958a3eec4db619109ae0642b2", @ANYRES32=r2, @ANYBLOB="04000280", @ANYRESDEC=0x0], 0x480}, 0x1, 0x0, 0x0, 0x44}, 0x41) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="280000001c00010029bd7000fedbdf25070000009d602d4ae3ab129e1256ace73f7aa72542264441a67590fd90ff54379405683ef573aa524196c94079a6ad7677d2aa96bd037746f227651d518bf4c3942812508bf43a15eb073b3e93207573a72a749845146dc87e3b77a3088613be708c5189", @ANYRES32=r2, @ANYBLOB="8000ba060a000200aaaaaaaaaa0c0000"], 0x28}, 0x1, 0x0, 0x0, 0x44}, 0x4040000) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000004040), 0xffffffffffffffff) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000206050000000000000000000700000505000400030000000900020073797a320000000014000780050015000000000008001240000000000500050002000000050001000602000015000300686173683a69702c706f72742c6e657400000000"], 0x64}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) sendmsg$SEG6_CMD_SETHMAC(r4, &(0x7f0000004140)={0x0, 0x0, &(0x7f0000004100)={&(0x7f0000000540)=ANY=[@ANYBLOB="2e000000ff744c39c4ef07b3e31f29bd9f1d7af0e413679087344ce9f52d7f6be518a38d3a5ea152222691da560c91851ef92def45735bc55468546bbec1c9e7fc32f1711d5c3b1450a5612e3e0c983488369374bea0d14a48338e", @ANYRES16=r5, @ANYBLOB="01002dbd7000fedbdf250100000005000600020000000500050004000000080003000700000004000400"], 0x30}, 0x1, 0x0, 0x0, 0x4845}, 0x20000080) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) socket$kcm(0xa, 0x2, 0x0) (async, rerun: 64) r8 = socket(0x2, 0x80805, 0x0) (rerun: 64) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @local, 0x4e21, 0x3, 'sh\x00', 0x1d, 0x9d43, 0x75}, 0x2c) (async) setsockopt$IP_VS_SO_SET_ADDDEST(r8, 0x0, 0x487, &(0x7f0000000000)={{0x0, @private=0xa010100, 0x4e21, 0x4, 'lc\x00', 0x5, 0x8, 0x74}, {@multicast2, 0x4e20, 0x10000, 0xcd}}, 0x44) (async) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000e40)=ANY=[@ANYBLOB="3266e6c489a64f7190c7af8ed37bf5518ead6d58774302514c8a5b75d6bf79a1e06b0a4698ae0d02d83d97b818b65b0ffdc89b6f621c6bccb29a119df12ca77b61de661312dddf880f525b2cba0085449c9de8849943080b9569fea56c2659ed0c477f749da61891a53aa706722d7102a9d3b5590f725102ec005bcbaefc334113c1b5a63b7ec798fac2e01e70c9323f8c37568a7f37d4dca923788d35b3f7912c8b17710000000000000000000000005caaaa5ff794601da3ff07878c973e19a08d16e4d1d9aac1133ec85474d87ef269784e0057c9b09d06c044c3ea9e8d0a4080af39a66ed10d120344e4d9915a5dcfdcbc39ba729a405f43dcebe95d98ff42db6425b2addf56806510c7606330c10ffb7e37780bb327f5325f22d934818b11da374bb1f0ff3bbe71582a05c3f32e7cea602b4e1f695df41e9cdced5e5e19f6c5cc627fc408d543a5a4f4504b1cf93a9d9215580c41c17f5cf4f61d9110a1e13dbeb16697e63dcabe65b597baa530a1f3e38cacabbf76c4ebb1a6c39eab1b33cb4e9628d84293b585306a8ce3071a7fd943f0b4adb2ec07e814fa7510dcff17b1d5d64ae320be14942a5324c6901a5fbaa5", @ANYRES32=r7, @ANYBLOB="073000000904000004001880"], 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x8804) sendmsg$AUDIT_GET_FEATURE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x3fb, 0x1, 0x70bd2a, 0x25dfdbfe, "", ["", "", "", ""]}, 0x10}}, 0x20048014) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000004060101000000000000000000000005050001000700000045df17a94c330c74ed6f3a2d7a5bb7709e599b39af90c72807a2b119006bc0"], 0x1c}, 0x1, 0x0, 0x0, 0x4040084}, 0x24040000) 4.691659409s ago: executing program 2 (id=6271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x94}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a88000000090a050000000000000000000a0000040900020073797a310000000008000a40fffffffc090001f573797a3100000000080005400000000b44001280200001800a00010071756f7461000000100002800c0001400000000000000080140001800c000100636f756e746572000400028001000180080001006c6f670008000340000001"], 0xb0}, 0x1, 0x0, 0x0, 0x4044050}, 0x40) 4.626091112s ago: executing program 1 (id=6272): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) socket$inet_mptcp(0x2, 0x1, 0x106) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) socket$unix(0x1, 0x1, 0x0) epoll_create1(0x0) socket$key(0xf, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400000000000000000ffe0000", @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200060000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 4.5748261s ago: executing program 2 (id=6273): r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="e8000000100001002dbd7000fddbdf257874732874776f666973682900000000000000000000000000000000000000001f000000000000000000000000000000000000000000000000000000c40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000008"], 0xe8}, 0x1, 0x0, 0x0, 0x44}, 0x80) 4.261860786s ago: executing program 2 (id=6274): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x161042, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a3000000000300003802c00008028000180230001"], 0xec}}, 0x0) close(0xffffffffffffffff) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) r3 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f0000000340)={r3}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000480)="d8001c00180081064e81f7050044fd56170d12a0b9b54570", 0x18}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e3, &(0x7f0000000180)={r3, r1}) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000000)=0x3) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, 0x0, 0x400d0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x80}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$kcm(0x11, 0xa, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0x14, 0x4, 0x8, 0x6, 0x0, 0x1}, 0x50) r6 = socket$inet6(0xa, 0x80002, 0x0) bind$inet6(r6, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) sendmsg$tipc(r5, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, 0x0}, 0x0) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r7, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e0000ea4feb931647fc5393de250000000000000000", 0x40}], 0x1}}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000fc0)="31fdffffffffffffff74098b2e5e55a1828636f60fc0cfdac56c75f1687f0c56287423f5eed69f117e766bdbad0c2171ad6227e1173ab6efa2fcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbe385ea382294882839a22674037b8910bd8a1420e33eb9be6d10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba999d89d0c5d7c9c8c569334e9547e1e343b", 0x93}], 0x1}}, {{0x0, 0x0, &(0x7f0000000a00)}}], 0x3, 0x2090) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) 1.233208842s ago: executing program 0 (id=6275): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x9, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit, @call={0x85, 0x0, 0x0, 0x5a}]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="df6501cc240000001e0001000600000883cf3c00", @ANYRES32=0x0, @ANYBLOB="000002000800070004000000"], 0x24}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r2, @ANYBLOB="80007f0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}, 0x1c) ioctl$sock_proto_private(r3, 0x89e5, &(0x7f0000000200)="a4a3c5f979bca587f781d8d764e6d0841c412f021696ee67abc81298696f98e2574a249b67540f495b47cae673ba9447b5610366c04550cb8373a9e4691e3c9d32d8311b8bba4c48071172e6ac4619a5a64b8e135823078b407030c3da84402b00a1389370cecb5002a2241373d8577f3bc01d05d5e77431e8eee2ea51e5b267c185669ba7a3b90775674aa8fcad7ebf0de627d7e700714d1f05bd7226edcbb293c28eb03c21d0bec91cf024a0356b495225f143c857ee9f594d3ac588cda31ad30d38e231757f7b064f6f676b924055c6f18aa3ff442cd0b993b111590345") socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380"], 0xfc}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r5, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) syz_emit_ethernet(0xa6, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6012000800703afffe8000000000000000000000000000bbff02000000000000000000000000000186009078ff0700020000000007000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e44afc5538a8b3f0ab0c430d1be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af18020001ffffffffff60000000000000"], 0x0) socket(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x9, &(0x7f0000000400)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit, @call={0x85, 0x0, 0x0, 0x5a}]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) (async) sendmsg$nl_route(r1, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="df6501cc240000001e0001000600000883cf3c00", @ANYRES32=0x0, @ANYBLOB="000002000800070004000000"], 0x24}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r2, @ANYBLOB="80007f0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) (async) socket$inet6(0xa, 0x1, 0x0) (async) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) (async) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8000}, 0x1c) (async) ioctl$sock_proto_private(r3, 0x89e5, &(0x7f0000000200)="a4a3c5f979bca587f781d8d764e6d0841c412f021696ee67abc81298696f98e2574a249b67540f495b47cae673ba9447b5610366c04550cb8373a9e4691e3c9d32d8311b8bba4c48071172e6ac4619a5a64b8e135823078b407030c3da84402b00a1389370cecb5002a2241373d8577f3bc01d05d5e77431e8eee2ea51e5b267c185669ba7a3b90775674aa8fcad7ebf0de627d7e700714d1f05bd7226edcbb293c28eb03c21d0bec91cf024a0356b495225f143c857ee9f594d3ac588cda31ad30d38e231757f7b064f6f676b924055c6f18aa3ff442cd0b993b111590345") (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380"], 0xfc}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'macvlan0\x00'}) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r5, @ANYBLOB="00001700000000001c0037800b0001006970768a616e08000c0002"], 0x44}, 0x1, 0x0, 0x0, 0x4008010}, 0x0) (async) socket(0x10, 0x3, 0x0) (async) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) syz_emit_ethernet(0xa6, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6012000800703afffe8000000000000000000000000000bbff02000000000000000000000000000186009078ff0700020000000007000000000aa78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e44afc5538a8b3f0ab0c430d1be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af18020001ffffffffff60000000000000"], 0x0) (async) 1.223540907s ago: executing program 3 (id=6276): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd8}, 0x1, 0x0, 0xfff5, 0x4000850}, 0x40) 1.17923935s ago: executing program 2 (id=6277): openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000c40)={{r0, &(0x7f0000000140)='/de\xd3\xab\xc2\xb2-\xc1\x91\xb5f', 0x490000, &(0x7f0000000180)={@align=0xffffffff, {0x9, 0x5, 0x4, 0xffffffffffff97fb}}, 0x6, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000300)=0x10001}, 0x5, &(0x7f0000000b80)=[{0x3, 0x6, &(0x7f00000002c0)='(^:\x00', &(0x7f0000000440)="a60c6068b6d82bab71b3a6ba129535b7c7287b852f5b32a5c9d6afd7db5fd4860f1ac698d0c197d825e8389c029f50aebf79d2dc041f42ba1c50758595f6c168c35495af20ac9cef10d17a9a25003a6876609917f3a9b1492ab79a0c0be894b76358127071ffb83282cc2d676a3867cbc1e9442392ffcb82266ceed728249c454ae93c2529af6828cccb6bf2de", 0x8d, 0x20}, {0x1, 0x30, &(0x7f0000000500)='/dev/rfkill\x00', &(0x7f0000000540)="5ec92421ecbbcd6c3ca753c915a09f97d5589f7e3caaec6905efb9ab474a149a05f108bd67fcb935ada5998137cf3033e5f2493226712fd52550bcb7914cf2d25a5fd0111eb8af0aa0458828529a09d3e224a3deb48bd0e3e843c93d32c7c91b275b1e77b498390980bdb22265a88577a63d", 0x72, 0x2}, {0x1, 0x5, &(0x7f00000005c0)='-]#}*:\x00', &(0x7f0000000600)="a38fc61b82066fbb57bc0aca1fbf3a8705c3f45c0aa2d3a3793e20a53468521cd7937985789c7beaf234c470b95c0a221578963961581400b638bbad688205d29708e196", 0x44, 0x10}, {0x2, 0x9, &(0x7f0000000680)='/dev/net/tun\x00', &(0x7f0000000980)="11b59a51bff3d4ce8c394ab4143752ac6d8b9112222aeec1bee42b1bfdcac34e38d0cebca7be6a846415c168aa318f31ac769fb803725c969828e67606da6b11c063dccaaf4f22120fe961d11b12bb34131f02ad22e090074b93954b0879e39b3686bf1c63c8a869b4026803b03a2a2a77d6fd10bcbb2752e28544de9df3db70d96ba39242", 0x85, 0x10}, {0x2, 0x0, &(0x7f0000000a40)='/dev/net/tun\x00', &(0x7f0000000a80)="81bb613303e49e003ee38b070d29daf1715d0341b8c80319b8c1b27ed21dcf3f763d2a9ec922c0c9c2fdf698306d1486dae9b63c23d870307ab0daa7d67e5f14c4cf7e4d8c1aad5343136dbaf3cbec01d4f9c44f719936de241a7dd18b6f005a2bbad0a5e33695a7e588da2c017e4318bd7b3fb555407f2305daa764bafe5ce3e4a007d370b54fa0c90c07a285bbd474187958f03604918127a64b4040bc60f0ed50927d2ca011fd511bf19a32b7cef4820386000f9aa320b6fbfc8906791777eede7adc3ff7e5738b47313ca8f63499a4330b39efa2ac5955f900abe0091e95", 0xe0, 0x8}]}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000d40)={{r3}, &(0x7f0000000cc0), &(0x7f0000000d00)='%pI4 \x00'}, 0x20) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a0c020000160a05000000000000000000020000000900010073797a3000000000e00103800800014000000000080002400000000308000240000005527c0003801400010064756d6d7930000000000000000000001400010076657468315f746f5f627269646765001400010076657468305f746f5f6272696467650014000100766c616e300000000000000000000000140001007465616d5f736c6176655f31000000001400010077673000000000000000000000000000a40003801400010076657400315f746f5f6261746164760014000100697036746e6c300000000000000000001400010076657468315f746f5f7465616d00000014000100726f73653000000000000000000000001400010064756d6d7930000000000000000000001400010076657468315f6d616376746170000000140001006c6f00000000000000000000000000001400010074756e6c300000000000000000000000a4000380140001006e6574706369300000000000000000001400010076657468300000000000000000000000140001006d6163766c616e3100000000000000001400010070696d7265673000000000000000000014000100626f6e643000000000000000000000001400010076657468305f746f5f6873720000000014000100766c616e31000000000000000010000014000100626f6e64300000000000000000000000090002"], 0x234}}, 0x800) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) socket$unix(0x1, 0x1, 0x0) epoll_create1(0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) r4 = socket(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c00038008000140"], 0xfc}}, 0x8880) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r5, @ANYBLOB="000000000000000010010c"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) 1.033223857s ago: executing program 1 (id=6278): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1800000071000100000000000000000007000000", @ANYBLOB="0c0001"], 0x30}}, 0x0) ioctl$OCFS2_IOC_REFLINK(r0, 0x40186f04, &(0x7f0000000140)={&(0x7f0000000080)='#{]**)%\x00', &(0x7f0000000100)=')^\x00', 0x8309}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000069114e0000000000850000001a0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x16, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000069114e0000000000850000001a0000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) 1.031209157s ago: executing program 3 (id=6279): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x2010000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value=0x2000000}, 0x94) 1.006188079s ago: executing program 0 (id=6280): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f0b2ad1eb9769d74e4f1feff374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724190000006f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0ed9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab778c50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b28448692686ac80d81a89f9c29e276800"/2574], &(0x7f0000000140)='GPL\x00'}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000540)={r1, 0xffffffffffffffff, 0x34, 0x0, @void}, 0x10) r2 = socket$kcm(0x2, 0x1, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001dc0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef23d430f6296b32a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ece1ccb0cd2b6d3cffd962867a3a2f624f992daa94a0c556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff730d00000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409eaa988dbc2fee9d313d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7a36b26a4e70f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf37704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eede0068ca1457870eb30d211e23ccc8e06dddeb61799257ab5000013c86ba9affb12ec757c7234c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad0e0e2b45d14ee446b840edaa1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff75067d2a214f8c9d9b2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c50ce6a8e9f65de13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae20bf279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522f7dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87915ed063f608dddb03a95b51cb6febd5f24a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be42827dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2ddf4c4d26f1cdd8c3c9736cf5e5082de3b484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b0033f8dfe0fd9bb2a70801f763524e1d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cfcb9066668627820d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67736ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e942e35c4baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000c3d51d9a161446b4373e06a9e07f8a000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b5b1dfa9fd31df213c88b4047979379dc15c9056fd3baa8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221f05e6ca8c705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f12fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612aa25d61ce4e2c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008435f39381c2a77c001caae53db7316fa6d48d032ab6831ebb813c85855c7a9ad8140a4b29422fc20d4e75c848984a2e217ec9c2833b8fa9106ee1be2c05103a36fc1126f1aa5284ba7179843b08ecadc199b9038cf6b9ee4e1f321a6a32e03bd987ddfada1f69756651b73a7ed0f7e467081193b2844869"], &(0x7f0000000140)='GPL\x00'}, 0x48) close(r2) r5 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r5, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r5, r4}) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000040)={r2, r0}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0xf, 0x4, 0x8, 0xb}, 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r7, r8, 0x7, 0x0, @val=@tcx={@void, @value=r7}}, 0x1c) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000038c0)={r8, &(0x7f0000002800)="40113cee60917ad334ecea8258da4a7d5fa4aa9eb01a20cdb611722b45736c6ccd7815116244e60567d63cad3961277021071edb02a40a9685b638497083f5f2e13b9f457d07f8dcf1dd8d33493f9068efa194fe24645ea9f1419b0633a393464509f7b0a062698982a83b05b53755e138c469834f0e44283c7c016bfa1a4c2014bc12812b979e9a1b9ad8473085f118b738b8eae8c2941c18b6d65e5aa4e67daea11bc6da6aaa7f1004657f0ce91d084ee6969ea3c07a67c971aa5f838d7326dcda748717f4cb50af0628b8537fa4e68298c5ec94d3cd9adf8f6b94d75b91646f861cf59d36d3f2591036273e97a8ee0a205f98f2fa6da76dd938870d1c7328d04b5da1c8c146d00517c35371b87464d82dc179aa8c2ae4bcc94dd436f193cb6d38226b183b7cf3dd66f957487f65ffe97a7c519c0bdfba73c4b4980e0908e861e5d2ce168ec75684af255c5091d16d841400598c2d371d3794ce85c53d8cc4f55432de2c47facc147f034921bd15589156a42c8a4c219500ab4cc2597b46ee8f9377dc41312390272a5a62c521c628f6a02ade656cfe5caf0ca1b192a941f3e55a7bf9de9122c9da5b879005eb9202f9d8d7425681acc5e20785b154c45ca9593683ccf81e3c6b583d21f8d9813ebece88734099fe661d379832b633030bff05e0c6d1a564cb8fc7716e8663583fc04b617c368d5f23c3b962ddf16fe6b0c847c9fc29902d9ac293049347c5b2edbde9b8f1d9327a57d6f72f8b245c81c5aa6f17b70b5c940cb7645d2ce1ed5d9f5a2862824ee41eff812e4aeae6a756e2d2da792421eaf0ee2522f937b90575a9e3b1640309c3d2d7ec07f3cbe969f4d0127fc10361eb07016b092117275f0fbaeb689ff3e3f94c14b0de87ab48bc8d2ae3d1a76707717052896c3c58852380ec68f5ad6e79804cc7a9466073cae6ba14a86495e5a7e55e48ef393c40eaf0221230957a589f5d3d3b140b7562ba339832d80bf08978a4c00a2f6e1d0c3be8a9a5946dc3b9d2db3d4678e75aa81c1225a1537ae1099fd7389882b710df633b251bc337becaae933980e4459dd0c92b49d6ee62662856a138de34c81fe1eadb8defffafdd689fea0a9564333e6416d539d8ca975e3f09cdfdca06dc20e8dfa40068474334044cde292feb47cff1043c7fc20ee044581f85b81158916571297e4f44ecf33912171c58985cff5a8144d5799d7a2e0e06cbca09a2dd04cb463ca2dd59a840413aaded15ecbd3557f54d18f3db28248b0b0b1e7640f216d7def3c8228c135e4ef80312502bc64d20d5678e2c684d4dc87c850848a24b586bbcc35bb82898bc65ef71d41d7b7f8407c105287ce60884c75884e6580950940ebe837849f1c32eb01d14c4c6550adabadf65b62e973528e59ffa04fecd6ea341bc6d3ed94e97f3a5c06f0bd694478f59c1720d7c18001db2b7a93fb6035a40cd2dd5b4be4bcfc639a97ed74efec03b4dd035ae3736493632aa61bd2776eda155363d9714f7a7520b9ed807341a029f0fd61ce2afff6e270906a9b0aab8f65cb656555c7b400d705c7be67ea87bcbba6f56e1102f188cb6ef63a244b61a2c6193a246f6c237873220e8384522e09a0d90f0a2bd6888c8c0f74c9641f9cd501a6138e3abb74d038ba6daf02a1df76f3d01be854aaaf4678d826fe2f401764ec084dadbdc38101ab250d13f57df34aa3e235525b82ccba85ac0c6da78d68885a19b2f2114e2684fa878ab52d1fb08e8d73f577b10a22dc26a95b78e851750c147323f03e6a2968de3975f1f46cba714ce160ca3275282b22dd94ca6cd53c6cd84cf44b2951facad7a765215e67bca0ed0a288616ee69657c050b14e3ee27d6cde4788b8df54cca40cef05869e049f5d4849724962396772885baa76119fb6d2127f731241fe73372cf2b799e3318efe932d7f819e326aa27498b31c1e5ddd43ea9c59326e002fc76a1e8f4dadd91b4e6ac5a97880cf8ccee57129b5361028bcbaf56f94a326b0cbfdc4432bbf71e5141f0c6574636dc62d47e3c55fa83b7689d4ae2b3dd58f96e7a19f998b3b8c5e75a941c9af557ab23e29b91c9c49fabd3975845ff80312d50be9946db4ef6593bddc97e94714f00b8cdab383c9c812ee1fc0b6321f9d9db68b106399cadeb1dd9de21c9ace304ff0e3555f1c6767e917ff808bda675b50eb3f181c4b21c349d24ad545d46c2f7b273175d3fb386df0cb5f1d8f2600ab5faac408dd65761494ed5726bead3fe7778af48aabea0a846c73439f05b6b023b1d05b1749cab54ca5e7462bd4f1808f59fe91e9e39bf74fe68bcfcbc1033440ea0230db1d178b6a1d1d1891bad2086aa54965fa157f4c7423c7bca3a103418c7777deda834a30ea5113c7cc91115244a294d7d4036df4d5786742cb7661c2f0a37b368ac3ca4408240630f92b8f3b6ded1b4dd60442de4255b8bf084c88c0728c01e55e12f262be2994cac966271d608bdb9503352aafaebcb5ae1f147b94ff61f39633b4a4aee7c0812b217e3c7dca9204430d7f468dcb55ff9d22bcf876074069a334279e74479c935523d5b1939426f845ffdff6c4f84cce74e50467e94e97cbcfaa2026cc3475d8a29e740b37a2d822145abf6bea8d6555348a66c293e17e046d8ce9cb31d62c804259aba8de02a564fe3564ef980812736c156f87869f3c0779073bf881721af45c725423711bd642c2818d6b566ee889fc601a73b15d36495655009b1e5114810f0516eb667af4e9003a84fa5bd0a12326463fa45350b7dac0ca8b9c50256476fb6f4bf800f45a45efcf3edfe9a1e567f1cd535dfe3c9cb4866b6651efb85da32385b2c40890ff5be75688c82973e6e64fbf39faca431056d85a4660ea2093d1d5bb8589de01c68f3a7af8144ce95d4955d94cbc110c617aa6e3a70b811a2acaa9dfec6c4df0b97f935d51c3e76e04d509da82ceb4a56932e2d96c93e5298b09ab0bce4c7bd95a24a6832deaeedf22959859d194a8d558643278f3894a9b6b0337512535f2e2d2615acca851331bed2c01cd3412032eeee47c1a8085b2e2db5d48b1e9dbb602c76e7d4d027465723d7a11ec9854ced1c69a4aa0e60380ea5b40b0ba0d595b28e72ad402400a208bc4572014bcc60f174b4f004905394701b8e74ffa37bf33ac4f48c3a36583ec37b13342bd738038ebf78b200ce6c94a06bffef9ac9f5bc7a38502af9bebb2c6137f1a47c589f4507f07de356ba1b8b27a86aeb2e0d18b3e6dd8e82bdcc83a366287d59c4b1c477a817cfc1afe443d1d70f08e4380698829fe28ae51aa26854ed6d2ead3f567acded9f29fdea550b4821102ce9f6f01a02e4081ff3517041b41a2de3a29c086624cddccf0575b27dcd2ae604db617954e5e3bda9c71b2be80559f9b0925f3499b3c334c7696826b1c98d0ae434fd77fc7a72a2733e35b10447dfeb14f424d18d32a4dcd96189e74cfa8db4be01886f7d0f7a6f3dbf50a0cd191e53f90cb177ca13bd92d54b7bdcd71e04d0c07b1cbbd9ac9b57c498465399d42597424fcbe81bd5f6fb4c950ff9ce7f5072b0da596e0e59b0e2db90cae783d37338fbb5e131f50b9fdeddc57af370904da958f1f5db1ef6f44690818b965fd88539dadf4f18524dcf54798b2b778195f9ad88345e7431d3cd4c66ccb58dd2ede03d8e15b96de68c4c6b3ae19b7fc163dac7af67086b9703ddd34d9f6666d792768f7528ed869cce43e9759597b78ee3bd573b3f5af4a6464126d076b506f74c52ff8b52702d3a65bbfb5808018be3f9a7f6a44e8125f978cf6b2dfd3e845538b9ca6b81dd2a5336d105c090d4feff66e09085c5a119a94ac8472731a468862aecb70e339ea1aa0a54f0a2653e893566dfce877e1f04c6e830d3b88215f0f008ccd790dd4e5dec1c9b799f86405ebeb801db7bcd5e69a38bf26dd31175373015a33813df93eebaeb662a9775af3b1f827927340756c6c7a79a028c1de97ba5795c932b5a4db24c007ba946a511df3acfe403aeca82cb1b8d12c3e0b3c183a655010ce1a40b8677b083360e778b22228349d01d18dfbf1a50b49c862490469c229bdc6c1bcf97a0af045bb6944971e1ff3ae16a9335f63a839bc26c23521b6ae50c3aa10ff12f6c4e5e10f8805b08d8de4b6be3b36918afca5836d062aa69e0c166d6a3d3950bf3e707e959085249cc7648d6b45271f72d374ef109121116b31994c44321de073e7727975cace41225a110f1826fbce3979db7fec7cd91169e9f608060e6b2b8b89a2d084d10a8c7ca7d13b10c9e454ad85ebf0eb7d54754a69ea316cf90aeeb9c4868dbdf6cf8b221cdca5139ac3f00ee255aa3d9e8166c443de67233f57f10da754a7f5df7fab099aa4a1d0e3816176ed75830419cf8abb3506726437ab2ae9102885f58e0ad8ff2f6d7b1e73b1209d038a35ed6d95f0ef595bc45960e5ad4caba3f9262012800e6e9cbe4ce51f6de8e94f594dd423a995a773905b0b9bb884409e8154d979ae3a16492947f0f7422f3398ac4ddbe0e3de6c90bd981ad114f94fc3583187bd26bcdbb89064dac3f3c0fc1ba4578bf6f29dc3305be0f91d91ec56110b48690d99ffa7060c003ae16745d8fadf81e01a3eb5e78a0ac54029ce75943990006c9597510469604dee20cbc3178054af58b950e0074477f32e9b89881b9648faf9cd436bb873f38dc70aa5836649f800d73c58eed1e74d894d85de91b43260d0908715bd3140c6de052fa46091b58f2f173f8eac96681eaea5c960223fa50f7b691eba763b52bd2f3a1d4562a93706b70de17ed95962eeb818b29ccf546534ad486047e917eccf04cecc5128c54bccba04b8ccd8a337ce74f1c1432eefa4e3c39ff1165693e8ae7d03374d70556cdc8c91f1b3148b27174488a95fbe3866f894c58d020c130a918f2615c3ba05998bbb7b8c27e9e6987e5220d33efdb041d70e9b231512907247051359813a251338cd7e8bc448506ab11dff4cd82b2bb909678790a8cb9a9e4946fbd1b4cb1a18a7972a1333a36771d39e863fe009339616e5347c56174495b0bc1b4e0d5cfc0aa6da1c0a38750505b726aaa77e8cf5dfbec2cf195eb3ffe10074841cbe576c341fdda9a2f0ffb43a46d54930bb2d02613a6139a4bc367dd279e792f977e60e30918dd0de6823616cbfb73a29d60ae836f4fc8798049bb6fe76897c09c17f25fea2d32fae258ac77e0f0e5cc0daf97c6c41ac3aafc1677c4408b2f6523731a472a9fd932aad4b5c064ce5282d215d99db626b9669f0e28106468bf5a94662486d546529b67d5c68d763f174d3626e5effbfabcdfc9b9586a5e564718ebc274c0a8fab3145b8bc8621ce52a1cbddc1d8a66811472dc6db9179b1a214427c0bc3d706e4486b6f145c5836641810cb038e73492e5451cf0f5cf7d6ae627affdc25d8eda2dc27191a48a075a9daad3a646e075310e7b60adf7b1206f10711ed5786d5619fdd0ecf453e0aa6409d52915391fd348b7241f3f469148735f514f4d3ad5711921b8984c47af4c5a8821b81927c562a8a5a1449209755fa86c1dfac3d54e137cc38e087d6830387c40e5a9a75b185cf335a446c57cb8e5d143e00216caf0c9c58ecc85c58d09bf3ad7b567576d7b4ee121b4ea0e99e193687026e8fca95a093704c15434a4570bf5e3d92789bc87d1b9cc671a0944937dc31bec5fc28ba2bb9c3649ad43fcd551ad725b5bcaccb30ce2e9d479b4ca5349ed18aee3c332eb533f902fa415102a9bd394b7400b472bc6bcc724b77821eeee75c7adbcbd19d1a2ec4bb7b", &(0x7f0000003800)=""/168}, 0x20) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)={0x5c, 0x2, 0x6, 0x3, 0xa, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0xffffffc7}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xffff}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0xa00}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 935.531664ms ago: executing program 3 (id=6281): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000004c0)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETDEBUG(r2, 0x400454c9, &(0x7f0000000100)=0x1) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000010000000", @ANYRESDEC], 0xffdd) socket$nl_generic(0x10, 0x3, 0x10) 773.336782ms ago: executing program 1 (id=6282): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000240070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3feffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30000000000900020073797a31"], 0x248}}, 0x0) 771.242314ms ago: executing program 2 (id=6283): sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)=ANY=[@ANYBLOB="780023e3070a0102000000000000e96db119af190d91d83cf022d771468600000a0000060900020073797a30000000005800048054000180090001006d657461000000004400028008000140000056d60800f80d0000000008000140000000010800014000000009080001400000000b080002"], 0x78}, 0x1, 0x0, 0x0, 0x48055}, 0x1000c080) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_buf(r2, 0x6, 0xd, &(0x7f0000000040)="03", 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=@gettaction={0x3c, 0x32, 0xe72c5f922f23cad9, 0x70bd27, 0x25dfdbf7, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xf8}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400c844}, 0x4000000) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=@newtaction={0x928, 0x30, 0x8101, 0xe501, 0x1000, {}, [{0x914, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {0x0, 0x2}, 0x8001, 0x0, 0x5}}]]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}, @m_police={0x8a4, 0x2, 0x0, 0x0, {{0xb}, {0x878, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1, 0x0, 0x0, 0x0, 0x400000, {0x0, 0x0, 0x0, 0x0, 0xffff}}}], [@TCA_POLICE_RATE64={0xc, 0x8, 0x1b}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE64={0xc, 0x8, 0x253}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0xf1d, 0x1, 0x6, 0x6, 0x81, 0xc, 0x3, 0xab99, 0xe, 0xffff, 0x2, 0x80000000, 0x9, 0x4, 0xfff, 0x1ff, 0xfffffff9, 0x4, 0x1, 0xa7e, 0x5f8b, 0x2, 0x7, 0x8001, 0x6, 0x1, 0x6f, 0x5098, 0x3a, 0x3, 0xff, 0x7, 0x1ff, 0x7fffffff, 0x4, 0x2, 0x2, 0x8, 0x10, 0x70bb, 0xb, 0x8, 0x9, 0x7f, 0x2, 0x8, 0x4, 0x0, 0x80000001, 0x1, 0x9, 0x65a, 0x0, 0x5, 0xe1, 0x3, 0x1, 0xf61, 0x3, 0x4, 0x4, 0x5, 0x2, 0x1, 0x9, 0x6, 0xc5bb, 0x3, 0x8, 0x8, 0x2, 0x7, 0x3, 0x8, 0x9, 0xb6b7, 0x3, 0x0, 0xfffffff8, 0x3, 0x6, 0x200, 0x0, 0x7, 0xd497, 0x6, 0x1, 0x8, 0x0, 0x2, 0x7, 0x4, 0x3, 0xdc, 0xc2b0, 0x9, 0x2, 0x10000, 0x6, 0xff, 0x5, 0x3, 0x2, 0x6, 0x8001, 0x8001, 0x200, 0x4, 0x1, 0x7, 0x4, 0x9, 0xffffff5f, 0x2, 0x3, 0xc8, 0x1, 0x1, 0x8, 0x5, 0x7fffffff, 0x2445, 0x1, 0x53c9, 0x2, 0x4f0, 0x7fffffff, 0x2, 0x0, 0xcd6, 0x9, 0x3, 0x9489, 0xc, 0xf3, 0x1, 0x67f4, 0x101, 0x9, 0x9, 0x4, 0x3, 0x8001, 0xb, 0x7ff, 0xb91, 0xd, 0x930, 0x3, 0x7, 0x2, 0x6, 0x4758, 0x9, 0xd, 0x5, 0x4, 0x5, 0x2, 0x9, 0xd84, 0x5, 0x8, 0x400, 0x7c, 0x6, 0x5477, 0x1, 0x100, 0xa5, 0x3b3, 0xb04, 0x9, 0x6, 0xfffffffb, 0x9, 0x7, 0x2, 0xf02, 0x9, 0x1, 0x4, 0x9, 0x7, 0x6e5, 0x7, 0x2, 0x7fffffff, 0x7, 0xffff, 0x10001, 0x2, 0x400, 0x6, 0xa7, 0x7444, 0x0, 0x0, 0x4, 0x80000001, 0x40ac, 0xfffffff7, 0x1, 0x5, 0x9a83, 0x10001, 0x100, 0xc6cf, 0xb5fd, 0x2, 0x0, 0x7, 0x80000001, 0x7, 0x8, 0x9, 0xff, 0xffff8001, 0x80000000, 0x7, 0x5, 0xe, 0xe, 0x10, 0x2, 0x4, 0x3, 0x400, 0x5, 0x1000, 0x1, 0xa1, 0xfffffffe, 0xd5c, 0x1ff, 0x6, 0x0, 0xc6, 0x1, 0x8, 0xe078, 0x8, 0x3, 0xf, 0x9, 0x7, 0x6a59, 0x7, 0x2, 0xbe9, 0x40, 0x7fffffff, 0x3, 0xe4, 0x5]}, @TCA_POLICE_AVRATE={0x8}, @TCA_POLICE_RESULT={0x8, 0x5, 0x9}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x3, 0x6, 0x7, 0xdae, 0x5, 0x5, 0xbe0, 0xc119, 0x3, 0x5, 0x7, 0x27, 0x135f43c3, 0x200, 0x9, 0xf8, 0x10, 0xff, 0x40, 0x7b, 0xb31abe6, 0x400, 0x90000000, 0x2, 0x7, 0x7, 0x7a40, 0x9, 0xa4fb, 0x7, 0x400, 0x101, 0x2, 0x8001, 0x6, 0x400, 0x4, 0xd, 0xb59, 0x800, 0x9288, 0x5, 0x89, 0x7fffffff, 0xa, 0x80000000, 0xffff, 0x9, 0x8, 0x5, 0x40, 0x414d, 0x7822, 0xfe73, 0x800, 0x6, 0x10000, 0x3, 0x6, 0xa, 0x7, 0x3, 0x800, 0x3, 0x81, 0x80, 0x10000, 0x4, 0xfffff61b, 0x6, 0x5e00, 0x4, 0x7, 0xffffffff, 0x1, 0x5, 0xfffffd61, 0x8, 0x7fffffff, 0x5, 0xe, 0xd0, 0xe58dfa9, 0xffffffff, 0x802000, 0x6, 0x8, 0x0, 0x6, 0x984, 0x9, 0x10001, 0x6, 0xbb4, 0xc, 0x4, 0x63, 0x3, 0x8, 0x100, 0x6221, 0x3, 0x6, 0x0, 0x6, 0x9, 0x2, 0x4, 0x44a, 0x3, 0x400, 0xffff, 0x5, 0xfff, 0x2, 0x6, 0x9, 0x5, 0x4, 0x4, 0x4, 0x2, 0x10001, 0x1, 0x1ff, 0x6, 0x8, 0x8, 0x4, 0x8, 0x9, 0x1, 0x4, 0x81, 0x6, 0x7ff, 0x9, 0xffffffff, 0x2, 0xd0, 0x3, 0x20, 0x7659, 0xdf, 0x9, 0x0, 0x0, 0x1, 0x7, 0x7, 0x0, 0x6, 0x1, 0x270, 0xa, 0x0, 0x0, 0x9, 0x80000000, 0x100, 0x4, 0x81, 0x401, 0x8, 0x7fffffff, 0x8, 0xffff, 0x5, 0x80000000, 0xc40, 0x1000, 0x6, 0x7, 0x1c00, 0x81, 0xcf5, 0x4b, 0x0, 0xb69, 0x1, 0x7fffffff, 0x6, 0xdbce, 0x6, 0xffffffff, 0x0, 0xf, 0x4, 0x3, 0x3, 0xfffff800, 0x3, 0x7fff, 0x2, 0x0, 0x0, 0x0, 0x10001, 0x8, 0x0, 0x345, 0x0, 0x81, 0x8, 0x3, 0x7f, 0x9, 0x6, 0x9e0, 0x1, 0x3, 0x8, 0x0, 0x4, 0xffffffff, 0x1, 0x11fb3e66, 0x9, 0x3, 0x1, 0x1, 0x6, 0x3, 0x7, 0xfffffff5, 0x79ea, 0x2, 0x101, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xfffff801, 0x2, 0x5, 0x401, 0x7fffffff, 0x2, 0x714, 0x600, 0x3, 0xb33, 0xffffffff, 0x100, 0x0, 0x7, 0x4, 0x9, 0x3, 0xd, 0xeb, 0x5, 0x1e]}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x928}}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000040200f2c8dc1b000000180001801400020073797a5f74756e0000000000000000000c000280"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 649.020748ms ago: executing program 1 (id=6284): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="48000000100001002bbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="01000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="1400030008"], 0x48}, 0x1, 0x0, 0xc3ff, 0x4010800}, 0x8054) 634.413638ms ago: executing program 1 (id=6285): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000002c0)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e1c, 0x3, 'wrr\x00', 0x5, 0x80, 0x1b}, 0x2c) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000340)={{0x84, @rand_addr=0x64010100, 0x4e24, 0x3, 'lc\x00', 0x8, 0x323b, 0x10000055}, {@remote, 0x4e23, 0x10000, 0x0, 0x12d5c, 0x12d5c}}, 0x44) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x1, 0xc, 0x9}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000400)=0xc) ioctl$TUNSETOWNER(r5, 0x400454cc, r7) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@loopback, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f00000006c0)=0xe8) sendmsg$nl_generic(r0, &(0x7f0000000e40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="8c0300001d00010025bd7000fcdbdf25120000004f020280dc08ca19467268ad077552b1907fe884201903d93cdb60c07019598d8924f9ca34776fc2f9b8995ba4fc513b46f6d98fb2ea587c904171e8ec333613b77cde56afbf7eb84ffb75a3797ffd096b664ed1f5b3a82f6cddd6e7463dd3458c85bd94e9c120d1e4a7ae08a851ad1cbf012ab7a3b1ef6b6cb6fa194f6e65844723f208fbd5d3a463f8dcfc85b6110ec3edd5ad36ce5cfe4368e5569fe1e055b27be1f7f6314e9d664550836e9c998a4d2347dc808fcd988af0bcc1bf76f497c9961d5a162c8721918eee3ef5e4cc418240dc0338f966f0909e4b0ef3828be50c7c4db451b659a352a5c6bf205dc18ff7844c0356235185c5118cd25b2a1ab7598be31b5b1f575b2a91195df77435cab82d31b143b9cdbdbd92a15d2b55f38296c11928438e45e4de075abdac6a63fb207e4c3135029f9605f15886a57223640c3f5e8be09a4052077d9e8878feb3042d5c0923bed88afda26eab937d6d38f967c30093de00c00c763704d954ac037de20f5fa139e5ff19fd8b2f639ce814501e972fe1dd208f1bbaaf37d3f4d631cd8ea4a1d7376291da2629a14758e3886d6921b4905f46e4c740b09bf508004900", @ANYRES32=r7, @ANYBLOB="ea8f83b5148c81d59942dbd3daa425ee44548f1cd33b58e6e528008782e992354e839c4962d68866153534672262615baf2e6033d8330159efc98c97aad5505341044568a6d67582adb4fc3964b8dd3abc366e985bf8704633965263a83e2b3bc2958b807a86c09acc629ff35767a057ac097cab8dcda87da5ae2298765a006bd3eb2e0eff00781d89e9877be6979092de7b160400348004003a80001b01948008008200", @ANYRES32=r8, @ANYBLOB="fb5e099fbfa31b3950c8bdd1c7fc623209ae685ef64dc95218eb607cf374105fce9296b0a52d697f2757e07cca23fd4642a30053e17ba621b4213bccdfe3352daa7234a1793a00d6a8eca308ad67e6c2a112da44bd79106d50935d96acf23e5b7da364cb1cd2f128997e8ab7905e83e4b5f3bbfb917804f7876eb0e80500000000000000bdb6b917b6441cd99c7161941dd4f7557aa53ab304cabe89b37fe5e1d6e4985fd758bedcfa2fbc071d8a8a49581625431b0a48566796e9cc4e34c6ef57e6f1299a5859b3f26c7b1dcac6e85666009945ea81f85c8d16b25f1bdb8c3dae24c5874529fe8105290e5edd23ec797f0cf2e3c673b2a14dc604001f806cafffffffffcff5f5d39d406404001780000c00c8000700000000000000"], 0x38c}, 0x1, 0x0, 0x0, 0x8002}, 0x8001) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 609.359277ms ago: executing program 2 (id=6286): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000002c0)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e1c, 0x3, 'wrr\x00', 0x5, 0x80, 0x1b}, 0x2c) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'syzkaller1\x00', 0x4c02}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="6c0000001000010400d201000072f60000020000", @ANYRES32=r4, @ANYBLOB="05"], 0x6c}, 0x1, 0x0, 0x0, 0x10004000}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) 0s ago: executing program 0 (id=6287): syz_emit_ethernet(0x36, &(0x7f0000000280)={@local, @link_local, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x1, 0x8, 0x28, 0x68, 0x0, 0x9, 0x21, 0x0, @rand_addr=0x64010100, @local, {[@generic={0x82, 0x2}]}}, {{0x4e21, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000700180a050000000000000000000a0000000900010073797a30000000000900020073797a31000000001400000011"], 0x54}}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000004001"], 0xfdef) kernel console output (not intermixed with test programs): device syzkaller0 mtu (1500) ! [ 661.794372][T22296] netlink: 'syz.0.5250': attribute type 10 has an invalid length. [ 661.844615][T22301] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5251'. [ 661.878368][T22294] netlink: 'syz.0.5250': attribute type 10 has an invalid length. [ 661.915331][T22296] bridge0: port 3(vlan2) entered disabled state [ 662.100628][T22310] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 662.535966][T22329] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 662.724946][T22336] nbd13: detected capacity change from 0 to 1 [ 662.758360][T21960] buffer_io_error: 46 callbacks suppressed [ 662.758382][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.809289][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.834408][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.864947][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.894443][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.928545][T21960] ldm_validate_partition_table(): Disk read failed. [ 662.943101][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.968052][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 662.980568][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 663.005806][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 663.024766][T21960] Dev nbd13: unable to read RDB block 0 [ 663.035700][T21960] Buffer I/O error on dev nbd13, logical block 0, async page read [ 663.050840][T21960] nbd13: unable to read partition table [ 663.070519][ T50] block nbd13: Receive control failed (result -32) [ 663.077957][T21960] nbd13: partition table beyond EOD, truncated [ 663.224892][T22363] netlink: 'syz.3.5270': attribute type 10 has an invalid length. [ 663.250262][T22363] __nla_validate_parse: 3 callbacks suppressed [ 663.250285][T22363] netlink: 228 bytes leftover after parsing attributes in process `syz.3.5270'. [ 664.022211][T22386] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5273'. [ 664.360258][T22401] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5276'. [ 664.602121][T22414] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5280'. [ 664.847866][T22425] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 664.879549][T22429] FAULT_INJECTION: forcing a failure. [ 664.879549][T22429] name failslab, interval 1, probability 0, space 0, times 0 [ 664.911362][T22429] CPU: 0 UID: 0 PID: 22429 Comm: syz.3.5285 Not tainted syzkaller #0 PREEMPT(full) [ 664.911399][T22429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 664.911411][T22429] Call Trace: [ 664.911419][T22429] [ 664.911428][T22429] dump_stack_lvl+0xe8/0x150 [ 664.911457][T22429] should_fail_ex+0x412/0x560 [ 664.911511][T22429] should_failslab+0xa8/0x100 [ 664.911539][T22429] __kvmalloc_node_noprof+0x178/0x8a0 [ 664.911569][T22429] ? bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 664.911602][T22429] bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 664.911631][T22429] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 664.911672][T22429] ? __pfx_autoremove_wake_function+0x10/0x10 [ 664.911704][T22429] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 664.911750][T22429] ? 0xffffffffa02019cc [ 664.911768][T22429] ? 0xffffffffa0201a3c [ 664.911785][T22429] ? 0xffffffffa0206f14 [ 664.911829][T22429] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 664.911863][T22429] ? _copy_from_user+0x94/0xb0 [ 664.911888][T22429] ? bpf_test_init+0x113/0x150 [ 664.911906][T22429] ? xdp_convert_md_to_buff+0x5b/0x330 [ 664.911932][T22429] bpf_prog_test_run_xdp+0x81c/0x1160 [ 664.911962][T22429] ? lockdep_hardirqs_on+0x7a/0x110 [ 664.911992][T22429] ? irqentry_exit+0x218/0x8b0 [ 664.912008][T22429] ? trace_irq_disable+0x3b/0x140 [ 664.912036][T22429] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 664.912071][T22429] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 664.912094][T22429] bpf_prog_test_run+0x2c7/0x340 [ 664.912117][T22429] __sys_bpf+0x643/0x950 [ 664.912156][T22429] ? __pfx___sys_bpf+0x10/0x10 [ 664.912200][T22429] ? ksys_write+0x242/0x270 [ 664.912229][T22429] ? __pfx_ksys_write+0x10/0x10 [ 664.912260][T22429] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.912281][T22429] __x64_sys_bpf+0x7c/0x90 [ 664.912308][T22429] do_syscall_64+0x174/0xf80 [ 664.912324][T22429] ? trace_irq_disable+0x3b/0x140 [ 664.912351][T22429] ? clear_bhb_loop+0x40/0x90 [ 664.912373][T22429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 664.912392][T22429] RIP: 0033:0x7f59a399ce59 [ 664.912411][T22429] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 664.912427][T22429] RSP: 002b:00007f59a4824028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 664.912449][T22429] RAX: ffffffffffffffda RBX: 00007f59a3c15fa0 RCX: 00007f59a399ce59 [ 664.912462][T22429] RDX: 0000000000000076 RSI: 0000200000000600 RDI: 000000000000000a [ 664.912474][T22429] RBP: 00007f59a4824090 R08: 0000000000000000 R09: 0000000000000000 [ 664.912485][T22429] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 664.912496][T22429] R13: 00007f59a3c16038 R14: 00007f59a3c15fa0 R15: 00007ffcf3d7d7d8 [ 664.912525][T22429] [ 664.930198][T22431] IPVS: ip_vs_add_dest(): server weight less than zero [ 665.209395][ T24] IPVS: starting estimator thread 0... [ 665.222856][T22438] syzkaller0: entered promiscuous mode [ 665.259656][T22438] syzkaller0: entered allmulticast mode [ 665.328879][T22433] IPVS: using max 30 ests per chain, 72000 per kthread [ 665.447425][T22449] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5288'. [ 665.906130][T22472] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5293'. [ 666.184029][T22486] netlink: 260 bytes leftover after parsing attributes in process `syz.2.5298'. [ 666.364202][T22495] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5302'. [ 666.582452][T22502] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 666.634530][T22508] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5307'. [ 666.733168][T22512] syzkaller0: entered promiscuous mode [ 666.743367][T22512] syzkaller0: entered allmulticast mode [ 666.961177][T22526] FAULT_INJECTION: forcing a failure. [ 666.961177][T22526] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 666.981230][T22526] CPU: 0 UID: 0 PID: 22526 Comm: syz.3.5314 Not tainted syzkaller #0 PREEMPT(full) [ 666.981261][T22526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 666.981273][T22526] Call Trace: [ 666.981281][T22526] [ 666.981290][T22526] dump_stack_lvl+0xe8/0x150 [ 666.981319][T22526] should_fail_ex+0x412/0x560 [ 666.981347][T22526] _copy_from_user+0x2d/0xb0 [ 666.981372][T22526] ipv6_get_msfilter+0x150/0x360 [ 666.981405][T22526] ? __pfx_ipv6_get_msfilter+0x10/0x10 [ 666.981466][T22526] do_ipv6_getsockopt+0xe3f/0x2610 [ 666.981499][T22526] ? __pfx_do_ipv6_getsockopt+0x10/0x10 [ 666.981535][T22526] ? __pfx_handle_mm_fault+0x10/0x10 [ 666.981561][T22526] ? __up_read+0x291/0x6b0 [ 666.981589][T22526] ? __pfx___up_read+0x10/0x10 [ 666.981615][T22526] ? do_user_addr_fault+0xbad/0x1340 [ 666.981643][T22526] ? do_user_addr_fault+0xc6f/0x1340 [ 666.981669][T22526] ? irqentry_exit+0x218/0x8b0 [ 666.981688][T22526] ? lockdep_hardirqs_on+0x7a/0x110 [ 666.981716][T22526] ? irqentry_exit+0x218/0x8b0 [ 666.981731][T22526] ? trace_irq_disable+0x3b/0x140 [ 666.981763][T22526] ipv6_getsockopt+0xbd/0x2b0 [ 666.981793][T22526] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 666.981819][T22526] ? rep_movs_alternative+0xf/0x90 [ 666.981838][T22526] ? sock_common_getsockopt+0x2d/0xb0 [ 666.981861][T22526] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 666.981885][T22526] do_sock_getsockopt+0x51d/0x7e0 [ 666.981909][T22526] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 666.981944][T22526] ? __fget_files+0x3a0/0x420 [ 666.981964][T22526] ? __fget_files+0x2a/0x420 [ 666.981992][T22526] __x64_sys_getsockopt+0x1a4/0x240 [ 666.982017][T22526] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.982035][T22526] do_syscall_64+0x174/0xf80 [ 666.982051][T22526] ? trace_irq_disable+0x3b/0x140 [ 666.982073][T22526] ? clear_bhb_loop+0x40/0x90 [ 666.982104][T22526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 666.982120][T22526] RIP: 0033:0x7f59a399ce59 [ 666.982139][T22526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 666.982154][T22526] RSP: 002b:00007f59a4824028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 666.982174][T22526] RAX: ffffffffffffffda RBX: 00007f59a3c15fa0 RCX: 00007f59a399ce59 [ 666.982186][T22526] RDX: 0000000000000030 RSI: 0000000000000029 RDI: 0000000000000003 [ 666.982197][T22526] RBP: 00007f59a4824090 R08: 0000200000000080 R09: 0000000000000000 [ 666.982214][T22526] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000001 [ 666.982226][T22526] R13: 00007f59a3c16038 R14: 00007f59a3c15fa0 R15: 00007ffcf3d7d7d8 [ 666.982256][T22526] [ 667.374203][T22537] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5320'. [ 667.670045][T22550] nbd14: detected capacity change from 0 to 1 [ 667.681955][T21960] ldm_validate_partition_table(): Disk read failed. [ 667.718928][T21960] Dev nbd14: unable to read RDB block 0 [ 667.759650][T21960] nbd14: unable to read partition table [ 667.785202][T21960] nbd14: partition table beyond EOD, truncated [ 667.832519][T21960] buffer_io_error: 30 callbacks suppressed [ 667.832540][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 667.841489][T22564] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 667.885342][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 667.919874][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 667.947153][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 667.970765][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 667.991140][ T4965] block nbd8: Possible stuck request ffff888027abe000: control (read@0,1024B). Runtime 90 seconds [ 668.002314][ T4965] block nbd8: Possible stuck request ffff888027abe1c0: control (read@1024,1024B). Runtime 90 seconds [ 668.013807][ T4965] block nbd8: Possible stuck request ffff888027abe380: control (read@2048,1024B). Runtime 90 seconds [ 668.028878][ T4965] block nbd8: Possible stuck request ffff888027abe540: control (read@3072,1024B). Runtime 90 seconds [ 668.046428][ T50] block nbd14: Receive control failed (result -32) [ 668.063267][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 668.072095][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 668.080916][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 668.090565][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 668.099448][T21960] Buffer I/O error on dev nbd14, logical block 0, async page read [ 668.387912][T22581] netlink: 'syz.0.5337': attribute type 10 has an invalid length. [ 668.406181][T22584] __nla_validate_parse: 6 callbacks suppressed [ 668.406201][T22584] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5338'. [ 668.430323][T22581] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 668.439891][T22586] netlink: 'syz.0.5337': attribute type 10 has an invalid length. [ 668.444464][T22581] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 668.458380][T22581] team0: Port device netdevsim1 added [ 668.466045][T22586] netdevsim netdevsim0 netdevsim1: left promiscuous mode [ 668.493350][T22586] team0: Port device netdevsim1 removed [ 668.504140][T22586] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 668.514173][T22586] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 668.526142][T22586] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 668.536348][T22582] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 668.579687][T22581] sctp: [Deprecated]: syz.0.5337 (pid 22581) Use of struct sctp_assoc_value in delayed_ack socket option. [ 668.579687][T22581] Use struct sctp_sack_info instead [ 668.649162][T22587] syzkaller0: entered promiscuous mode [ 668.656914][T22587] syzkaller0: entered allmulticast mode [ 669.018183][T22604] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5343'. [ 669.059646][T22606] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 669.079676][T22606] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 669.097723][T22609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5344'. [ 669.109029][T22604] nbd15: detected capacity change from 0 to 1 [ 669.129009][T21960] ldm_validate_partition_table(): Disk read failed. [ 669.153919][T21960] Dev nbd15: unable to read RDB block 0 [ 669.189555][T21960] nbd15: unable to read partition table [ 669.219328][T21960] nbd15: partition table beyond EOD, truncated [ 669.338472][ T50] block nbd15: Receive control failed (result -32) [ 669.559879][T22622] netlink: 'syz.3.5346': attribute type 1 has an invalid length. [ 669.658089][T22629] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 669.680327][T22632] netlink: 'syz.1.5349': attribute type 1 has an invalid length. [ 669.769659][T22622] 8021q: adding VLAN 0 to HW filter on device bond2 [ 669.861691][T22643] xt_hashlimit: size too large, truncated to 1048576 [ 669.943293][T22648] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5349'. [ 670.033717][T22652] netlink: 'syz.4.5350': attribute type 1 has an invalid length. [ 670.071052][T22652] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5350'. [ 670.120545][T22636] 8021q: adding VLAN 0 to HW filter on device bond4 [ 670.131547][T22636] bond3: (slave bond4): making interface the new active one [ 670.141055][T22636] bond3: (slave bond4): Enslaving as an active interface with an up link [ 670.169856][T22641] bond3: (slave gretap1): Enslaving as a backup interface with an up link [ 670.229351][T22622] bond2: (slave geneve2): making interface the new active one [ 670.278025][T22622] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 670.396041][T22649] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.423218][T22649] bridge_slave_0 (unregistering): left allmulticast mode [ 670.439131][T22649] bridge_slave_0 (unregistering): left promiscuous mode [ 670.462406][T22649] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.462599][T22660] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5356'. [ 670.588473][T22648] 8021q: adding VLAN 0 to HW filter on device bond3 [ 670.931922][T22660] nbd2: detected capacity change from 0 to 1 [ 670.942345][T22669] syzkaller0: entered promiscuous mode [ 670.958226][T21960] ldm_validate_partition_table(): Disk read failed. [ 670.966589][T22669] syzkaller0: entered allmulticast mode [ 670.972823][T21960] Dev nbd2: unable to read RDB block 0 [ 670.981093][T21960] nbd2: unable to read partition table [ 670.990783][T22680] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5359'. [ 670.998537][T21960] nbd2: partition table beyond EOD, truncated [ 671.088847][ T50] block nbd2: Receive control failed (result -32) [ 671.331404][T22691] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5361'. [ 671.536904][T22704] netlink: 'syz.2.5365': attribute type 361 has an invalid length. [ 671.807773][T22715] netlink: 9 bytes leftover after parsing attributes in process `syz.2.5365'. [ 671.924896][T22720] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5365'. [ 675.020673][ T3366] bond0: (slave bond_slave_0): interface is now down [ 675.022057][T22725] FAULT_INJECTION: forcing a failure. [ 675.022057][T22725] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 675.031658][T22728] bond0: option arp_validate: invalid value (55553) [ 675.055062][ T3366] bond0: (slave bond_slave_1): interface is now down [ 675.077972][ T754] bond0: (slave bond_slave_0): interface is now down [ 675.093802][T22731] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5370'. [ 675.116660][T22725] CPU: 1 UID: 0 PID: 22725 Comm: syz.2.5368 Not tainted syzkaller #0 PREEMPT(full) [ 675.116690][T22725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 675.116702][T22725] Call Trace: [ 675.116711][T22725] [ 675.116720][T22725] dump_stack_lvl+0xe8/0x150 [ 675.116750][T22725] should_fail_ex+0x412/0x560 [ 675.116778][T22725] _copy_from_user+0x2d/0xb0 [ 675.116804][T22725] ___sys_sendmsg+0x1c6/0x360 [ 675.116825][T22725] ? __lock_acquire+0x6b5/0x2cf0 [ 675.116847][T22725] ? __pfx____sys_sendmsg+0x10/0x10 [ 675.116903][T22725] ? __fget_files+0x2a/0x420 [ 675.116926][T22725] ? __fget_files+0x3a0/0x420 [ 675.116959][T22725] __x64_sys_sendmsg+0x1bd/0x2a0 [ 675.116983][T22725] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 675.117015][T22725] ? __pfx_ksys_write+0x10/0x10 [ 675.117054][T22725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.117085][T22725] do_syscall_64+0x174/0xf80 [ 675.117104][T22725] ? trace_irq_disable+0x3b/0x140 [ 675.117132][T22725] ? clear_bhb_loop+0x40/0x90 [ 675.117157][T22725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.117176][T22725] RIP: 0033:0x7f3552b9ce59 [ 675.117195][T22725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.117210][T22725] RSP: 002b:00007f3553a80028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 675.117232][T22725] RAX: ffffffffffffffda RBX: 00007f3552e15fa0 RCX: 00007f3552b9ce59 [ 675.117246][T22725] RDX: 0000000000000800 RSI: 0000200000000140 RDI: 0000000000000004 [ 675.117259][T22725] RBP: 00007f3553a80090 R08: 0000000000000000 R09: 0000000000000000 [ 675.117272][T22725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 675.117284][T22725] R13: 00007f3552e16038 R14: 00007f3552e15fa0 R15: 00007ffcd0e25de8 [ 675.117317][T22725] [ 675.121160][ T754] bond0: (slave bond_slave_1): interface is now down [ 675.332291][ T754] bond0: now running without any active interface! [ 675.708671][T22731] nbd12: detected capacity change from 0 to 1 [ 675.733971][T21960] buffer_io_error: 62 callbacks suppressed [ 675.733990][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.740969][T22757] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 675.764829][ T50] block nbd12: Receive control failed (result -32) [ 675.776407][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.798708][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.816585][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.834935][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.865320][T22759] syzkaller0: entered promiscuous mode [ 675.865872][T21960] ldm_validate_partition_table(): Disk read failed. [ 675.889708][T22759] syzkaller0: entered allmulticast mode [ 675.922403][T22767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5380'. [ 675.939049][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.956193][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.970981][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 675.982103][T22761] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5379'. [ 675.983519][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 676.000602][T21960] Dev nbd12: unable to read RDB block 0 [ 676.006990][T21960] Buffer I/O error on dev nbd12, logical block 0, async page read [ 676.015367][T21960] nbd12: unable to read partition table [ 676.022252][T21960] nbd12: partition table beyond EOD, truncated [ 676.077111][T22761] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5379'. [ 676.100104][T22775] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.5384'. [ 676.107275][T22761] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5379'. [ 676.178902][T22780] FAULT_INJECTION: forcing a failure. [ 676.178902][T22780] name failslab, interval 1, probability 0, space 0, times 0 [ 676.204091][T22780] CPU: 1 UID: 0 PID: 22780 Comm: syz.0.5385 Not tainted syzkaller #0 PREEMPT(full) [ 676.204120][T22780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 676.204133][T22780] Call Trace: [ 676.204141][T22780] [ 676.204149][T22780] dump_stack_lvl+0xe8/0x150 [ 676.204177][T22780] should_fail_ex+0x412/0x560 [ 676.204202][T22780] should_failslab+0xa8/0x100 [ 676.204224][T22780] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 676.204251][T22780] ? __alloc_skb+0x186/0x7d0 [ 676.204277][T22780] ? __alloc_skb+0x1d0/0x7d0 [ 676.204300][T22780] ? __local_bh_enable_ip+0xd0/0x130 [ 676.204324][T22780] __alloc_skb+0x1d0/0x7d0 [ 676.204355][T22780] netlink_sendmsg+0x5d4/0xb40 [ 676.204388][T22780] ? __pfx_netlink_sendmsg+0x10/0x10 [ 676.204412][T22780] ? aa_sock_msg_perm+0xf1/0x1b0 [ 676.204442][T22780] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 676.204471][T22780] ____sys_sendmsg+0x972/0x9f0 [ 676.204492][T22780] ? __might_fault+0xaf/0x130 [ 676.204521][T22780] ? __pfx_____sys_sendmsg+0x10/0x10 [ 676.204552][T22780] ? import_iovec+0x73/0xa0 [ 676.204578][T22780] ___sys_sendmsg+0x2a5/0x360 [ 676.204596][T22780] ? __lock_acquire+0x6b5/0x2cf0 [ 676.204619][T22780] ? __pfx____sys_sendmsg+0x10/0x10 [ 676.204673][T22780] ? __fget_files+0x2a/0x420 [ 676.204695][T22780] ? __fget_files+0x3a0/0x420 [ 676.204726][T22780] __x64_sys_sendmsg+0x1bd/0x2a0 [ 676.204750][T22780] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 676.204790][T22780] ? __pfx_ksys_write+0x10/0x10 [ 676.204823][T22780] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.204844][T22780] do_syscall_64+0x174/0xf80 [ 676.204863][T22780] ? trace_irq_disable+0x3b/0x140 [ 676.204890][T22780] ? clear_bhb_loop+0x40/0x90 [ 676.204914][T22780] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.204939][T22780] RIP: 0033:0x7f24e419ce59 [ 676.204959][T22780] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 676.204976][T22780] RSP: 002b:00007f24e4fc0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 676.204998][T22780] RAX: ffffffffffffffda RBX: 00007f24e4415fa0 RCX: 00007f24e419ce59 [ 676.205012][T22780] RDX: 0000000000000800 RSI: 0000200000000140 RDI: 0000000000000004 [ 676.205025][T22780] RBP: 00007f24e4fc0090 R08: 0000000000000000 R09: 0000000000000000 [ 676.205036][T22780] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 676.205047][T22780] R13: 00007f24e4416038 R14: 00007f24e4415fa0 R15: 00007ffdbb79a628 [ 676.205080][T22780] [ 676.814003][T22796] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5391'. [ 677.076485][T22802] tipc: Enabled bearer , priority 0 [ 677.106791][T22802] syzkaller0: entered promiscuous mode [ 677.121037][T22802] syzkaller0: entered allmulticast mode [ 677.129881][T22810] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5399'. [ 677.145349][T22811] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5398'. [ 677.227125][T22802] tipc: Resetting bearer [ 677.241322][T22808] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 677.273561][T22801] tipc: Resetting bearer [ 677.341685][T22801] tipc: Disabling bearer [ 677.399882][T22822] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 677.560193][T22832] syzkaller0: entered promiscuous mode [ 677.566910][T22832] syzkaller0: entered allmulticast mode [ 677.634464][T22836] syzkaller0: entered promiscuous mode [ 677.659332][T22836] syzkaller0: entered allmulticast mode [ 677.755341][T22836] tipc: Enabled bearer , priority 0 [ 677.790896][T22834] tipc: Resetting bearer [ 677.882700][T22834] tipc: Disabling bearer [ 678.013859][T22855] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5417'. [ 678.290243][T22855] nbd16: detected capacity change from 0 to 1 [ 678.334567][T21960] ldm_validate_partition_table(): Disk read failed. [ 678.355049][T21960] Dev nbd16: unable to read RDB block 0 [ 678.373062][T21960] nbd16: unable to read partition table [ 678.396069][T21960] nbd16: partition table beyond EOD, truncated [ 678.572806][ T50] block nbd16: Receive control failed (result -32) [ 678.798137][T22884] IPv6: sit2: Disabled Multicast RS [ 679.218886][ T12] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.246134][ T12] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.265280][ T12] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.336282][ T12] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.651532][T22920] syzkaller0: entered promiscuous mode [ 679.666523][T22920] syzkaller0: entered allmulticast mode [ 679.872833][T22930] netlink: 'syz.2.5444': attribute type 8 has an invalid length. [ 680.258506][T22953] raw_sendmsg: syz.4.5452 forgot to set AF_INET. Fix it! [ 680.266909][T22953] x_tables: duplicate underflow at hook 3 [ 683.168708][T22961] __nla_validate_parse: 11 callbacks suppressed [ 683.168741][T22961] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5455'. [ 683.452928][T22976] FAULT_INJECTION: forcing a failure. [ 683.452928][T22976] name failslab, interval 1, probability 0, space 0, times 0 [ 683.480421][T22977] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5462'. [ 683.499733][T22976] CPU: 0 UID: 0 PID: 22976 Comm: syz.4.5460 Not tainted syzkaller #0 PREEMPT(full) [ 683.499762][T22976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 683.499774][T22976] Call Trace: [ 683.499783][T22976] [ 683.499792][T22976] dump_stack_lvl+0xe8/0x150 [ 683.499821][T22976] should_fail_ex+0x412/0x560 [ 683.499849][T22976] should_failslab+0xa8/0x100 [ 683.499872][T22976] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 683.499900][T22976] ? __alloc_skb+0x186/0x7d0 [ 683.499937][T22976] ? __alloc_skb+0x1d0/0x7d0 [ 683.499963][T22976] ? __local_bh_enable_ip+0xd0/0x130 [ 683.499990][T22976] __alloc_skb+0x1d0/0x7d0 [ 683.500018][T22976] ? netlink_ack_tlv_len+0x6c/0x210 [ 683.500042][T22976] netlink_ack+0x146/0xa50 [ 683.500068][T22976] ? __pfx___up_read+0x10/0x10 [ 683.500130][T22976] rdma_nl_rcv+0x3ee/0xa10 [ 683.500171][T22976] ? __pfx_rdma_nl_rcv+0x10/0x10 [ 683.500221][T22976] ? netlink_deliver_tap+0x2e/0x1b0 [ 683.500242][T22976] ? netlink_deliver_tap+0x2e/0x1b0 [ 683.500269][T22976] netlink_unicast+0x75c/0x8e0 [ 683.500301][T22976] netlink_sendmsg+0x813/0xb40 [ 683.500334][T22976] ? __pfx_netlink_sendmsg+0x10/0x10 [ 683.500360][T22976] ? aa_sock_msg_perm+0xf1/0x1b0 [ 683.500388][T22976] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 683.500418][T22976] ____sys_sendmsg+0x972/0x9f0 [ 683.500440][T22976] ? __might_fault+0xaf/0x130 [ 683.500488][T22976] ? __pfx_____sys_sendmsg+0x10/0x10 [ 683.500519][T22976] ? import_iovec+0x73/0xa0 [ 683.500547][T22976] ___sys_sendmsg+0x2a5/0x360 [ 683.500567][T22976] ? __lock_acquire+0x6b5/0x2cf0 [ 683.500592][T22976] ? __pfx____sys_sendmsg+0x10/0x10 [ 683.500651][T22976] ? __fget_files+0x2a/0x420 [ 683.500672][T22976] ? __fget_files+0x3a0/0x420 [ 683.500703][T22976] __x64_sys_sendmsg+0x1bd/0x2a0 [ 683.500725][T22976] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 683.500757][T22976] ? __pfx_ksys_write+0x10/0x10 [ 683.500799][T22976] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.500820][T22976] do_syscall_64+0x174/0xf80 [ 683.500838][T22976] ? trace_irq_disable+0x3b/0x140 [ 683.500864][T22976] ? clear_bhb_loop+0x40/0x90 [ 683.500886][T22976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 683.500903][T22976] RIP: 0033:0x7f1d6e39ce59 [ 683.500930][T22976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 683.500946][T22976] RSP: 002b:00007f1d6f234028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 683.500968][T22976] RAX: ffffffffffffffda RBX: 00007f1d6e615fa0 RCX: 00007f1d6e39ce59 [ 683.500981][T22976] RDX: 0000000000000800 RSI: 0000200000000140 RDI: 0000000000000004 [ 683.500992][T22976] RBP: 00007f1d6f234090 R08: 0000000000000000 R09: 0000000000000000 [ 683.501002][T22976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 683.501014][T22976] R13: 00007f1d6e616038 R14: 00007f1d6e615fa0 R15: 00007ffccaefc548 [ 683.501046][T22976] [ 683.505117][T22979] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5461'. [ 683.578410][T22977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5462'. [ 683.873075][T22980] bridge0: port 3(vlan2) entered blocking state [ 683.879663][T22980] bridge0: port 3(vlan2) entered forwarding state [ 683.971559][T22995] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5466'. [ 684.013415][T22980] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 684.100805][ T754] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.105651][T22977] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5462'. [ 684.122684][ T754] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.164247][ T754] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.183984][ T754] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.220590][ T24] IPVS: starting estimator thread 0... [ 684.251394][T23002] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5468'. [ 684.275428][T23002] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5468'. [ 684.315585][T22996] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5466'. [ 684.327491][T23003] IPVS: using max 27 ests per chain, 64800 per kthread [ 684.377956][T23007] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5470'. [ 684.427197][T23006] Bluetooth: MGMT ver 1.23 [ 684.553322][T23010] netlink: 'syz.4.5472': attribute type 75 has an invalid length. [ 684.669503][T23013] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1500) ! [ 684.823781][T23019] syzkaller0: entered promiscuous mode [ 684.868235][T23019] syzkaller0: entered allmulticast mode [ 684.891329][T23022] FAULT_INJECTION: forcing a failure. [ 684.891329][T23022] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 684.934499][T23022] CPU: 0 UID: 0 PID: 23022 Comm: syz.0.5476 Not tainted syzkaller #0 PREEMPT(full) [ 684.934530][T23022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 684.934542][T23022] Call Trace: [ 684.934551][T23022] [ 684.934560][T23022] dump_stack_lvl+0xe8/0x150 [ 684.934590][T23022] should_fail_ex+0x412/0x560 [ 684.934627][T23022] _copy_from_user+0x2d/0xb0 [ 684.934653][T23022] kstrtouint_from_user+0xd6/0x180 [ 684.934677][T23022] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 684.934718][T23022] proc_fail_nth_write+0x8e/0x210 [ 684.934746][T23022] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 684.934779][T23022] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 684.934807][T23022] vfs_write+0x29a/0xb90 [ 684.934846][T23022] ? __pfx_vfs_write+0x10/0x10 [ 684.934875][T23022] ? __fget_files+0x2a/0x420 [ 684.934905][T23022] ? __fget_files+0x3a0/0x420 [ 684.934926][T23022] ? __fget_files+0x2a/0x420 [ 684.934959][T23022] ksys_write+0x150/0x270 [ 684.934989][T23022] ? __pfx_ksys_write+0x10/0x10 [ 684.935029][T23022] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.935051][T23022] do_syscall_64+0x174/0xf80 [ 684.935071][T23022] ? trace_irq_disable+0x3b/0x140 [ 684.935099][T23022] ? clear_bhb_loop+0x40/0x90 [ 684.935124][T23022] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.935144][T23022] RIP: 0033:0x7f24e415d68e [ 684.935164][T23022] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 684.935181][T23022] RSP: 002b:00007f24e4fbffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 684.935204][T23022] RAX: ffffffffffffffda RBX: 00007f24e4fc06c0 RCX: 00007f24e415d68e [ 684.935224][T23022] RDX: 0000000000000001 RSI: 00007f24e4fc00a0 RDI: 0000000000000005 [ 684.935237][T23022] RBP: 00007f24e4fc0090 R08: 0000000000000000 R09: 0000000000000000 [ 684.935249][T23022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 684.935262][T23022] R13: 00007f24e4416038 R14: 00007f24e4415fa0 R15: 00007ffdbb79a628 [ 684.935296][T23022] [ 685.868657][T23054] syzkaller0: entered promiscuous mode [ 685.885802][T23054] syzkaller0: entered allmulticast mode [ 686.049907][T23061] SET target dimension over the limit! [ 686.688717][T23077] FAULT_INJECTION: forcing a failure. [ 686.688717][T23077] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 686.755947][T23077] CPU: 1 UID: 0 PID: 23077 Comm: syz.1.5497 Not tainted syzkaller #0 PREEMPT(full) [ 686.755976][T23077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 686.755987][T23077] Call Trace: [ 686.755996][T23077] [ 686.756005][T23077] dump_stack_lvl+0xe8/0x150 [ 686.756033][T23077] should_fail_ex+0x412/0x560 [ 686.756059][T23077] _copy_to_user+0x31/0xb0 [ 686.756083][T23077] simple_read_from_buffer+0xe1/0x170 [ 686.756107][T23077] proc_fail_nth_read+0x1bb/0x230 [ 686.756133][T23077] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 686.756158][T23077] ? rw_verify_area+0x2a6/0x4d0 [ 686.756182][T23077] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 686.756205][T23077] vfs_read+0x20c/0xa70 [ 686.756236][T23077] ? __pfx___mutex_lock+0x10/0x10 [ 686.756256][T23077] ? __pfx_vfs_read+0x10/0x10 [ 686.756283][T23077] ? __fget_files+0x2a/0x420 [ 686.756308][T23077] ? __fget_files+0x3a0/0x420 [ 686.756329][T23077] ? __fget_files+0x2a/0x420 [ 686.756358][T23077] ksys_read+0x150/0x270 [ 686.756385][T23077] ? __pfx_ksys_read+0x10/0x10 [ 686.756406][T23077] ? fput+0xa0/0xd0 [ 686.756435][T23077] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 686.756456][T23077] do_syscall_64+0x174/0xf80 [ 686.756472][T23077] ? trace_irq_disable+0x3b/0x140 [ 686.756496][T23077] ? clear_bhb_loop+0x40/0x90 [ 686.756520][T23077] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 686.756539][T23077] RIP: 0033:0x7fce9795d68e [ 686.756558][T23077] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 686.756575][T23077] RSP: 002b:00007fce98796fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 686.756597][T23077] RAX: ffffffffffffffda RBX: 00007fce987976c0 RCX: 00007fce9795d68e [ 686.756610][T23077] RDX: 000000000000000f RSI: 00007fce987970a0 RDI: 0000000000000005 [ 686.756621][T23077] RBP: 00007fce98797090 R08: 0000000000000000 R09: 0000000000000000 [ 686.756632][T23077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 686.756643][T23077] R13: 00007fce97c16038 R14: 00007fce97c15fa0 R15: 00007ffc85d4e638 [ 686.756686][T23077] [ 687.030782][T23088] netlink: 'syz.3.5502': attribute type 30 has an invalid length. [ 687.158446][T23085] nbd17: detected capacity change from 0 to 1 [ 687.172889][T21960] buffer_io_error: 46 callbacks suppressed [ 687.172909][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.210835][ T50] block nbd17: Receive control failed (result -32) [ 687.225405][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.234700][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.245172][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.254893][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.263732][T21960] ldm_validate_partition_table(): Disk read failed. [ 687.270663][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.279058][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.288270][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.296419][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.304440][T21960] Dev nbd17: unable to read RDB block 0 [ 687.312351][T21960] Buffer I/O error on dev nbd17, logical block 0, async page read [ 687.326026][T21960] nbd17: unable to read partition table [ 687.333702][T21960] nbd17: partition table beyond EOD, truncated [ 688.183055][T23124] __nla_validate_parse: 13 callbacks suppressed [ 688.183078][T23124] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5513'. [ 688.213890][T23118] team0: Port device team_slave_0 removed [ 688.319409][T23125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5514'. [ 688.471500][T23132] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5516'. [ 688.482862][T23130] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5515'. [ 688.731010][T23136] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5517'. [ 689.078450][T23136] gretap0: entered promiscuous mode [ 689.119162][T23136] vlan4: entered promiscuous mode [ 689.290939][T23135] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.380192][T23156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5522'. [ 689.409188][T23156] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5522'. [ 689.632012][T23135] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 689.658041][T23165] netlink: 'syz.1.5526': attribute type 1 has an invalid length. [ 689.760319][T23172] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5528'. [ 689.897817][T23181] netlink: 'syz.1.5526': attribute type 2 has an invalid length. [ 689.943501][T23165] 8021q: adding VLAN 0 to HW filter on device bond5 [ 689.980125][T23170] bond5: (slave veth19): Enslaving as an active interface with a down link [ 690.022977][T23176] bond5: (slave veth21): Enslaving as an active interface with a down link [ 690.063666][T23135] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.083672][T23178] bond5: entered allmulticast mode [ 690.090456][T23168] syzkaller1: entered promiscuous mode [ 690.098397][T23168] syzkaller1: entered allmulticast mode [ 690.198877][T23135] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 690.266453][T23183] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5529'. [ 690.345227][T16842] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 690.379070][T16842] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 690.415405][ T12] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 690.473168][ T12] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 690.482960][T23190] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5533'. [ 690.838261][T23192] nbd18: detected capacity change from 0 to 1 [ 690.850134][T21960] ldm_validate_partition_table(): Disk read failed. [ 690.859789][T21960] Dev nbd18: unable to read RDB block 0 [ 690.866692][T21960] nbd18: unable to read partition table [ 690.873109][T21960] nbd18: partition table beyond EOD, truncated [ 691.167092][T23231] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 691.240336][ T50] block nbd18: Receive control failed (result -32) [ 691.449617][T23237] nbd19: detected capacity change from 0 to 1 [ 691.466618][T21960] ldm_validate_partition_table(): Disk read failed. [ 691.473901][T21960] Dev nbd19: unable to read RDB block 0 [ 691.480303][T21960] nbd19: unable to read partition table [ 691.487170][T21960] nbd19: partition table beyond EOD, truncated [ 691.753420][T23248] nbd20: detected capacity change from 0 to 1 [ 691.832129][T21960] ldm_validate_partition_table(): Disk read failed. [ 691.867458][T21960] Dev nbd20: unable to read RDB block 0 [ 691.882567][T21960] nbd20: unable to read partition table [ 691.897735][T21960] nbd20: partition table beyond EOD, truncated [ 691.908606][ T50] block nbd19: Receive control failed (result -32) [ 692.114869][T19131] block nbd20: Receive control failed (result -32) [ 693.231372][T23327] bond7: option xmit_hash_policy: invalid value (10) [ 693.254713][T23327] bond7 (unregistering): Released all slaves [ 693.312122][T23333] __nla_validate_parse: 15 callbacks suppressed [ 693.312138][T23333] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5581'. [ 693.451777][T23343] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 693.696751][T23333] nbd21: detected capacity change from 0 to 1 [ 693.750012][T21960] buffer_io_error: 102 callbacks suppressed [ 693.750033][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.788679][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.799568][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.810225][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.829137][T23359] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5589'. [ 693.841347][T19131] block nbd21: Receive control failed (result -32) [ 693.842624][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.876250][T21960] ldm_validate_partition_table(): Disk read failed. [ 693.894666][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.908850][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.926250][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.934517][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.943483][T21960] Dev nbd21: unable to read RDB block 0 [ 693.949596][T21960] Buffer I/O error on dev nbd21, logical block 0, async page read [ 693.967768][T21960] nbd21: unable to read partition table [ 693.987615][T21960] nbd21: partition table beyond EOD, truncated [ 694.274059][T23385] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5599'. [ 694.775076][T23406] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5605'. [ 694.812161][T23406] netlink: 52 bytes leftover after parsing attributes in process `syz.2.5605'. [ 695.355122][T19131] Bluetooth: hci1: link tx timeout [ 695.362623][T19131] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 695.377953][T19131] Bluetooth: hci1: link tx timeout [ 695.384600][T19131] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 695.458320][T23424] xt_hashlimit: size too large, truncated to 1048576 [ 695.910922][T23442] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 695.962080][T23445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5619'. [ 696.225043][ T42] IPVS: starting estimator thread 0... [ 696.291428][T23453] syzkaller0: entered promiscuous mode [ 696.300648][T23453] syzkaller0: entered allmulticast mode [ 696.306947][T23465] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5622'. [ 696.320684][T23464] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5621'. [ 696.330784][T23461] IPVS: using max 29 ests per chain, 69600 per kthread [ 697.446411][T19131] Bluetooth: hci1: command 0x0405 tx timeout [ 697.493515][T23491] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5627'. [ 698.076733][ T4965] block nbd8: Possible stuck request ffff888027abe000: control (read@0,1024B). Runtime 120 seconds [ 698.088039][ T4965] block nbd8: Possible stuck request ffff888027abe1c0: control (read@1024,1024B). Runtime 120 seconds [ 698.100709][ T4965] block nbd8: Possible stuck request ffff888027abe380: control (read@2048,1024B). Runtime 120 seconds [ 698.112823][ T4965] block nbd8: Possible stuck request ffff888027abe540: control (read@3072,1024B). Runtime 120 seconds [ 699.526476][T19131] Bluetooth: hci1: command 0x0405 tx timeout [ 702.580175][ T5000] udevd[5000]: worker [20551] /devices/virtual/block/nbd3 is taking a long time [ 703.035426][T23493] netdevsim netdevsim3 netdevsim0: refused to change device tx_queue_len [ 703.226346][T23510] netlink: 'syz.1.5631': attribute type 1 has an invalid length. [ 703.243537][T23510] netlink: 'syz.1.5631': attribute type 2 has an invalid length. [ 703.271971][T23510] netlink: 'syz.1.5631': attribute type 1 has an invalid length. [ 703.449934][T23522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5638'. [ 703.864484][T23543] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5644'. [ 703.894244][T23543] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5644'. [ 703.952438][T23548] netlink: 104 bytes leftover after parsing attributes in process `syz.2.5645'. [ 704.025003][T23556] netlink: 'syz.3.5649': attribute type 4 has an invalid length. [ 704.029168][T23546] syzkaller0: create flow: hash 3800581822 index 2 [ 704.040175][ T24] syzkaller0: tun_net_xmit 76 [ 704.053895][T23556] netlink: 'syz.3.5649': attribute type 4 has an invalid length. [ 704.194115][T23563] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5651'. [ 704.216254][ T24] syzkaller0: tun_net_xmit 76 [ 704.338800][ T24] syzkaller0: tun_net_xmit 76 [ 704.434994][T23545] syzkaller0: delete flow: hash 3800581822 index 2 [ 704.455793][ T8451] syzkaller0: tun_net_xmit 76 [ 704.604203][T23571] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5654'. [ 707.754576][T23571] bridge0: port 3(vlan2) entered disabled state [ 707.763882][T23571] bond0: (slave dummy0): Releasing backup interface [ 707.774096][T23571] vlan2 (unregistering): left allmulticast mode [ 707.780911][T23571] dummy0 (unregistering): left allmulticast mode [ 707.788094][T23571] vlan2 (unregistering): left promiscuous mode [ 707.794518][T23571] dummy0 (unregistering): left promiscuous mode [ 707.802446][T23571] bridge0: port 3(vlan2) entered disabled state [ 707.840102][T23575] bridge0: port 3(vlan2) entered disabled state [ 707.846699][T23575] bridge0: port 1(bridge_slave_0) entered disabled state [ 707.906797][T23581] tipc: Enabling of bearer rejected, failed to enable media [ 708.284699][T23621] ip6tnl2: entered allmulticast mode [ 708.309706][T23615] syzkaller0: entered promiscuous mode [ 708.332151][T23615] syzkaller0: entered allmulticast mode [ 708.369785][T23626] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5670'. [ 708.490370][T23629] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5671'. [ 708.510550][T23629] bridge0: port 2(bridge_slave_1) entered disabled state [ 708.861951][T23649] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5679'. [ 708.892214][T23649] bridge0: port 3(vlan2) entered blocking state [ 708.898872][T23649] bridge0: port 3(vlan2) entered forwarding state [ 708.905918][T23649] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.913110][T23649] bridge0: port 1(bridge_slave_0) entered forwarding state [ 708.955187][T23649] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5679'. [ 709.020741][T23649] bridge0: port 3(vlan2) entered disabled state [ 709.027358][T23649] bridge0: port 1(bridge_slave_0) entered disabled state [ 709.122544][T23661] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5683'. [ 709.148929][T23661] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 709.223544][T23663] bridge0: port 3(vlan2) entered disabled state [ 709.230220][T23663] bridge0: port 2(bridge_slave_1) entered disabled state [ 709.238131][T23663] bridge0: port 1(bridge_slave_0) entered disabled state [ 709.331537][T23663] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5684'. [ 709.662096][T23678] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5688'. [ 710.428393][T23663] bridge0: port 3(vlan2) entered blocking state [ 710.434961][T23663] bridge0: port 3(vlan2) entered forwarding state [ 710.441861][T23663] bridge0: port 2(bridge_slave_1) entered blocking state [ 710.449215][T23663] bridge0: port 2(bridge_slave_1) entered forwarding state [ 710.456826][T23663] bridge0: port 1(bridge_slave_0) entered blocking state [ 710.464117][T23663] bridge0: port 1(bridge_slave_0) entered forwarding state [ 710.499742][T23663] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5684'. [ 710.513920][T23663] bridge0: port 3(vlan2) entered disabled state [ 710.520610][T23663] bridge0: port 2(bridge_slave_1) entered disabled state [ 710.527870][T23663] bridge0: port 1(bridge_slave_0) entered disabled state [ 710.541769][T23678] netlink: 3640 bytes leftover after parsing attributes in process `syz.2.5688'. [ 710.609793][T16840] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 710.627569][T16840] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.639489][T16840] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 710.651475][T16840] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.663432][T23685] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5689'. [ 710.701402][T16840] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 710.738395][T16840] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.760325][T16840] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 710.772881][T16840] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 710.998098][T23696] macsec1: entered promiscuous mode [ 711.017781][T23696] macsec1: entered allmulticast mode [ 711.062310][T23701] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5697'. [ 711.778154][T23740] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 712.059562][T23748] FAULT_INJECTION: forcing a failure. [ 712.059562][T23748] name failslab, interval 1, probability 0, space 0, times 0 [ 712.073189][T23748] CPU: 0 UID: 0 PID: 23748 Comm: syz.3.5712 Not tainted syzkaller #0 PREEMPT(full) [ 712.073217][T23748] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 712.073229][T23748] Call Trace: [ 712.073248][T23748] [ 712.073258][T23748] dump_stack_lvl+0xe8/0x150 [ 712.073288][T23748] should_fail_ex+0x412/0x560 [ 712.073317][T23748] should_failslab+0xa8/0x100 [ 712.073339][T23748] __kmalloc_cache_noprof+0x88/0x660 [ 712.073367][T23748] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 712.073394][T23748] ? sctp_add_bind_addr+0x8c/0x370 [ 712.073428][T23748] sctp_add_bind_addr+0x8c/0x370 [ 712.073461][T23748] sctp_copy_local_addr_list+0x314/0x4f0 [ 712.073491][T23748] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 712.073519][T23748] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 712.073549][T23748] ? sctp_v6_is_any+0x64/0x80 [ 712.073580][T23748] ? sctp_copy_one_addr+0x93/0x360 [ 712.073612][T23748] sctp_bind_addr_copy+0xb3/0x3c0 [ 712.073641][T23748] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 712.073670][T23748] sctp_connect_new_asoc+0x2ff/0x6b0 [ 712.073696][T23748] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 712.073724][T23748] ? sctp_get_af_specific+0x29/0x80 [ 712.073750][T23748] ? sctp_inet6_send_verify+0x80/0x300 [ 712.073775][T23748] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 712.073801][T23748] __sctp_connect+0x5cb/0xdc0 [ 712.073836][T23748] ? __pfx___sctp_connect+0x10/0x10 [ 712.073860][T23748] ? sctp_setsockopt+0x21c/0x12c0 [ 712.073878][T23748] ? security_sctp_bind_connect+0x7e/0x2c0 [ 712.073906][T23748] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 712.073935][T23748] sctp_setsockopt+0x708/0x12c0 [ 712.073954][T23748] ? sock_common_setsockopt+0x36/0xc0 [ 712.073979][T23748] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 712.074010][T23748] do_sock_setsockopt+0x17c/0x1b0 [ 712.074036][T23748] __x64_sys_setsockopt+0x13d/0x1b0 [ 712.074060][T23748] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.074081][T23748] do_syscall_64+0x174/0xf80 [ 712.074100][T23748] ? trace_irq_disable+0x3b/0x140 [ 712.074129][T23748] ? clear_bhb_loop+0x40/0x90 [ 712.074154][T23748] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.074174][T23748] RIP: 0033:0x7f59a399ce59 [ 712.074193][T23748] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 712.074209][T23748] RSP: 002b:00007f59a4824028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 712.074231][T23748] RAX: ffffffffffffffda RBX: 00007f59a3c15fa0 RCX: 00007f59a399ce59 [ 712.074254][T23748] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 712.074267][T23748] RBP: 00007f59a4824090 R08: 0000000000000010 R09: 0000000000000000 [ 712.074279][T23748] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 712.074292][T23748] R13: 00007f59a3c16038 R14: 00007f59a3c15fa0 R15: 00007ffcf3d7d7d8 [ 712.074327][T23748] [ 713.441560][T23800] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 713.454329][T23800] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 713.674586][T23819] __nla_validate_parse: 9 callbacks suppressed [ 713.674607][T23819] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5737'. [ 717.441972][T23824] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 717.562274][T23826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5739'. [ 717.579476][T23826] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5739'. [ 717.667615][T23800] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 717.679608][T23800] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.951486][T23800] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 717.985362][T23800] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.003285][T23844] netlink: 88 bytes leftover after parsing attributes in process `syz.3.5744'. [ 718.208649][T23800] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 718.237860][T23842] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5743'. [ 718.250378][T23852] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5745'. [ 718.259552][T23800] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.594931][T16842] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.617750][T16842] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.732708][T16836] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.754272][T16836] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 718.957270][T16840] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 718.974562][T16840] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.049539][T16840] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 719.074364][T16840] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 719.234653][T23906] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5765'. [ 719.627470][T23927] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5771'. [ 720.439399][T23958] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5782'. [ 720.529532][T23968] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5786'. [ 720.714648][T23958] nbd22: detected capacity change from 0 to 1 [ 720.728974][T21960] buffer_io_error: 18 callbacks suppressed [ 720.728994][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.776953][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.791217][ T50] block nbd22: Receive control failed (result -32) [ 720.820291][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.857772][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.890830][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.899935][T21960] ldm_validate_partition_table(): Disk read failed. [ 720.907158][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.928470][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.945085][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.968647][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 720.994874][T21960] Dev nbd22: unable to read RDB block 0 [ 721.003496][T21960] Buffer I/O error on dev nbd22, logical block 0, async page read [ 721.012745][T21960] nbd22: unable to read partition table [ 721.020378][T21960] nbd22: partition table beyond EOD, truncated [ 721.161323][T23984] bond7: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 721.234554][T23984] bond7 (unregistering): Released all slaves [ 721.368121][T24004] sctp: [Deprecated]: syz.4.5797 (pid 24004) Use of struct sctp_assoc_value in delayed_ack socket option. [ 721.368121][T24004] Use struct sctp_sack_info instead [ 721.474314][T24008] netlink: 'syz.0.5799': attribute type 10 has an invalid length. [ 721.498891][T24008] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5799'. [ 721.549177][T24014] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5802'. [ 721.586012][T24008] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5799'. [ 721.690565][T24008] syzkaller0: entered promiscuous mode [ 721.704514][T24008] syzkaller0: entered allmulticast mode [ 721.727740][T24025] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 721.740019][T24014] nbd23: detected capacity change from 0 to 1 [ 721.775367][T21960] ldm_validate_partition_table(): Disk read failed. [ 721.791845][T21960] Dev nbd23: unable to read RDB block 0 [ 721.799078][T21960] nbd23: unable to read partition table [ 721.807933][T21960] nbd23: partition table beyond EOD, truncated [ 721.908954][T24031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5807'. [ 722.371629][ T50] block nbd23: Receive control failed (result -32) [ 725.583153][T24074] netlink: 'syz.0.5816': attribute type 1 has an invalid length. [ 725.758750][T24086] FAULT_INJECTION: forcing a failure. [ 725.758750][T24086] name failslab, interval 1, probability 0, space 0, times 0 [ 725.774596][T24086] CPU: 0 UID: 0 PID: 24086 Comm: syz.4.5822 Not tainted syzkaller #0 PREEMPT(full) [ 725.774632][T24086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 725.774644][T24086] Call Trace: [ 725.774653][T24086] [ 725.774661][T24086] dump_stack_lvl+0xe8/0x150 [ 725.774691][T24086] should_fail_ex+0x412/0x560 [ 725.774719][T24086] should_failslab+0xa8/0x100 [ 725.774740][T24086] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 725.774792][T24086] ? __alloc_skb+0x186/0x7d0 [ 725.774820][T24086] ? __alloc_skb+0x1d0/0x7d0 [ 725.774845][T24086] ? __local_bh_enable_ip+0xd0/0x130 [ 725.774871][T24086] __alloc_skb+0x1d0/0x7d0 [ 725.774904][T24086] netlink_sendmsg+0x5d4/0xb40 [ 725.774934][T24086] ? __pfx_netlink_sendmsg+0x10/0x10 [ 725.774957][T24086] ? aa_sock_msg_perm+0xf1/0x1b0 [ 725.774986][T24086] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 725.775016][T24086] ____sys_sendmsg+0x972/0x9f0 [ 725.775037][T24086] ? __might_fault+0xaf/0x130 [ 725.775064][T24086] ? __pfx_____sys_sendmsg+0x10/0x10 [ 725.775096][T24086] ? import_iovec+0x73/0xa0 [ 725.775125][T24086] ___sys_sendmsg+0x2a5/0x360 [ 725.775145][T24086] ? __lock_acquire+0x6b5/0x2cf0 [ 725.775172][T24086] ? __pfx____sys_sendmsg+0x10/0x10 [ 725.775232][T24086] ? __fget_files+0x2a/0x420 [ 725.775256][T24086] ? __fget_files+0x3a0/0x420 [ 725.775291][T24086] __x64_sys_sendmsg+0x1bd/0x2a0 [ 725.775325][T24086] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 725.775357][T24086] ? __pfx_ksys_write+0x10/0x10 [ 725.775394][T24086] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.775416][T24086] do_syscall_64+0x174/0xf80 [ 725.775434][T24086] ? trace_irq_disable+0x3b/0x140 [ 725.775460][T24086] ? clear_bhb_loop+0x40/0x90 [ 725.775482][T24086] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.775501][T24086] RIP: 0033:0x7f1d6e39ce59 [ 725.775520][T24086] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.775537][T24086] RSP: 002b:00007f1d6f234028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 725.775559][T24086] RAX: ffffffffffffffda RBX: 00007f1d6e615fa0 RCX: 00007f1d6e39ce59 [ 725.775573][T24086] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000017 [ 725.775586][T24086] RBP: 00007f1d6f234090 R08: 0000000000000000 R09: 0000000000000000 [ 725.775598][T24086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 725.775610][T24086] R13: 00007f1d6e616038 R14: 00007f1d6e615fa0 R15: 00007ffccaefc548 [ 725.775642][T24086] [ 726.088041][T24092] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5823'. [ 726.118902][T24094] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5825'. [ 726.359128][T24094] nbd24: detected capacity change from 0 to 1 [ 726.374241][T24105] netlink: 288 bytes leftover after parsing attributes in process `syz.4.5827'. [ 726.409796][T21960] buffer_io_error: 46 callbacks suppressed [ 726.409816][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.449106][ T50] block nbd24: Receive control failed (result -32) [ 726.471276][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.504154][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.585054][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.645348][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.678470][T21960] ldm_validate_partition_table(): Disk read failed. [ 726.709620][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.731821][T24123] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5831'. [ 726.738445][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.761545][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.781293][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.797459][T21960] Dev nbd24: unable to read RDB block 0 [ 726.813504][T21960] Buffer I/O error on dev nbd24, logical block 0, async page read [ 726.834000][T21960] nbd24: unable to read partition table [ 726.846397][T21960] nbd24: partition table beyond EOD, truncated [ 726.978875][T16836] vlan2: left allmulticast mode [ 727.008526][T16836] dummy0: left allmulticast mode [ 727.045848][T16836] bridge0: port 3(vlan2) entered disabled state [ 727.050263][T24132] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5836'. [ 727.096188][T24138] FAULT_INJECTION: forcing a failure. [ 727.096188][T24138] name failslab, interval 1, probability 0, space 0, times 0 [ 727.116085][T24138] CPU: 1 UID: 0 PID: 24138 Comm: syz.1.5838 Not tainted syzkaller #0 PREEMPT(full) [ 727.116113][T24138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 727.116126][T24138] Call Trace: [ 727.116135][T24138] [ 727.116144][T24138] dump_stack_lvl+0xe8/0x150 [ 727.116172][T24138] should_fail_ex+0x412/0x560 [ 727.116201][T24138] should_failslab+0xa8/0x100 [ 727.116223][T24138] __kmalloc_cache_noprof+0x88/0x660 [ 727.116250][T24138] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 727.116278][T24138] ? sctp_add_bind_addr+0x8c/0x370 [ 727.116309][T24138] sctp_add_bind_addr+0x8c/0x370 [ 727.116340][T24138] sctp_copy_local_addr_list+0x314/0x4f0 [ 727.116372][T24138] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 727.116399][T24138] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 727.116428][T24138] ? sctp_v6_is_any+0x64/0x80 [ 727.116457][T24138] ? sctp_copy_one_addr+0x93/0x360 [ 727.116487][T24138] sctp_bind_addr_copy+0xb3/0x3c0 [ 727.116516][T24138] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 727.116545][T24138] sctp_connect_new_asoc+0x2ff/0x6b0 [ 727.116570][T24138] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 727.116598][T24138] ? sctp_get_af_specific+0x29/0x80 [ 727.116624][T24138] ? sctp_inet6_send_verify+0x80/0x300 [ 727.116649][T24138] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 727.116674][T24138] __sctp_connect+0x5cb/0xdc0 [ 727.116709][T24138] ? __pfx___sctp_connect+0x10/0x10 [ 727.116727][T24138] ? sctp_setsockopt+0x21c/0x12c0 [ 727.116745][T24138] ? security_sctp_bind_connect+0x7e/0x2c0 [ 727.116773][T24138] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 727.116802][T24138] sctp_setsockopt+0x708/0x12c0 [ 727.116820][T24138] ? sock_common_setsockopt+0x36/0xc0 [ 727.116847][T24138] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 727.116876][T24138] do_sock_setsockopt+0x17c/0x1b0 [ 727.116902][T24138] __x64_sys_setsockopt+0x13d/0x1b0 [ 727.116925][T24138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.116946][T24138] do_syscall_64+0x174/0xf80 [ 727.116964][T24138] ? trace_irq_disable+0x3b/0x140 [ 727.116992][T24138] ? clear_bhb_loop+0x40/0x90 [ 727.117016][T24138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.117035][T24138] RIP: 0033:0x7fce9799ce59 [ 727.117069][T24138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.117086][T24138] RSP: 002b:00007fce98797028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 727.117109][T24138] RAX: ffffffffffffffda RBX: 00007fce97c15fa0 RCX: 00007fce9799ce59 [ 727.117123][T24138] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 727.117135][T24138] RBP: 00007fce98797090 R08: 0000000000000010 R09: 0000000000000000 [ 727.117147][T24138] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 727.117160][T24138] R13: 00007fce97c16038 R14: 00007fce97c15fa0 R15: 00007ffc85d4e638 [ 727.117195][T24138] [ 727.467980][T24141] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 727.504917][T24142] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5839'. [ 727.782441][T24150] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5842'. [ 727.798916][T24149] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5842'. [ 728.155174][ T4965] block nbd8: Possible stuck request ffff888027abe000: control (read@0,1024B). Runtime 150 seconds [ 728.166374][ T4965] block nbd8: Possible stuck request ffff888027abe1c0: control (read@1024,1024B). Runtime 150 seconds [ 728.177936][ T4965] block nbd8: Possible stuck request ffff888027abe380: control (read@2048,1024B). Runtime 150 seconds [ 728.189029][ T4965] block nbd8: Possible stuck request ffff888027abe540: control (read@3072,1024B). Runtime 150 seconds [ 729.796272][T24154] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5843'. [ 729.918847][T24154] nbd25: detected capacity change from 0 to 1 [ 729.927756][T21960] ldm_validate_partition_table(): Disk read failed. [ 729.934922][T21960] Dev nbd25: unable to read RDB block 0 [ 729.935035][T16836] bond3 (unregistering): (slave gretap1): Releasing active interface [ 729.940841][T21960] nbd25: unable to read partition table [ 729.941141][T21960] nbd25: partition table beyond EOD, truncated [ 730.104170][T16836] bond0 (unregistering): Released all slaves [ 730.117509][T16836] bond1 (unregistering): Released all slaves [ 730.134845][T16836] bond2 (unregistering): Released all slaves [ 730.154264][T16836] bond3 (unregistering): Released all slaves [ 730.170324][T24120] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 730.339125][ T50] block nbd25: Receive control failed (result -32) [ 730.419680][T16836] : left promiscuous mode [ 730.520414][T24169] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5847'. [ 730.983634][T24192] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 731.128805][T24197] __nla_validate_parse: 1 callbacks suppressed [ 731.128829][T24197] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5856'. [ 731.781222][T24197] nbd26: detected capacity change from 0 to 1 [ 731.848247][T21960] buffer_io_error: 46 callbacks suppressed [ 731.848267][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 731.943000][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 731.956563][ T50] block nbd26: Receive control failed (result -32) [ 731.968251][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 731.997183][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.006270][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.014451][T21960] ldm_validate_partition_table(): Disk read failed. [ 732.034022][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.042240][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.051200][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.063841][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.086645][T21960] Dev nbd26: unable to read RDB block 0 [ 732.127522][T21960] Buffer I/O error on dev nbd26, logical block 0, async page read [ 732.152850][T21960] nbd26: unable to read partition table [ 732.171608][T21960] nbd26: partition table beyond EOD, truncated [ 732.391205][T24249] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5867'. [ 733.058398][T24276] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5876'. [ 733.102137][T24270] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5874'. [ 733.309203][T24276] nbd27: detected capacity change from 0 to 1 [ 733.331320][T21960] ldm_validate_partition_table(): Disk read failed. [ 733.350383][T21960] Dev nbd27: unable to read RDB block 0 [ 733.361147][T21960] nbd27: unable to read partition table [ 733.367617][T21960] nbd27: partition table beyond EOD, truncated [ 733.538133][ T50] block nbd27: Receive control failed (result -32) [ 733.940919][T24312] netlink: 'syz.4.5885': attribute type 1 has an invalid length. [ 734.074084][T24312] 8021q: adding VLAN 0 to HW filter on device bond4 [ 734.355677][T24330] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5892'. [ 734.372314][T24333] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5893'. [ 734.432210][T24335] syzkaller0: entered promiscuous mode [ 734.438359][T24335] syzkaller0: entered allmulticast mode [ 734.531287][T24335] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5894'. [ 734.608081][T24330] nbd28: detected capacity change from 0 to 1 [ 734.623728][T21960] ldm_validate_partition_table(): Disk read failed. [ 734.639693][T21960] Dev nbd28: unable to read RDB block 0 [ 734.684312][T21960] nbd28: unable to read partition table [ 734.692285][T21960] nbd28: partition table beyond EOD, truncated [ 734.933630][T24350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5897'. [ 734.955400][ T50] block nbd28: Receive control failed (result -32) [ 735.861403][T16836] veth1_macvtap: left promiscuous mode [ 735.872895][T16836] veth0_macvtap: left promiscuous mode [ 735.888404][T16836] veth1_vlan: left promiscuous mode [ 735.904175][T16836] veth0_vlan: left promiscuous mode [ 735.922266][T24378] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5905'. [ 736.458124][T24386] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5909'. [ 736.688986][T24386] nbd29: detected capacity change from 0 to 1 [ 736.697214][T21960] ldm_validate_partition_table(): Disk read failed. [ 736.722554][T21960] Dev nbd29: unable to read RDB block 0 [ 736.730248][T21960] nbd29: unable to read partition table [ 736.736702][T21960] nbd29: partition table beyond EOD, truncated [ 737.274531][ T50] block nbd29: Receive control failed (result -32) [ 737.291198][T24408] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5915'. [ 737.307127][T24408] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5915'. [ 737.323215][T24408] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5915'. [ 737.352689][T24408] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5915'. [ 737.385682][T24408] netlink: 'syz.3.5915': attribute type 6 has an invalid length. [ 737.777626][T24429] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 737.881258][T24432] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5924'. [ 737.890949][T24433] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 738.035342][T16836] IPVS: stop unused estimator thread 0... [ 738.094173][T24440] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5926'. [ 738.130206][T24442] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5927'. [ 738.269031][T24440] nbd30: detected capacity change from 0 to 1 [ 738.278447][T21960] buffer_io_error: 102 callbacks suppressed [ 738.278469][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.311227][ T50] block nbd30: Receive control failed (result -32) [ 738.328239][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.336899][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.351332][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.362461][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.371106][T21960] ldm_validate_partition_table(): Disk read failed. [ 738.378708][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.387572][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.396843][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.405319][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.413649][T21960] Dev nbd30: unable to read RDB block 0 [ 738.419579][T21960] Buffer I/O error on dev nbd30, logical block 0, async page read [ 738.429036][T21960] nbd30: unable to read partition table [ 738.435151][T21960] nbd30: partition table beyond EOD, truncated [ 738.572431][T24458] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.5930'. [ 738.611639][T24458] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5930'. [ 738.858619][T24471] bridge0: port 2(bridge_slave_1) entered blocking state [ 738.866107][T24471] bridge0: port 2(bridge_slave_1) entered forwarding state [ 738.923401][T24471] bridge0: port 2(bridge_slave_1) entered disabled state [ 739.158385][T19131] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 739.180075][T19131] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 739.191717][T19131] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 739.206278][T19131] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 739.219766][T19131] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 740.341323][T24535] bond5: option packets_per_slave: invalid value (1048582) [ 740.349267][T24535] bond5: option packets_per_slave: allowed values 0 - 65535 [ 740.361708][T24535] bond5 (unregistering): Released all slaves [ 740.432555][T24540] vlan0: entered promiscuous mode [ 740.579415][T24486] bridge0: port 1(bridge_slave_0) entered blocking state [ 740.593490][T24486] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.601774][T24486] bridge_slave_0: entered allmulticast mode [ 740.610036][T24486] bridge_slave_0: entered promiscuous mode [ 740.620577][T24486] bridge0: port 2(bridge_slave_1) entered blocking state [ 740.628415][T24486] bridge0: port 2(bridge_slave_1) entered disabled state [ 740.637297][T24486] bridge_slave_1: entered allmulticast mode [ 740.650179][T24486] bridge_slave_1: entered promiscuous mode [ 740.750048][T24486] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 740.785066][T24486] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 740.894812][T24548] bridge9: entered promiscuous mode [ 740.905868][T24548] bridge9: entered allmulticast mode [ 740.915274][T24548] team0: Port device bridge9 added [ 740.924241][T24486] team0: Port device team_slave_0 added [ 740.943140][T24486] team0: Port device team_slave_1 added [ 741.009736][T24486] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 741.017511][T24486] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 741.044863][T24486] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 741.217543][T24486] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 741.229688][T24486] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 741.256959][T24486] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 741.265686][ T50] Bluetooth: hci0: command tx timeout [ 741.327828][T24486] hsr_slave_0: entered promiscuous mode [ 741.334705][T24486] hsr_slave_1: entered promiscuous mode [ 741.341410][T24486] debugfs: 'hsr0' already exists in 'hsr' [ 741.348259][T24486] Cannot create hsr debugfs directory [ 741.607524][T24486] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 741.806461][T24486] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 741.869884][T24583] __nla_validate_parse: 13 callbacks suppressed [ 741.869908][T24583] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5970'. [ 741.933788][T24486] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.038834][T24586] netlink: 76 bytes leftover after parsing attributes in process `syz.4.5974'. [ 742.051261][T24486] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 742.082971][T24586] bridge0: port 2(bridge_slave_1) entered blocking state [ 742.090244][T24586] bridge0: port 2(bridge_slave_1) entered forwarding state [ 742.118920][T24586] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5974'. [ 742.170903][T24586] bridge0: port 2(bridge_slave_1) entered disabled state [ 742.281059][T24599] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 742.295403][T24597] netlink: 'syz.3.5978': attribute type 1 has an invalid length. [ 742.453768][T24486] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 742.477509][T24486] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 742.499916][T24486] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 742.533810][T24486] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 742.550587][T24486] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 742.589577][T24486] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 742.619215][T24486] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 742.646063][T24486] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 742.716218][T24627] netlink: 'syz.0.5984': attribute type 1 has an invalid length. [ 742.746077][T24627] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5984'. [ 742.900282][T24486] 8021q: adding VLAN 0 to HW filter on device bond0 [ 742.949384][T24633] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5989'. [ 742.963552][T24486] 8021q: adding VLAN 0 to HW filter on device team0 [ 743.001806][T11467] bridge0: port 1(bridge_slave_0) entered blocking state [ 743.009164][T11467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 743.017900][T24635] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5990'. [ 743.039718][T16842] bridge0: port 2(bridge_slave_1) entered blocking state [ 743.047034][T16842] bridge0: port 2(bridge_slave_1) entered forwarding state [ 743.208765][T24640] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 743.346158][ T50] Bluetooth: hci0: command tx timeout [ 743.408489][T24651] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5997'. [ 743.660446][T24667] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 744.088184][T24686] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6007'. [ 744.334915][T24486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 744.369737][T24702] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6012'. [ 744.478387][T24486] veth0_vlan: entered promiscuous mode [ 744.517637][T24486] veth1_vlan: entered promiscuous mode [ 744.622662][T24486] veth0_macvtap: entered promiscuous mode [ 744.651033][T24486] veth1_macvtap: entered promiscuous mode [ 744.713641][T24486] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 744.751789][T24486] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.787814][ T3366] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.804181][ T3366] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.824193][ T3366] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.835652][ T3366] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.935051][T24716] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6017'. [ 745.390260][T16836] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.419235][T16836] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 745.428333][ T50] Bluetooth: hci0: command tx timeout [ 745.543512][T16836] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.563743][T16836] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 746.583714][T24785] netlink: 'syz.4.6042': attribute type 2 has an invalid length. [ 746.607329][T24786] macvlan0: entered promiscuous mode [ 746.720837][T24795] macvlan0: entered allmulticast mode [ 746.727286][T24795] veth1_vlan: entered allmulticast mode [ 746.740328][T24795] veth1_vlan: left allmulticast mode [ 746.761291][T24795] macvlan0 (unregistering): left promiscuous mode [ 746.769958][T24795] macvlan0 (unregistering): left allmulticast mode [ 746.781872][T24794] block nbd0: reconnected socket [ 746.782478][ T50] block nbd0: Receive control failed (result -107) [ 746.820356][ T3366] vlan2: left allmulticast mode [ 746.835635][ T3366] dummy0: left allmulticast mode [ 746.853923][ T3366] vlan2: left promiscuous mode [ 746.867740][ T3366] dummy0: left promiscuous mode [ 746.880127][ T3366] bridge0: port 3(vlan2) entered disabled state [ 746.891988][ T3366] bridge_slave_1: left allmulticast mode [ 746.898562][ T3366] bridge_slave_1: left promiscuous mode [ 746.907213][ T3366] bridge0: port 2(bridge_slave_1) entered disabled state [ 746.919512][ T3366] bridge_slave_0: left allmulticast mode [ 746.929338][ T3366] bridge_slave_0: left promiscuous mode [ 746.938921][ T3366] bridge0: port 1(bridge_slave_0) entered disabled state [ 746.980704][ T3366] dvmrp0: left allmulticast mode [ 747.345258][T24807] __nla_validate_parse: 9 callbacks suppressed [ 747.345281][T24807] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6050'. [ 747.363423][ T3366] bond2 (unregistering): (slave bridge6): Releasing backup interface [ 747.372494][ T3366] bond2 (unregistering): (slave bridge6): the permanent HWaddr of slave - ce:b0:93:ca:a3:b6 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 747.401162][ T3366] bond2 (unregistering): (slave bridge7): Releasing backup interface [ 747.437754][ T3366] bond4 (unregistering): (slave bridge10): Releasing backup interface [ 747.459414][ T3366] bridge10 (unregistering): left promiscuous mode [ 747.482200][ T3366] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 747.499189][ T3366] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 747.505624][T19131] Bluetooth: hci0: command tx timeout [ 747.518958][ T3366] bond0 (unregistering): Released all slaves [ 747.539371][T24813] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6051'. [ 747.540293][ T3366] bond1 (unregistering): Released all slaves [ 747.549877][T24807] nbd31: detected capacity change from 0 to 1 [ 747.567202][T24722] buffer_io_error: 18 callbacks suppressed [ 747.567220][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.573363][ T3366] bond2 (unregistering): Released all slaves [ 747.583014][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.598164][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.599917][T24814] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6051'. [ 747.607388][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.627739][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.636797][T24722] ldm_validate_partition_table(): Disk read failed. [ 747.643515][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.652121][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.660684][ T3366] bond3 (unregistering): (slave macvlan0): Releasing active interface [ 747.660718][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.682089][T24809] Bluetooth: MGMT ver 1.23 [ 747.688188][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.689667][ T3366] bond3 (unregistering): Released all slaves [ 747.696458][T24722] Dev nbd31: unable to read RDB block 0 [ 747.696530][T24722] Buffer I/O error on dev nbd31, logical block 0, async page read [ 747.696810][T24722] nbd31: unable to read partition table [ 747.725317][T24722] nbd31: partition table beyond EOD, truncated [ 747.725748][ T3366] bond4 (unregistering): Released all slaves [ 747.763474][T24801] vxcan8: entered allmulticast mode [ 747.802598][ T50] block nbd31: Receive control failed (result -32) [ 747.974977][T24814] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6051'. [ 748.001441][ T3366] tipc: Left network mode [ 748.061677][T24820] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6055'. [ 748.086805][T24822] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 749.004910][T24850] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6065'. [ 749.316150][T24860] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6066'. [ 749.359107][T24860] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6066'. [ 749.733553][T24872] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6073'. [ 749.902903][T24876] IPVS: Error connecting to the multicast addr [ 749.930153][T24879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6076'. [ 750.217998][T24887] FAULT_INJECTION: forcing a failure. [ 750.217998][T24887] name failslab, interval 1, probability 0, space 0, times 0 [ 750.238207][T24887] CPU: 1 UID: 0 PID: 24887 Comm: syz.1.6081 Not tainted syzkaller #0 PREEMPT(full) [ 750.238236][T24887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 750.238247][T24887] Call Trace: [ 750.238255][T24887] [ 750.238265][T24887] dump_stack_lvl+0xe8/0x150 [ 750.238293][T24887] should_fail_ex+0x412/0x560 [ 750.238320][T24887] should_failslab+0xa8/0x100 [ 750.238341][T24887] __kmalloc_cache_noprof+0x88/0x660 [ 750.238363][T24887] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 750.238389][T24887] ? sctp_add_bind_addr+0x8c/0x370 [ 750.238419][T24887] sctp_add_bind_addr+0x8c/0x370 [ 750.238448][T24887] sctp_copy_local_addr_list+0x314/0x4f0 [ 750.238476][T24887] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 750.238500][T24887] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 750.238526][T24887] ? sctp_v6_is_any+0x64/0x80 [ 750.238552][T24887] ? sctp_copy_one_addr+0x93/0x360 [ 750.238580][T24887] sctp_bind_addr_copy+0xb3/0x3c0 [ 750.238606][T24887] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 750.238631][T24887] sctp_connect_new_asoc+0x2ff/0x6b0 [ 750.238655][T24887] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 750.238681][T24887] ? sctp_get_af_specific+0x29/0x80 [ 750.238716][T24887] ? sctp_inet6_send_verify+0x80/0x300 [ 750.238738][T24887] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 750.238759][T24887] __sctp_connect+0x5cb/0xdc0 [ 750.238793][T24887] ? __pfx___sctp_connect+0x10/0x10 [ 750.238809][T24887] ? sctp_setsockopt+0x21c/0x12c0 [ 750.238826][T24887] ? security_sctp_bind_connect+0x7e/0x2c0 [ 750.238850][T24887] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 750.238877][T24887] sctp_setsockopt+0x708/0x12c0 [ 750.238894][T24887] ? sock_common_setsockopt+0x36/0xc0 [ 750.238918][T24887] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 750.238943][T24887] do_sock_setsockopt+0x17c/0x1b0 [ 750.238967][T24887] __x64_sys_setsockopt+0x13d/0x1b0 [ 750.238988][T24887] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.239021][T24887] do_syscall_64+0x174/0xf80 [ 750.239037][T24887] ? trace_irq_disable+0x3b/0x140 [ 750.239061][T24887] ? clear_bhb_loop+0x40/0x90 [ 750.239083][T24887] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 750.239101][T24887] RIP: 0033:0x7fce9799ce59 [ 750.239121][T24887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 750.239136][T24887] RSP: 002b:00007fce98797028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 750.239158][T24887] RAX: ffffffffffffffda RBX: 00007fce97c15fa0 RCX: 00007fce9799ce59 [ 750.239171][T24887] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 750.239183][T24887] RBP: 00007fce98797090 R08: 0000000000000010 R09: 0000000000000000 [ 750.239195][T24887] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 750.239206][T24887] R13: 00007fce97c16038 R14: 00007fce97c15fa0 R15: 00007ffc85d4e638 [ 750.239239][T24887] [ 751.302754][T19131] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 751.303418][T24918] netlink: 'syz.2.6090': attribute type 1 has an invalid length. [ 751.325972][T19131] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 751.339189][T19131] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 751.347730][T19131] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 751.357916][T19131] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 751.865846][T24928] vlan2: entered promiscuous mode [ 752.744884][T24950] __nla_validate_parse: 3 callbacks suppressed [ 752.744908][T24950] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6100'. [ 752.788291][T24950] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6100'. [ 752.877875][T24950] bridge0: port 2(bridge_slave_1) entered blocking state [ 752.885165][T24950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 752.919379][T24950] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6100'. [ 753.014642][T24955] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6103'. [ 753.203307][T24961] netlink: 'syz.0.6105': attribute type 1 has an invalid length. [ 753.331239][T24961] bond5: entered promiscuous mode [ 753.348974][T24961] 8021q: adding VLAN 0 to HW filter on device bond5 [ 753.425725][T19131] Bluetooth: hci5: command tx timeout [ 753.520761][T24971] bond5: (slave veth17): making interface the new active one [ 753.548778][T24971] veth17: entered promiscuous mode [ 753.573752][T24971] bond5: (slave veth17): Enslaving as an active interface with an up link [ 753.648883][ T3366] hsr_slave_0: left promiscuous mode [ 753.671648][ T3366] hsr_slave_1: left promiscuous mode [ 753.804086][T24978] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6111'. [ 753.817469][T24977] netlink: 96 bytes leftover after parsing attributes in process `syz.2.6110'. [ 754.139861][T24984] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6113'. [ 754.296978][ T3366] team0 (unregistering): Port device team_slave_1 removed [ 754.323001][ T3366] team0 (unregistering): Port device team_slave_0 removed [ 754.759443][T24988] FAULT_INJECTION: forcing a failure. [ 754.759443][T24988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 754.799554][T24988] CPU: 1 UID: 0 PID: 24988 Comm: syz.2.6115 Not tainted syzkaller #0 PREEMPT(full) [ 754.799583][T24988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 754.799596][T24988] Call Trace: [ 754.799604][T24988] [ 754.799613][T24988] dump_stack_lvl+0xe8/0x150 [ 754.799643][T24988] should_fail_ex+0x412/0x560 [ 754.799679][T24988] _copy_from_user+0x2d/0xb0 [ 754.799704][T24988] ___sys_sendmsg+0x1c6/0x360 [ 754.799725][T24988] ? __lock_acquire+0x6b5/0x2cf0 [ 754.799752][T24988] ? __pfx____sys_sendmsg+0x10/0x10 [ 754.799812][T24988] ? __fget_files+0x2a/0x420 [ 754.799834][T24988] ? __fget_files+0x3a0/0x420 [ 754.799869][T24988] __x64_sys_sendmsg+0x1bd/0x2a0 [ 754.799894][T24988] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 754.799924][T24988] ? __pfx_ksys_write+0x10/0x10 [ 754.799961][T24988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.799983][T24988] do_syscall_64+0x174/0xf80 [ 754.800002][T24988] ? trace_irq_disable+0x3b/0x140 [ 754.800030][T24988] ? clear_bhb_loop+0x40/0x90 [ 754.800055][T24988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.800075][T24988] RIP: 0033:0x7f280ff9ce59 [ 754.800095][T24988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 754.800111][T24988] RSP: 002b:00007f2810d9e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 754.800134][T24988] RAX: ffffffffffffffda RBX: 00007f2810215fa0 RCX: 00007f280ff9ce59 [ 754.800148][T24988] RDX: 0000000000000000 RSI: 0000200000001240 RDI: 0000000000000003 [ 754.800160][T24988] RBP: 00007f2810d9e090 R08: 0000000000000000 R09: 0000000000000000 [ 754.800171][T24988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 754.800183][T24988] R13: 00007f2810216038 R14: 00007f2810215fa0 R15: 00007ffe8aec12f8 [ 754.800216][T24988] [ 755.153787][T25005] FAULT_INJECTION: forcing a failure. [ 755.153787][T25005] name failslab, interval 1, probability 0, space 0, times 0 [ 755.168477][T25005] CPU: 1 UID: 0 PID: 25005 Comm: syz.3.6121 Not tainted syzkaller #0 PREEMPT(full) [ 755.168506][T25005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 755.168518][T25005] Call Trace: [ 755.168526][T25005] [ 755.168535][T25005] dump_stack_lvl+0xe8/0x150 [ 755.168565][T25005] should_fail_ex+0x412/0x560 [ 755.168593][T25005] should_failslab+0xa8/0x100 [ 755.168616][T25005] __kmalloc_cache_noprof+0x88/0x660 [ 755.168644][T25005] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 755.168682][T25005] ? sctp_add_bind_addr+0x8c/0x370 [ 755.168716][T25005] sctp_add_bind_addr+0x8c/0x370 [ 755.168749][T25005] sctp_copy_local_addr_list+0x314/0x4f0 [ 755.168780][T25005] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 755.168808][T25005] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 755.168839][T25005] ? sctp_v6_is_any+0x64/0x80 [ 755.168869][T25005] ? sctp_copy_one_addr+0x93/0x360 [ 755.168901][T25005] sctp_bind_addr_copy+0xb3/0x3c0 [ 755.168928][T25005] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 755.168958][T25005] sctp_connect_new_asoc+0x2ff/0x6b0 [ 755.168984][T25005] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 755.169013][T25005] ? sctp_get_af_specific+0x29/0x80 [ 755.169039][T25005] ? sctp_inet6_send_verify+0x80/0x300 [ 755.169064][T25005] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 755.169090][T25005] __sctp_connect+0x5cb/0xdc0 [ 755.169126][T25005] ? __pfx___sctp_connect+0x10/0x10 [ 755.169145][T25005] ? sctp_setsockopt+0x21c/0x12c0 [ 755.169164][T25005] ? security_sctp_bind_connect+0x7e/0x2c0 [ 755.169192][T25005] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 755.169223][T25005] sctp_setsockopt+0x708/0x12c0 [ 755.169242][T25005] ? sock_common_setsockopt+0x36/0xc0 [ 755.169281][T25005] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 755.169311][T25005] do_sock_setsockopt+0x17c/0x1b0 [ 755.169337][T25005] __x64_sys_setsockopt+0x13d/0x1b0 [ 755.169361][T25005] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.169384][T25005] do_syscall_64+0x174/0xf80 [ 755.169403][T25005] ? trace_irq_disable+0x3b/0x140 [ 755.169432][T25005] ? clear_bhb_loop+0x40/0x90 [ 755.169457][T25005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.169478][T25005] RIP: 0033:0x7f59a399ce59 [ 755.169497][T25005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.169514][T25005] RSP: 002b:00007f59a4824028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 755.169537][T25005] RAX: ffffffffffffffda RBX: 00007f59a3c15fa0 RCX: 00007f59a399ce59 [ 755.169552][T25005] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 755.169565][T25005] RBP: 00007f59a4824090 R08: 0000000000000010 R09: 0000000000000000 [ 755.169578][T25005] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 755.169591][T25005] R13: 00007f59a3c16038 R14: 00007f59a3c15fa0 R15: 00007ffcf3d7d7d8 [ 755.169625][T25005] [ 755.505759][T19131] Bluetooth: hci5: command tx timeout [ 755.717853][T25014] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6123'. [ 755.772873][T24917] bridge0: port 1(bridge_slave_0) entered blocking state [ 755.780283][T24917] bridge0: port 1(bridge_slave_0) entered disabled state [ 755.788963][T24917] bridge_slave_0: entered allmulticast mode [ 755.798638][T24917] bridge_slave_0: entered promiscuous mode [ 755.863900][T24917] bridge0: port 2(bridge_slave_1) entered blocking state [ 755.872502][T24917] bridge0: port 2(bridge_slave_1) entered disabled state [ 755.880404][T24917] bridge_slave_1: entered allmulticast mode [ 755.889596][T24917] bridge_slave_1: entered promiscuous mode [ 755.917345][ T3366] IPVS: stop unused estimator thread 0... [ 756.053421][T24917] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 756.102143][T24917] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 756.110067][T25033] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6128'. [ 756.275760][T24917] team0: Port device team_slave_0 added [ 756.293119][T24917] team0: Port device team_slave_1 added [ 756.357562][T25033] nbd32: detected capacity change from 0 to 1 [ 756.378257][T24722] buffer_io_error: 18 callbacks suppressed [ 756.378276][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.431958][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.434260][T19131] block nbd32: Receive control failed (result -32) [ 756.452167][T24917] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 756.486057][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.494270][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.508648][T24917] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 756.511834][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.549056][T24722] ldm_validate_partition_table(): Disk read failed. [ 756.551951][T25049] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6132'. [ 756.556494][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.578922][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.596235][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.606226][T25053] FAULT_INJECTION: forcing a failure. [ 756.606226][T25053] name failslab, interval 1, probability 0, space 0, times 0 [ 756.620181][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.630513][T24722] Dev nbd32: unable to read RDB block 0 [ 756.631448][T24917] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 756.636659][T25053] CPU: 1 UID: 0 PID: 25053 Comm: syz.3.6133 Not tainted syzkaller #0 PREEMPT(full) [ 756.636681][T25053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 756.636691][T25053] Call Trace: [ 756.636699][T25053] [ 756.636708][T25053] dump_stack_lvl+0xe8/0x150 [ 756.636736][T25053] should_fail_ex+0x412/0x560 [ 756.636763][T25053] should_failslab+0xa8/0x100 [ 756.636784][T25053] __kmalloc_cache_noprof+0x88/0x660 [ 756.636813][T25053] ? sctp_add_bind_addr+0x8c/0x370 [ 756.636843][T25053] sctp_add_bind_addr+0x8c/0x370 [ 756.636870][T25053] sctp_copy_local_addr_list+0x314/0x4f0 [ 756.636907][T25053] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 756.636930][T25053] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 756.636955][T25053] ? sctp_v6_is_any+0x64/0x80 [ 756.636981][T25053] ? sctp_copy_one_addr+0x93/0x360 [ 756.637007][T25053] sctp_bind_addr_copy+0xb3/0x3c0 [ 756.637032][T25053] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 756.637057][T25053] sctp_connect_new_asoc+0x2ff/0x6b0 [ 756.637079][T25053] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 756.637104][T25053] ? sctp_get_af_specific+0x29/0x80 [ 756.637126][T25053] ? sctp_inet6_send_verify+0x80/0x300 [ 756.637147][T25053] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 756.637169][T25053] __sctp_connect+0x5cb/0xdc0 [ 756.637199][T25053] ? __pfx___sctp_connect+0x10/0x10 [ 756.637215][T25053] ? sctp_setsockopt+0x21c/0x12c0 [ 756.637231][T25053] ? security_sctp_bind_connect+0x7e/0x2c0 [ 756.637256][T25053] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 756.637281][T25053] sctp_setsockopt+0x708/0x12c0 [ 756.637297][T25053] ? sock_common_setsockopt+0x36/0xc0 [ 756.637320][T25053] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 756.637346][T25053] do_sock_setsockopt+0x17c/0x1b0 [ 756.637369][T25053] __x64_sys_setsockopt+0x13d/0x1b0 [ 756.637389][T25053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.637408][T25053] do_syscall_64+0x174/0xf80 [ 756.637424][T25053] ? trace_irq_disable+0x3b/0x140 [ 756.637449][T25053] ? clear_bhb_loop+0x40/0x90 [ 756.637470][T25053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.637487][T25053] RIP: 0033:0x7f59a399ce59 [ 756.637505][T25053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 756.637519][T25053] RSP: 002b:00007f59a4824028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 756.637539][T25053] RAX: ffffffffffffffda RBX: 00007f59a3c15fa0 RCX: 00007f59a399ce59 [ 756.637551][T25053] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 756.637562][T25053] RBP: 00007f59a4824090 R08: 0000000000000010 R09: 0000000000000000 [ 756.637573][T25053] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 756.637583][T25053] R13: 00007f59a3c16038 R14: 00007f59a3c15fa0 R15: 00007ffcf3d7d7d8 [ 756.637614][T25053] [ 756.640615][T24722] Buffer I/O error on dev nbd32, logical block 0, async page read [ 756.690239][T25049] bridge0: port 3(vlan2) entered blocking state [ 756.722761][T24722] nbd32: unable to read partition table [ 756.723683][T25049] bridge0: port 3(vlan2) entered forwarding state [ 756.729447][T24722] nbd32: partition table beyond EOD, [ 756.733804][T25049] bridge0: port 2(bridge_slave_1) entered blocking state [ 756.753793][T24722] truncated [ 756.756339][T25049] bridge0: port 2(bridge_slave_1) entered forwarding state [ 756.756654][T25049] bridge0: port 1(bridge_slave_0) entered blocking state [ 756.987383][T25049] bridge0: port 1(bridge_slave_0) entered forwarding state [ 757.041375][T24917] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 757.050324][T24917] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.100175][T24917] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 757.303668][T24917] hsr_slave_0: entered promiscuous mode [ 757.332240][T24917] hsr_slave_1: entered promiscuous mode [ 757.592447][ T50] Bluetooth: hci5: command tx timeout [ 757.685577][T25074] nbd33: detected capacity change from 0 to 1 [ 757.740940][T21960] ldm_validate_partition_table(): Disk read failed. [ 757.761529][T21960] Dev nbd33: unable to read RDB block 0 [ 757.782443][T19131] block nbd33: Receive control failed (result -32) [ 757.784889][T21960] nbd33: unable to read partition table [ 757.798172][T21960] nbd33: partition table beyond EOD, truncated [ 757.873623][T25096] FAULT_INJECTION: forcing a failure. [ 757.873623][T25096] name failslab, interval 1, probability 0, space 0, times 0 [ 757.888682][T25096] CPU: 1 UID: 0 PID: 25096 Comm: syz.4.6145 Not tainted syzkaller #0 PREEMPT(full) [ 757.888723][T25096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 757.888735][T25096] Call Trace: [ 757.888743][T25096] [ 757.888752][T25096] dump_stack_lvl+0xe8/0x150 [ 757.888781][T25096] should_fail_ex+0x412/0x560 [ 757.888810][T25096] should_failslab+0xa8/0x100 [ 757.888838][T25096] __kmalloc_cache_noprof+0x88/0x660 [ 757.888864][T25096] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 757.888892][T25096] ? sctp_v6_cmp_addr+0x15/0xd0 [ 757.888918][T25096] ? sctp_add_bind_addr+0x8c/0x370 [ 757.888948][T25096] sctp_add_bind_addr+0x8c/0x370 [ 757.888979][T25096] sctp_copy_local_addr_list+0x314/0x4f0 [ 757.889012][T25096] ? sctp_copy_local_addr_list+0xa4/0x4f0 [ 757.889038][T25096] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 757.889067][T25096] ? sctp_v6_is_any+0x64/0x80 [ 757.889094][T25096] ? sctp_copy_one_addr+0x93/0x360 [ 757.889122][T25096] sctp_bind_addr_copy+0xb3/0x3c0 [ 757.889148][T25096] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 757.889177][T25096] sctp_connect_new_asoc+0x2ff/0x6b0 [ 757.889204][T25096] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 757.889232][T25096] ? sctp_get_af_specific+0x29/0x80 [ 757.889258][T25096] ? sctp_inet6_send_verify+0x80/0x300 [ 757.889283][T25096] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 757.889309][T25096] __sctp_connect+0x5cb/0xdc0 [ 757.889344][T25096] ? __pfx___sctp_connect+0x10/0x10 [ 757.889363][T25096] ? sctp_setsockopt+0x21c/0x12c0 [ 757.889381][T25096] ? security_sctp_bind_connect+0x7e/0x2c0 [ 757.889410][T25096] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 757.889437][T25096] sctp_setsockopt+0x708/0x12c0 [ 757.889455][T25096] ? sock_common_setsockopt+0x36/0xc0 [ 757.889481][T25096] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 757.889508][T25096] do_sock_setsockopt+0x17c/0x1b0 [ 757.889535][T25096] __x64_sys_setsockopt+0x13d/0x1b0 [ 757.889559][T25096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.889582][T25096] do_syscall_64+0x174/0xf80 [ 757.889601][T25096] ? trace_irq_disable+0x3b/0x140 [ 757.889629][T25096] ? clear_bhb_loop+0x40/0x90 [ 757.889656][T25096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.889676][T25096] RIP: 0033:0x7f1d6e39ce59 [ 757.889705][T25096] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.889723][T25096] RSP: 002b:00007f1d6f234028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 757.889746][T25096] RAX: ffffffffffffffda RBX: 00007f1d6e615fa0 RCX: 00007f1d6e39ce59 [ 757.889760][T25096] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 757.889773][T25096] RBP: 00007f1d6f234090 R08: 0000000000000010 R09: 0000000000000000 [ 757.889785][T25096] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000002 [ 757.889799][T25096] R13: 00007f1d6e616038 R14: 00007f1d6e615fa0 R15: 00007ffccaefc548 [ 757.889834][T25096] [ 758.254785][T25098] __nla_validate_parse: 6 callbacks suppressed [ 758.254808][T25098] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6146'. [ 758.276883][ T4965] block nbd8: Possible stuck request ffff888027abe000: control (read@0,1024B). Runtime 180 seconds [ 758.287921][ T4965] block nbd8: Possible stuck request ffff888027abe1c0: control (read@1024,1024B). Runtime 180 seconds [ 758.305199][ T4965] block nbd8: Possible stuck request ffff888027abe380: control (read@2048,1024B). Runtime 180 seconds [ 758.318034][ T4965] block nbd8: Possible stuck request ffff888027abe540: control (read@3072,1024B). Runtime 180 seconds [ 758.330389][T25098] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6146'. [ 758.362794][T24917] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 758.373154][T24917] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.379352][T25104] FAULT_INJECTION: forcing a failure. [ 758.379352][T25104] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 758.399882][T25104] CPU: 0 UID: 0 PID: 25104 Comm: syz.0.6149 Not tainted syzkaller #0 PREEMPT(full) [ 758.399908][T25104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 758.399918][T25104] Call Trace: [ 758.399926][T25104] [ 758.399934][T25104] dump_stack_lvl+0xe8/0x150 [ 758.399959][T25104] should_fail_ex+0x412/0x560 [ 758.399983][T25104] _copy_from_iter+0x1d3/0x1670 [ 758.400004][T25104] ? rcu_is_watching+0x15/0xb0 [ 758.400030][T25104] ? __pfx__copy_from_iter+0x10/0x10 [ 758.400055][T25104] ? netlink_sendmsg+0x650/0xb40 [ 758.400073][T25104] ? skb_put+0x11b/0x210 [ 758.400093][T25104] netlink_sendmsg+0x6c0/0xb40 [ 758.400118][T25104] ? __pfx_netlink_sendmsg+0x10/0x10 [ 758.400139][T25104] ? aa_sock_msg_perm+0xf1/0x1b0 [ 758.400164][T25104] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 758.400189][T25104] ____sys_sendmsg+0x972/0x9f0 [ 758.400206][T25104] ? __might_fault+0xaf/0x130 [ 758.400232][T25104] ? __pfx_____sys_sendmsg+0x10/0x10 [ 758.400259][T25104] ? import_iovec+0x73/0xa0 [ 758.400281][T25104] ___sys_sendmsg+0x2a5/0x360 [ 758.400298][T25104] ? __lock_acquire+0x6b5/0x2cf0 [ 758.400320][T25104] ? __pfx____sys_sendmsg+0x10/0x10 [ 758.400371][T25104] ? __fget_files+0x2a/0x420 [ 758.400390][T25104] ? __fget_files+0x3a0/0x420 [ 758.400418][T25104] __x64_sys_sendmsg+0x1bd/0x2a0 [ 758.400441][T25104] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 758.400469][T25104] ? __pfx_ksys_write+0x10/0x10 [ 758.400498][T25104] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.400515][T25104] do_syscall_64+0x174/0xf80 [ 758.400529][T25104] ? trace_irq_disable+0x3b/0x140 [ 758.400550][T25104] ? clear_bhb_loop+0x40/0x90 [ 758.400568][T25104] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 758.400582][T25104] RIP: 0033:0x7f24e419ce59 [ 758.400599][T25104] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.400613][T25104] RSP: 002b:00007f24e4fc0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 758.400631][T25104] RAX: ffffffffffffffda RBX: 00007f24e4415fa0 RCX: 00007f24e419ce59 [ 758.400642][T25104] RDX: 0000000000000000 RSI: 0000200000001240 RDI: 0000000000000003 [ 758.400652][T25104] RBP: 00007f24e4fc0090 R08: 0000000000000000 R09: 0000000000000000 [ 758.400661][T25104] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 758.400670][T25104] R13: 00007f24e4416038 R14: 00007f24e4415fa0 R15: 00007ffdbb79a628 [ 758.400694][T25104] [ 758.743654][T24917] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 758.755098][T24917] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.784886][T25107] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6150'. [ 758.900393][T24917] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 758.911038][T24917] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.961759][T25123] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6154'. [ 759.042914][T24917] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 759.072647][T24917] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 759.251522][T25138] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6159'. [ 759.313644][T25138] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6159'. [ 759.565775][T25148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6161'. [ 759.578344][T25147] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6162'. [ 759.595822][T25147] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6162'. [ 759.617328][T25148] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6161'. [ 759.669715][T19131] Bluetooth: hci5: command tx timeout [ 759.683555][T16837] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 759.697445][T16837] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 759.708962][T16837] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 759.812713][T16837] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 759.943408][T24917] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 759.976047][T24917] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 760.039684][T24917] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 760.085195][T24917] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 760.103867][T24917] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 760.130513][T24917] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 760.254469][T24917] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 760.268319][T24917] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 760.644785][T24917] 8021q: adding VLAN 0 to HW filter on device bond0 [ 760.791496][T24917] 8021q: adding VLAN 0 to HW filter on device team0 [ 760.987522][T16839] bridge0: port 1(bridge_slave_0) entered blocking state [ 760.994788][T16839] bridge0: port 1(bridge_slave_0) entered forwarding state [ 761.045354][T16839] bridge0: port 2(bridge_slave_1) entered blocking state [ 761.052715][T16839] bridge0: port 2(bridge_slave_1) entered forwarding state [ 761.144317][ T29] audit: type=1804 audit(1779939160.872:4): pid=25204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.6180" name="/newroot/569/cgroup.controllers" dev="tmpfs" ino=2893 res=1 errno=0 [ 761.187491][ T29] audit: type=1800 audit(1779939160.872:5): pid=25204 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.6180" name="cgroup.controllers" dev="tmpfs" ino=2893 res=0 errno=0 [ 761.794920][ T5295] veth0_vlan: left promiscuous mode [ 761.858402][ T5295] veth0_vlan: entered promiscuous mode [ 762.077561][T25252] xfrm1: entered promiscuous mode [ 762.088813][T25252] xfrm1: entered allmulticast mode [ 762.247670][T25259] bridge0: port 3(vlan2) entered disabled state [ 762.254238][T25259] bridge0: port 2(bridge_slave_1) entered disabled state [ 762.261739][T25259] bridge0: port 1(bridge_slave_0) entered disabled state [ 762.719125][T24917] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 762.780946][T25284] syzkaller0: entered promiscuous mode [ 762.804308][T25284] syzkaller0: entered allmulticast mode [ 762.993063][T24917] veth0_vlan: entered promiscuous mode [ 763.057815][T24917] veth1_vlan: entered promiscuous mode [ 763.262274][T24917] veth0_macvtap: entered promiscuous mode [ 763.331013][T24917] veth1_macvtap: entered promiscuous mode [ 763.425053][T24917] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 763.659485][T24917] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 763.719603][ T3366] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 763.749078][ T3366] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 763.811257][ T3366] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 763.843750][T25315] __nla_validate_parse: 36 callbacks suppressed [ 763.843776][T25315] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6209'. [ 763.846739][ T3366] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 764.243021][T25330] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6214'. [ 764.253594][T25333] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 764.267415][T16842] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 764.286841][T16842] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 764.428536][T25337] bond0: (slave bond_slave_1): Releasing backup interface [ 764.457889][T11467] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 764.467990][T11467] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 765.094217][T25365] openvswitch: netlink: Duplicate key (type 21). [ 765.184430][T25368] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6227'. [ 765.316644][T25372] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6228'. [ 765.353541][T25372] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6228'. [ 765.526208][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 765.542543][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 765.553201][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 765.576199][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 765.584132][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 765.763329][T25395] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.891500][T25399] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6233'. [ 766.135232][ T8471] IPVS: starting estimator thread 0... [ 766.206539][T25409] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6236'. [ 766.246536][T25408] IPVS: using max 26 ests per chain, 62400 per kthread [ 766.278048][T25409] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.287442][T25409] bridge0: port 1(bridge_slave_0) entered disabled state [ 766.382006][T25420] netlink: 'syz.3.6240': attribute type 11 has an invalid length. [ 766.410350][T25420] mac80211_hwsim hwsim85 wlan0: entered promiscuous mode [ 766.420176][T25420] mac80211_hwsim hwsim85 wlan0: entered allmulticast mode [ 766.572535][T25432] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6244'. [ 766.578924][T25429] x_tables: ip6_tables: eui64 match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT/FORWARD [ 766.834349][T25442] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6246'. [ 766.870818][T25442] bridge0: port 3(vlan2) entered blocking state [ 766.877473][T25442] bridge0: port 3(vlan2) entered forwarding state [ 766.884347][T25442] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.891692][T25442] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.899306][T25442] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.906571][T25442] bridge0: port 1(bridge_slave_0) entered forwarding state [ 766.918314][T25442] bridge0: port 3(vlan2) entered disabled state [ 766.924881][T25442] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.932300][T25442] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.098803][T25448] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6248'. [ 767.380930][T25468] sctp: [Deprecated]: syz.2.6253 (pid 25468) Use of struct sctp_assoc_value in delayed_ack socket option. [ 767.380930][T25468] Use struct sctp_sack_info instead [ 767.666565][T19131] Bluetooth: hci3: command tx timeout [ 767.825664][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 767.880647][T25380] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.894880][T25492] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 767.909231][T25380] bridge0: port 1(bridge_slave_0) entered disabled state [ 767.917796][T25380] bridge_slave_0: entered allmulticast mode [ 767.934351][T25380] bridge_slave_0: entered promiscuous mode [ 767.954250][T25484] tipc: Started in network mode [ 767.960977][T25484] tipc: Node identity 6a8d49433966, cluster identity 4711 [ 767.970601][T25484] tipc: Enabled bearer , priority 0 [ 768.109200][T25493] syzkaller0: entered promiscuous mode [ 768.128553][T25493] syzkaller0: entered allmulticast mode [ 768.135080][T25493] tipc: Resetting bearer [ 768.156335][T25380] bridge0: port 2(bridge_slave_1) entered blocking state [ 768.180441][T25380] bridge0: port 2(bridge_slave_1) entered disabled state [ 768.195617][T25380] bridge_slave_1: entered allmulticast mode [ 768.204074][T25380] bridge_slave_1: entered promiscuous mode [ 768.315278][T25482] tipc: Resetting bearer [ 769.753822][T19131] Bluetooth: hci3: command tx timeout [ 771.768997][T25482] tipc: Disabling bearer [ 771.781179][T25380] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 771.794024][T25380] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 771.811738][T25521] vlan2: entered promiscuous mode [ 771.817691][T25521] veth0: entered promiscuous mode [ 771.827330][T19131] Bluetooth: hci3: command tx timeout [ 771.864193][T10162] tipc: Node number set to 1407928643 [ 771.942229][ T5000] udevd[5000]: worker [20354] /devices/virtual/block/nbd8 timeout; kill it [ 771.968804][T25538] __nla_validate_parse: 12 callbacks suppressed [ 771.968825][T25538] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6275'. [ 771.977970][T25380] team0: Port device team_slave_0 added [ 771.997253][ T5000] udevd[5000]: seq 26095 '/devices/virtual/block/nbd8' killed [ 772.050203][T25380] team0: Port device team_slave_1 added [ 772.170280][T25544] netlink: 'syz.2.6277': attribute type 1 has an invalid length. [ 772.189229][T25544] netlink: 260 bytes leftover after parsing attributes in process `syz.2.6277'. [ 772.206095][T25544] bridge0: port 1(bridge_slave_0) entered disabled state [ 772.217801][T25380] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 772.237060][T25380] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 772.273988][T25380] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 772.293728][T25380] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 772.301717][T25380] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 772.340937][T25555] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6280'. [ 772.351886][T25380] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 772.404775][T25558] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6282'. [ 772.580328][T10164] IPVS: starting estimator thread 0... [ 772.601455][T25568] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6286'. [ 772.624635][T25552] syzkaller0: delete flow: hash 4171723113 index 2 [ 772.640693][T25380] hsr_slave_0: entered promiscuous mode [ 772.646175][T25569] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6285'. [ 772.647797][T25380] hsr_slave_1: entered promiscuous mode [ 772.663006][T25380] debugfs: 'hsr0' already exists in 'hsr' [ 772.669160][T25380] Cannot create hsr debugfs directory [ 772.675698][T16836] syzkaller0: tun_net_xmit 76 [ 772.680833][T16836] syzkaller0: tun_net_xmit 48 [ 772.686964][T25568] bridge0: port 2(bridge_slave_1) entered blocking state [ 772.694108][T25568] bridge0: port 2(bridge_slave_1) entered forwarding state [ 772.696021][T25566] IPVS: using max 28 ests per chain, 67200 per kthread [ 772.702020][T25568] bridge0: port 1(bridge_slave_0) entered blocking state [ 772.715937][T25568] bridge0: port 1(bridge_slave_0) entered forwarding state [ 772.724936][ T8471] syzkaller0: tun_net_xmit 76 [ 772.731440][T25568] netlink: 52 bytes leftover after parsing attributes in process `syz.2.6286'. [ 773.908475][T19131] Bluetooth: hci3: command tx timeout [ 774.869061][ T30] INFO: task udevd:20551 blocked for more than 143 seconds. [ 774.877812][ T30] Not tainted syzkaller #0 [ 774.882827][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 774.891890][ T30] task:udevd state:D stack:23400 pid:20551 tgid:20551 ppid:5000 task_flags:0x400140 flags:0x00080000 [ 774.904470][ T30] Call Trace: [ 774.908274][ T30] [ 774.911262][ T30] __schedule+0x1821/0x5740 [ 774.916132][ T30] ? irqentry_exit+0x218/0x8b0 [ 774.921372][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 774.927796][ T30] ? __blk_flush_plug+0x416/0x4d0 [ 774.932868][ T30] ? __pfx___schedule+0x10/0x10 [ 774.937969][ T30] ? schedule+0x90/0x360 [ 774.942255][ T30] schedule+0x164/0x360 [ 774.947147][ T30] schedule_timeout+0x158/0x2c0 [ 774.952082][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 774.958089][ T30] ? __pfx_process_timeout+0x10/0x10 [ 774.963420][ T30] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 774.969672][ T30] ? prepare_to_wait_event+0x436/0x480 [ 774.975320][ T30] nbd_queue_rq+0x857/0x1100 [ 774.980570][ T30] ? __pfx_nbd_queue_rq+0x10/0x10 [ 774.986443][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 774.991563][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 774.998269][ T30] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 775.003870][ T30] ? sbitmap_get+0x229/0x390 [ 775.009222][ T30] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 775.015261][ T30] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 775.021247][ T30] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 775.028337][ T30] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 775.035167][ T30] ? blk_mq_hw_queue_need_run+0x13c/0x680 [ 775.041407][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 775.046952][ T30] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 775.052972][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 775.059012][ T30] blk_mq_run_hw_queue+0x348/0x4f0 [ 775.064154][ T30] blk_mq_dispatch_list+0xd16/0xe10 [ 775.070055][ T30] ? bdev_count_inflight+0x1cf/0x210 [ 775.075582][ T30] ? blk_mq_dispatch_list+0x1e0/0xe10 [ 775.081061][ T30] ? __pfx_blk_mq_dispatch_list+0x10/0x10 [ 775.087295][ T30] ? rcu_is_watching+0x15/0xb0 [ 775.092090][ T30] blk_mq_flush_plug_list+0x48d/0x570 [ 775.098615][ T30] ? blk_add_rq_to_plug+0x300/0x450 [ 775.103865][ T30] ? blk_mq_submit_bio+0x1acf/0x28e0 [ 775.109644][ T30] ? __pfx_blk_mq_flush_plug_list+0x10/0x10 [ 775.116543][ T30] __blk_flush_plug+0x3ed/0x4d0 [ 775.121574][ T30] ? __pfx___blk_flush_plug+0x10/0x10 [ 775.127505][ T30] __submit_bio+0x28d/0x580 [ 775.132340][ T30] ? __pfx___submit_bio+0x10/0x10 [ 775.137803][ T30] ? bio_associate_blkg+0x6d/0x230 [ 775.143150][ T30] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 775.149702][ T30] ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 [ 775.156561][ T30] block_read_full_folio+0x7b7/0x830 [ 775.161885][ T30] ? __pfx_blkdev_get_block+0x10/0x10 [ 775.167544][ T30] filemap_read_folio+0x137/0x3b0 [ 775.172634][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 775.179023][ T30] ? __pfx_filemap_read_folio+0x10/0x10 [ 775.184728][ T30] ? filemap_add_folio+0x356/0x530 [ 775.190618][ T30] do_read_cache_folio+0x358/0x590 [ 775.196082][ T30] ? __pfx_blkdev_read_folio+0x10/0x10 [ 775.201831][ T30] read_part_sector+0xb6/0x2b0 [ 775.207431][ T30] adfspart_check_ICS+0xb1/0x960 [ 775.212879][ T30] ? seq_buf_printf+0x212/0x2d0 [ 775.218763][ T30] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 775.225175][ T30] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 775.231078][ T30] bdev_disk_changed+0x817/0x1770 [ 775.236645][ T30] ? __pfx_bdev_disk_changed+0x10/0x10 [ 775.242147][ T30] blkdev_get_whole+0x380/0x510 [ 775.247718][ T30] bdev_open+0x31e/0xd30 [ 775.252152][ T30] blkdev_open+0x470/0x610 [ 775.256670][ T30] ? __pfx_blkdev_open+0x10/0x10 [ 775.262177][ T30] do_dentry_open+0x822/0x13a0 [ 775.267725][ T30] vfs_open+0x3b/0x340 [ 775.271988][ T30] ? path_openat+0x2df0/0x3860 [ 775.277268][ T30] path_openat+0x2e08/0x3860 [ 775.282135][ T30] ? __pfx_stack_trace_save+0x10/0x10 [ 775.287738][ T30] ? stack_depot_save_flags+0x33/0x810 [ 775.293268][ T30] ? __pfx_path_openat+0x10/0x10 [ 775.298907][ T30] ? __x64_sys_openat+0x138/0x170 [ 775.304009][ T30] ? __lock_acquire+0x6b5/0x2cf0 [ 775.309585][ T30] do_file_open+0x23e/0x4a0 [ 775.314156][ T30] ? __pfx_do_file_open+0x10/0x10 [ 775.319702][ T30] ? _raw_spin_unlock+0x28/0x50 [ 775.324613][ T30] ? alloc_fd+0x64b/0x6c0 [ 775.329520][ T30] do_sys_openat2+0x113/0x200 [ 775.334507][ T30] ? lapic_next_event+0x11/0x20 [ 775.339846][ T30] ? __pfx_do_sys_openat2+0x10/0x10 [ 775.345088][ T30] __x64_sys_openat+0x138/0x170 [ 775.350225][ T30] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.356901][ T30] do_syscall_64+0x174/0xf80 [ 775.361557][ T30] ? clear_bhb_loop+0x40/0x90 [ 775.366728][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.372647][ T30] RIP: 0033:0x7f38ef4a7407 [ 775.377136][ T30] RSP: 002b:00007ffedcdbc640 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 775.385982][ T30] RAX: ffffffffffffffda RBX: 00007f38efc7b880 RCX: 00007f38ef4a7407 [ 775.393980][ T30] RDX: 00000000000a0800 RSI: 0000556ec23d6860 RDI: ffffffffffffff9c [ 775.402453][ T30] RBP: 0000556ec23ca910 R08: 0000000000000000 R09: 0000000000000000 [ 775.410521][ T30] R10: 0000000000000000 R11: 0000000000000202 R12: 0000556ec23dde20 [ 775.419483][ T30] R13: 0000556ec23d8190 R14: 0000000000000000 R15: 0000556ec23dde20 [ 775.428044][ T30] [ 775.431211][ T30] [ 775.431211][ T30] Showing all locks held in the system: [ 775.439877][ T30] 1 lock held by khungtaskd/30: [ 775.444809][ T30] #0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 775.455066][ T30] 3 locks held by kworker/u8:9/3366: [ 775.460784][ T30] #0: ffff888031f0d140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 775.472548][ T30] #1: ffffc9000d457c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 775.486894][ T30] #2: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 775.496471][ T30] 1 lock held by dhcpcd/5295: [ 775.501165][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 [ 775.512291][ T30] 2 locks held by getty/5393: [ 775.518256][ T30] #0: ffff888036aaf0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 775.528728][ T30] #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 [ 775.539096][ T30] 3 locks held by kworker/1:12/8466: [ 775.544429][ T30] #0: ffff88813fe43140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 775.556635][ T30] #1: ffffc9000e217c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 775.568326][ T30] #2: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 775.578815][ T30] 3 locks held by kworker/1:14/8471: [ 775.584111][ T30] #0: ffff88813fe43140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 775.596401][ T30] #1: ffffc9000e257c40 (rx_mode_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 775.606793][ T30] #2: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_rx_mode_work+0x19/0x3c0 [ 775.616354][ T30] 3 locks held by kworker/u8:17/16836: [ 775.621826][ T30] #0: ffff88801ae84140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 [ 775.634727][ T30] #1: ffffc9000202fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 [ 775.645996][ T30] #2: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 775.656439][ T30] 1 lock held by udevd/20354: [ 775.661173][ T30] #0: ffff8880279ed350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 775.670754][ T30] 3 locks held by udevd/20551: [ 775.675764][ T30] #0: ffff8880277a1350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 775.685067][ T30] #1: ffff888026e18e18 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 775.695704][ T30] #2: ffff8880278c51f8 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc6/0x1100 [ 775.704897][ T30] 1 lock held by syz-executor/25380: [ 775.710364][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 775.719737][ T30] 2 locks held by syz.3.6281/25552: [ 775.725030][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 775.734989][ T30] #1: ffffffff8e962fa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 775.746570][ T30] 1 lock held by syz.1.6285/25564: [ 775.751691][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 775.761459][ T30] 1 lock held by syz.1.6285/25569: [ 775.766659][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 775.776223][ T30] 2 locks held by syz.2.6286/25568: [ 775.781497][ T30] #0: ffffffff90326de0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 775.791689][ T30] #1: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 775.800864][ T30] 1 lock held by syz.0.6287/25571: [ 775.806151][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bc/0x1e10 [ 775.816082][ T30] 1 lock held by syz.0.6287/25572: [ 775.821229][ T30] #0: ffffffff8fdc85c0 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x32b/0x1b30 [ 775.831012][ T30] [ 775.833399][ T30] ============================================= [ 775.833399][ T30] [ 775.845349][ T30] NMI backtrace for cpu 1 [ 775.845371][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 775.845392][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 775.845403][ T30] Call Trace: [ 775.845417][ T30] [ 775.845425][ T30] dump_stack_lvl+0xe8/0x150 [ 775.845455][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 775.845480][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 775.845503][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 775.845530][ T30] sys_info+0x135/0x170 [ 775.845549][ T30] watchdog+0xfd3/0x1030 [ 775.845584][ T30] ? watchdog+0x1c9/0x1030 [ 775.845616][ T30] kthread+0x389/0x470 [ 775.845650][ T30] ? __pfx_watchdog+0x10/0x10 [ 775.845675][ T30] ? __pfx_kthread+0x10/0x10 [ 775.845699][ T30] ret_from_fork+0x514/0xb70 [ 775.845722][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 775.845743][ T30] ? __switch_to+0xc79/0x1410 [ 775.845773][ T30] ? __pfx_kthread+0x10/0x10 [ 775.845798][ T30] ret_from_fork_asm+0x1a/0x30 [ 775.845837][ T30] [ 775.951898][ T30] Sending NMI from CPU 1 to CPUs 0: [ 775.957366][ C0] NMI backtrace for cpu 0 [ 775.957386][ C0] CPU: 0 UID: 0 PID: 11467 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT(full) [ 775.957405][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 775.957416][ C0] Workqueue: events_unbound cfg80211_wiphy_work [ 775.957452][ C0] RIP: 0010:__lock_acquire+0xb17/0x2cf0 [ 775.957471][ C0] Code: 14 92 0e 48 c7 c6 61 bc 0c 8e 67 48 0f b9 3a 90 48 bb eb 83 b5 80 46 86 c8 61 48 0f af dd 48 c1 eb 2d 48 8b 04 dd a0 f3 fc 93 <48> 85 c0 0f 94 c1 48 83 c0 f8 0f 94 c2 08 ca 0f 84 1c 01 00 00 e8 [ 775.957485][ C0] RSP: 0018:ffffc9000518f898 EFLAGS: 00000806 [ 775.957499][ C0] RAX: ffffffff944bb578 RBX: 0000000000057a1d RCX: 0000000000040000 [ 775.957511][ C0] RDX: 00000000aa67bd20 RSI: 00000000ebc161d4 RDI: ffff888031513e00 [ 775.957522][ C0] RBP: 9d7345180e85340d R08: ffffffff8aefea30 R09: ffff88806aaa0700 [ 775.957533][ C0] R10: dffffc0000000000 R11: fffffbfff2060f3f R12: ffff888031514a08 [ 775.957545][ C0] R13: ffff888031514a08 R14: ffff888031513e00 R15: 0000000000000003 [ 775.957556][ C0] FS: 0000000000000000(0000) GS:ffff88812528e000(0000) knlGS:0000000000000000 [ 775.957569][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 775.957580][ C0] CR2: 000055558eb234e8 CR3: 000000000e74a000 CR4: 00000000003526f0 [ 775.957596][ C0] Call Trace: [ 775.957603][ C0] [ 775.957614][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 775.957632][ C0] ? trace_hrtimer_start+0x82/0x200 [ 775.957653][ C0] ? cfg80211_wiphy_work+0xb4/0x460 [ 775.957674][ C0] ? cfg80211_wiphy_work+0xf0/0x460 [ 775.957693][ C0] lock_acquire+0x106/0x350 [ 775.957708][ C0] ? cfg80211_wiphy_work+0xf0/0x460 [ 775.957730][ C0] ? process_scheduled_works+0xa70/0x1860 [ 775.957746][ C0] ? rcu_is_watching+0x15/0xb0 [ 775.957765][ C0] _raw_spin_lock_irq+0x3d/0x50 [ 775.957784][ C0] ? cfg80211_wiphy_work+0xf0/0x460 [ 775.957803][ C0] cfg80211_wiphy_work+0xf0/0x460 [ 775.957822][ C0] ? process_scheduled_works+0xa70/0x1860 [ 775.957836][ C0] ? process_scheduled_works+0xa70/0x1860 [ 775.957852][ C0] process_scheduled_works+0xb5d/0x1860 [ 775.957877][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 775.957895][ C0] ? assign_work+0x3d5/0x5e0 [ 775.957911][ C0] worker_thread+0xa53/0xfc0 [ 775.957936][ C0] kthread+0x389/0x470 [ 775.957954][ C0] ? __pfx_worker_thread+0x10/0x10 [ 775.957969][ C0] ? __pfx_kthread+0x10/0x10 [ 775.957987][ C0] ret_from_fork+0x514/0xb70 [ 775.958004][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 775.958024][ C0] ? __switch_to+0xc79/0x1410 [ 775.958045][ C0] ? __pfx_kthread+0x10/0x10 [ 775.958063][ C0] ret_from_fork_asm+0x1a/0x30 [ 775.958086][ C0] [ 776.240954][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 776.247881][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 776.257200][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 776.267374][ T30] Call Trace: [ 776.270662][ T30] [ 776.273612][ T30] vpanic+0x56c/0xa60 [ 776.277599][ T30] ? __pfx___schedule+0x10/0x10 [ 776.282546][ T30] ? __pfx_vpanic+0x10/0x10 [ 776.287041][ T30] ? nmi_trigger_cpumask_backtrace+0x1f4/0x300 [ 776.293205][ T30] panic+0xc5/0xd0 [ 776.296923][ T30] ? __pfx_panic+0x10/0x10 [ 776.301335][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 776.306701][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 776.312850][ T30] watchdog+0x102c/0x1030 [ 776.317182][ T30] ? watchdog+0x1c9/0x1030 [ 776.321602][ T30] kthread+0x389/0x470 [ 776.325684][ T30] ? __pfx_watchdog+0x10/0x10 [ 776.330357][ T30] ? __pfx_kthread+0x10/0x10 [ 776.334952][ T30] ret_from_fork+0x514/0xb70 [ 776.339547][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 776.344774][ T30] ? __switch_to+0xc79/0x1410 [ 776.349485][ T30] ? __pfx_kthread+0x10/0x10 [ 776.354159][ T30] ret_from_fork_asm+0x1a/0x30 [ 776.358948][ T30] [ 776.362573][ T30] Kernel Offset: disabled [ 776.366909][ T30] Rebooting in 86400 seconds..