last executing test programs: 1m3.793863221s ago: executing program 2 (id=3474): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000e40)=[{&(0x7f0000000e80)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000000000000002", 0x54}, {&(0x7f0000000f00)="14a3db2a", 0x4}], 0x2) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000001240)={0x0, 0x7ffffffe}, 0x8) sendto$inet6(r0, 0x0, 0x0, 0x24060404, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @empty}, 0x4}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000e9ffff470000002c41000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd3641130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce7400dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f000006a10f58fa645335000000000000000a0000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08e774c48785f895b4ec8d11410500000000000000f6027bf48cabecead649f96ea24d32872c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe94ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d263e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000380f00000000895ddbb76122bf222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd311a40030f9ffce75ffff996a80153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c015dd026fd0fffe3c66f5c343afb78a7cfd852f3e05c089887d7df2ff4f9982030019421af6b78ff9c444a17091875cfe4eab0e7f50eb69c860b1613a6b4f5af04f9c635d8d646c89f8b85f820ce7464c731deba39f9ff7b815f7b0acba754c01ed8bf1bba0010a8c6a2b966d861f9dd547abf2e9b23e5607f00f80b58fd76e4bc46c84799aa792cdaeb6cfb858e577dacff607ba513250e13ae696cd6ed7d318190a93b9ee07927efca6b8d1f5980994690bbe002db5146439d906a0d4aef065214b15666cdca81091b69acee2c7ce0821fc19e0891f0b53469f935c5ac420100010000000000fb53faf4420638489e6a1c696d8c414a87b60000000000080000b6be1557951854c01dbc2d061827ae6349a045b780893771524a424335b9fc34616ee9f09141057262530b7c2f7c9b969938779736ece7b470078ac0b1b4b528000000009866e9994ca9096672ec9f3800c2fc35ba6516e542624c47bdba76a816c3a3dd6c3fa87a3ec91df199a9af91a7babf2b8d0e7b77e6dfb4bbc9817847b705000000a1000000000000ab8353f3800f045b90b0eaab6d731199c9447eabbc8c740183aff5389742e47de5000000826a570d143107006b9419c2b6353fcf2ae3366ebdb7f1000000000000333c00e6addbf4c71ffad6bfb5babb49109f92a5a52042c425190a6e3f1a8a3abfe6059da9c952cf35c98ce7616355493d280f2d0be99e18fd0900c769e7eb4edc1c03a33676590bd2047229e0237c1e34641848531712ff09e89fb062a3e66f4fced0ae679733830039cb61ea0691f0b4e0b33194404e643243c3841e1e7fe301f7f47a7f89512d92e83624e3de705bdfbfd0e5e381398e9d5428a00cc8a6d097d97e6ac8bd09b1a5577920a650114a522c1e2dcdc4f606fcbcee91770a9fada34d38cd7976a9228a0a0dd8661be8162e966aac26bea4c11458cd6ce22ddf7054cdd0a60ef3ec000000000000000800425cb75dc7ec92e9a5d29f9c99697d2a98ae0a9f35e4196c3faeb7a60a0290bf897846f6f0f1c163d6075119169d55d10da9ad0e4b2c636d200000009baaf94e2b2c48e70d8453f832eecfb1de2a3f38a5c986de9e37737dac74db251d5e9ea2b8ed39e91a7a17d01b49f7aaff7c4c73c3484bdcab362838ed940035b239a3646ef55b9f210ae14466b3acef9f8b28fb938a237e2e068ae4a6bce4407b54cc14614c2cdf877f00000000c4c2566179b9043a48da00000000003f000000cf23144e6c16b9235552aed83b6428f34d88c258a9ad16386bba51b60838fb11bc193a206b5a25b7233b222e4e68e0d1e88f26b9a45b6c29469530a37ea92aaf421cdcc1f594ecfaff9a79b56f8b38038002d29b3193cea9cd0a0ef4f58fa48f61071f548d411353965615c24c1860fd0dfae0f4cdf8c8f8645a289a79f9b919b674f0325d81eacaa8399324a304885da01733bb7917ec5e52718eb05f9c1ffd69f834150e9100c215968e8fb31c83526e6f66897569e28d01ca6135a2acca398c1415e0f9b58b63ee9dc33608ba7e5c4bdf3f37d8e4f4f424be263d9c2a5204f41e9b0ee01ad4cc0519395b69c310c98d3c8edc7d07b30617f3535634257f5472d9f3263a6f04778a920c12000721bb82f9884780ac294b8ba9778289c19fb775514246159bbfa9dc0fdf711d3efa316a3323c915a40e6d7c8f8d7daf98824fd0bc955dc9731cc8c7a600d94b8049af764688c7ffdd26a741b03b065ba9c586914d8beb94c8a265ace34172ed003357ddd400557230b2caba00000000000000ce4801461c36b5f430dc67f3759c367c43398cdfd550bcbb"], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000a80), 0x57, 0x10, &(0x7f0000000ac0), 0xffffffffffffffc9}, 0x48) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000c40)={0x2, 0xfffffff7}, &(0x7f0000000c80)=0x8) setsockopt$inet_sctp6_SCTP_REMOTE_UDP_ENCAPS_PORT(r0, 0x84, 0x84, &(0x7f0000000cc0)={r2, @in={{0x2, 0x4e21, @multicast2}}, 0x4e24}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="0a00000004000000080000000f00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000008000"/28], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000d80)={r3, 0xffffffffffffffff}, 0x4) close(0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="23000000080091aa02000000b549340dc0", @ANYRES16=r4], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001140)={0x6, 0x21, &(0x7f0000001000)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x1}, @map_fd={0x18, 0x7, 0x1, 0x0, r3}, @func={0x85, 0x0, 0x1, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @call={0x85, 0x0, 0x0, 0x5f}], &(0x7f0000001880)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) socket(0x2c, 0x3, 0x0) close(0x3) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) socket(0x28, 0x801, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000f40)={0x12, 0xf, &(0x7f00000018c0)=ANY=[@ANYBLOB="180800001fffffff004c93030000001c110000c7b9d1777df955dcccd99e0fa9ce327e21226e8a213d79941e157c815ea608279bcf7b72f8a2825af33f61f072c1c8d6480b73f241c47cfa4f67c53105479e86151d69f159155ee30e9b8511c30f9555883f6d1493fffa0c89833058146dc9368f8c5708a035bfc7c16174a09c67fc807db869693093f17d722ced8a105a9737304bed11796f08c6fae7a735eb06629a96f0ad2ded12c0f510d11bcdf17682e42676a69841435b6b27eb737c8367f09a70c2d847d2c14c47e240cbe8b7ba212f1ea8d84aee73762270cf3bf401c95d1d6d3d63f28389d18605c496", @ANYRES8=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf9100000000000076080000000000008500000085000000b7000000000000009500000000000000"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x25, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000001280)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3c8, 0x290, 0x290, 0x328, 0x98, 0x98, 0x420, 0x420, 0x420, 0x420, 0x420, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0xfffb, 0xfff8}}}, {{@ip={@multicast2, @rand_addr=0x64010102, 0xff, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {0xff}, {}, 0x16, 0x2, 0x4}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@local, @rand_addr=0x64010100, 0x0, 0x0, 'tunl0\x00', 'vlan0\x00', {}, {0xff}, 0x32, 0x2, 0x57}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x62, 0x1}}}, {{@uncond, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x1, 0x40, 0x2}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x4, 0x4, 0x1, 0x3, 0x7, 0x2], 0x3, 0x6}, {0x4, [0x0, 0x0, 0x0, 0x2, 0x0, 0x6], 0x4, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000016c0), r8) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000001780)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0b062dbd70000000000030000000050035000700000005003300030000000a0001007770616e30000000050034000e000000050036000100000008000200", @ANYRES32=0x0, @ANYBLOB], 0x50}}, 0x0) bind$inet(r7, &(0x7f0000001800)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000001840)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r7, &(0x7f0000001880), 0x800001d, 0x0) 1m3.467682783s ago: executing program 2 (id=3477): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, &(0x7f0000000700), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@ah={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x400000, &(0x7f0000000080)={@align=0x4, {0x2, 0x1000, 0x80, 0xfff}}, 0x9, &(0x7f0000000140), &(0x7f0000000180)=0x8}) sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000280)={&(0x7f0000000740)=ANY=[@ANYBLOB="cd7722c7d1be0c7361dc309369aba00ce4c6c06a68c9184f0bec5d54fef56c7d6457fb199bd5d17d873877927120bcc98730d24c972eb8432393ec6c5365bbab9e42e47526e7846ea695", @ANYRES16=0x0, @ANYBLOB="00012dbd7000fddbdf2500000000080009000200000008000700", @ANYRES32, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x840}, 0x20004810) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x28, 0x1040, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) r3 = socket(0xa, 0x3, 0xff) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x1, 0x4, &(0x7f0000001c00)=ANY=[@ANYBLOB="1800000029ffffff00000000f9ffffff91115e000000000095"], &(0x7f0000001c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000001c80)={'ip6tnl0\x00', &(0x7f0000001cc0)={'syztnl1\x00', 0x0, 0x4, 0x7, 0xf5, 0x7, 0x1, @mcast1, @dev={0xfe, 0x80, '\x00', 0x18}, 0x8000, 0x20, 0x7, 0x4}}) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000001d40), 0xffffffffffffffff) r8 = socket$inet(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r8, 0x0, 0x81, &(0x7f0000001d80)={'nat\x00', 0x0, 0x0, 0x4, [0x2, 0x80, 0xffffffffffffffc0, 0xfff, 0xfffffffffffffff7, 0xd], 0x600, 0x0, 0x0}, &(0x7f0000001e00)=0x108) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000001e80)={&(0x7f0000001ec0)={0x14, r7, 0x313, 0x70bd2a, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20040800}, 0x8000) connect$bt_l2cap(r5, &(0x7f0000001f00)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000001f40)={r5, r5, 0x9, 0x0, 0x0, 0x9, 0x89, 0x6, 0x5508, 0xa35, 0x1, 0x1, 'syz0\x00'}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002000)=@bpf_lsm={0xd, 0x5, &(0x7f00000020c0)=ANY=[@ANYBLOB="750a00000000000061111400000000001800"/29], &(0x7f0000002100)='GPL\x00'}, 0x94) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000002140)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000002180)='cdg', 0x3) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r10, 0x8933, &(0x7f00000021c0)={'batadv0\x00', 0x0}) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000002200), r10) sendmsg$BATADV_CMD_SET_HARDIF(r10, &(0x7f0000002240)={0x0, 0x0, &(0x7f0000002280)={&(0x7f00000022c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010027bd7002fbdbdf251000000008000300", @ANYRES32=r11], 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000002300)={0x0, 0x0, &(0x7f0000002340)={&(0x7f0000002380)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0xb3}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000002400), r2) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) 1m3.192801473s ago: executing program 2 (id=3484): openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40a01, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000090000000500000004"], 0x50) unshare(0x20000400) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={&(0x7f0000000100), 0x0, 0x0, 0x0, 0x3, r1}, 0x38) getsockopt$inet_opts(r0, 0x6, 0x4, 0xffffffffffffffff, &(0x7f0000000000)=0x4b) r2 = socket(0x10, 0x803, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400ff2340834b80040d8c560a067f0258ff0000000000000006000000000000005f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090810ee0000408c56040000", 0x58}], 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000002d0007012bbd7000fbdbdf250a7c0000109f3e250be1bd9ad5bbfb0051d5d8a1d01658656dc404d1e6db4a54ea205277fad4d253e09842777c6d18046424ca02e740fbfd13365683e8849f264427dd6345c675b149c4a84939034243"], 0x14}, 0x1, 0x0, 0x0, 0x20048024}, 0x4008030) connect$unix(r4, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000380)={0x40000004}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r3, &(0x7f00000003c0)={0xa0000001}) ppoll(&(0x7f0000000400)=[{r8, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r5, &(0x7f0000000440)={0x4}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000203000000000000000100010000000900010073797b300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004044) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000006c0)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x0, 0xffe1}, {0xb, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=@newtfilter={0x70, 0x2c, 0xd2b, 0x70fd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x44, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth1_to_team\x00'}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xffc, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}, @TCA_U32_LINK={0x8}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084) r11 = socket(0x2b, 0x1, 0x1) connect$inet6(r11, &(0x7f0000000900)={0xa, 0x4e22, 0xffffffff, @ipv4={'\x00', '\xff\xff', @empty}, 0x2}, 0x1c) 1m2.312335502s ago: executing program 1 (id=3494): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) getsockopt$CAN_RAW_JOIN_FILTERS(r0, 0x65, 0x6, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001214100026bdf000fcdbdf25080003000000000008000100000000000800030000000000"], 0x28}, 0x1, 0x0, 0x0, 0x48000}, 0x8080) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x10c, 0x24, 0x4ee4e6a52ff56541, 0x2000, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x7, 0xffff}, {0xffff, 0xffff}, {0x10}}, [@TCA_STAB={0xc4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x73, 0x6, 0x1fa, 0x2, 0x2, 0x2, 0x3}}, {0xa, 0x2, [0x100, 0x2, 0xc]}}, {{0x1c, 0x1, {0x1, 0xe, 0x1, 0xabda, 0x0, 0xb, 0x9}}, {0x4}}, {{0x1c, 0x1, {0x4, 0x3, 0x9, 0x715, 0x1, 0x10, 0x9, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x6, 0x1, 0x8001, 0x1, 0x2, 0xfffffff8, 0x6, 0x6}}, {0x10, 0x2, [0x2, 0x4, 0x8, 0x2, 0xd955, 0x800]}}, {{0x1c, 0x1, {0x0, 0xe, 0x9, 0x8d, 0x1, 0x1, 0x3, 0x3}}, {0xa, 0x2, [0x8, 0x4, 0x0]}}]}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa7, 0x0, 0x0, 0x0, 0x0, 0x1, 0xb}}, {0x4}}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x8080}, 0x20008085) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) vmsplice(r1, &(0x7f0000000680)=[{&(0x7f0000000240)="e4bf5f073b08006e3796c7f42cc249", 0xf}, {&(0x7f0000000500)="b77559dfb25c90afc148cd980014475ee8d73233a9a15689da81b2ce660b09cc6f677e51dc5654d998c6bfaaf48d1bc0b90ba6b357cc897dc06c8b794a4f90359e467c0b3d484a15bbe4aff4475699269c867c9c0c602939986b6b8ade71833c40951300fdde86e4cbb9546a5805ebc49a16004a512f304614491e11197d518f4723406ea17503ed23def3a4cf4bd7b7cb23500f6864c38098cb179506d381dff5250f46c5a2ed1f5e5664583be10f96880ad235b1fccdaaf2d933cdcbab671818adfbfe294103910be98eaef4621650043942a2b3f30b53b48c51d4", 0xdc}, {&(0x7f0000000600)="3062a62429c9edaeebac300e27776ab4347c1d211b5dd5c60cf44190f75c24d0729ffcf377f20f0486e5db3dc3b863ccc416fd5f048813f20cc0d56194efcf445800c53fa4ad1e23c407b84a", 0x4c}], 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r4, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0xf, 0x4b}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x801) 1m2.206008561s ago: executing program 4 (id=3495): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000000100)=0xffffffff, 0x4) sendto$inet6(r0, &(0x7f0000001d40), 0x0, 0x24000045, &(0x7f0000001d80)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) 1m2.143425243s ago: executing program 1 (id=3497): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000440)={'syzkaller0\x00', 0x2}) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, 0x0, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) writev(r2, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_opts(r3, 0x29, 0x3b, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b00)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x5, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ffd, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x7a}, @call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (fail_nth: 3) 1m2.11117027s ago: executing program 4 (id=3498): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=@newsa={0x138, 0x10, 0x633, 0x70bd2a, 0x0, {{@in6=@local, @in6=@mcast1, 0x0, 0xfffd, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x4}, {@in=@multicast1, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0xfffffffffffffffd, 0x40000000000, 0x0, 0x2dcd, 0x3, 0x4000}, {}, {0x0, 0x4, 0x3}, 0x70bd25, 0x0, 0xa, 0x4}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x24000084}, 0x0) 1m2.025055568s ago: executing program 3 (id=3499): r0 = accept$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$INCFS_IOC_READ_FILE_SIGNATURE(r0, 0x8010671f, &(0x7f0000000080)={&(0x7f0000000040)=""/51, 0x33}) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000140)={@mcast2, 0x0}, &(0x7f0000000180)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000001c0)={'batadv0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'ip_vti0\x00', 0x0, 0x80, 0x8068, 0x401, 0xd2e, {{0x9, 0x4, 0x2, 0x28, 0x24, 0x67, 0x0, 0x2, 0x29, 0x0, @remote, @empty, {[@timestamp={0x44, 0x10, 0x35, 0x0, 0x2, [0x5, 0x3, 0x7]}]}}}}}) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xd8, r1, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [{{0x8, 0x1, r2}, {0xbc, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xe}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2d}}, {0x8, 0x6, r3}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r4}}}]}}]}, 0xd8}, 0x1, 0x0, 0x0, 0x4000}, 0x9000) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, r6, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {}, {0x18, 0x17, {0x9, 0x0, @udp='udp:syz2\x00'}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$inet(r5, &(0x7f0000001680)={&(0x7f0000000580)={0x2, 0x4e24, @broadcast}, 0x10, &(0x7f0000001600)=[{&(0x7f00000005c0)="d3eaa665a00168b48073f85b63a205592a310a1613c76e7c1e6cbbb7a73ad72c3a67659aacdbc25d134fada569ea10ceed37195587ed9fb75c56e97491b6002288d57f2c65876cac1d59565788ff362e833ce76b420a81204e5e8a24d672fe629d999d8cb10f415f08993a0741bb12d724d037c4444b36b2d15ddcedeaf70934ef8f6c7634052aa7fab01bd0503ec7a486937850eb9df267bbb9aeab608aaddd0b8a481253af17aa538800e7b759e51225868d12191043564c2190aa067555dd17191fcca3628f8cbd532880bdfa42ae474a023bf0a56f51486b4fcbc4ed6479e6e6115df0e5ff8e815d8b54be5bfca046dd57c56cdcf3417d2b42424e739cf2efba709b3d37c5f9e78670ae542fb43c9467d050ad0cb451fbbc10b5eff244b53d52769b779ece87e0f5b1ca50a0c96b5c87f116dfa69a51d5c4478323514c2645686ef67398f5d8f70d7626e3572f6cedbdbea5317c57c1bb5581d5f3a569467d3b0385ec0ac5297844c4a071fa903e35ac740f4f9f1651f0ad3e0bc26688e6742dcb096be8c773b94fa3d05a4cb4ee9d73c7410c990069ae4a28b2f0326819c2eeaa3c3ad2b42212feb43977cb7db870d6943a36e0d1df0accd82f48ac836f5425c0a0b7eecc86513079b843a8359a469187257434c84b3a44ff988e1bf941652e0597f05cb4fbfea9f8979451a9a948c5e6181c2f06f47d74b4d591bc256ef4b52dd62a8fdc04e139086495045c27eee1c532c2367423dd6d48865d1cbc2238ff879eb9bed43f9bd6bda4d17336e0bdcf793ade90e5801cbc67f74235054ac128d63d00f62b6d8c0365d9d8c32ddca8fed37c01f4c2a3462073db7b5fac035694225fa79931d834b4b0e478f8fe94788751164c5a87e39534fc6cdb4927cba69b4720eb12fc29a09d53a7f6d334761d8d8253f60ba024caa2c335865b6f3cc41ca02cc979461dc204a1b0b22761eb55a959ec47bbf302809c238aab752e1b520e62464a7840da7844d419ea5b84a7408ce904eceda09ee32d1e64b04ddd2429b307bc2b9edbc2fc561550d656c07fd4de7ff035e2c36fb4ad555921412fb53390d73ac834d95a7d7d5c6c2f77ce4af481c747e76de5282671e30ed9ebe173410dad699552c2317605ed0580a0cb046d3b3b774329101daaeba2819135ec1cc6cf2c6a20de1e67dda81125533ed54b2719ed421af437a898cf46b44c75b51c96189a11b4c6eea929b7cec70a309c406a27e5d06b5ceb2d944569a0d7bcad3ce6ef22c9b51ae267d947fe4d0ca5b5835297b126c78564d2ede82177f842fa7ade8b83f5ebece4973140c8a78cb6c75cfa82c2d2a9213a027343da95561c6dde26592f46f70ce56c47453d94843cb364c7c61eb2e560c93087b75096807341f8d50b9555edb36159ed87fe78b1643b7a98f0f514562b078a0c240905823f6f836e7f1abac3e904d66d68e6cd249ffaa08bc8cb0d1b9913e32755ada519b2e62370b4227e35b4f33659a02a27b70e852804c933229d5d9efd76769e7c217ae1313273d22bd3f8240ec7a38337d23bdf35e2ade7499926d39cdc927da2e178adca0055ef18d2f6f819e2a033dcb8a89da4fd5c4b5c4729e9cb17713d2be4c753d540f1c69f8f3f9b870451e93b130d9d6b0b6029015a9b9bff24403f408212ef76ab29d4b11df3f3f1d553c1f93a251ea279b20885eaad8f2bb8a51c440739b91ef11ce16a6cdaf96eb72328528d54b1e66578707ba07eef7aa044b219deac0759ff0fe709c4e28a69cedb5e466ab5e95e86575f8c618ed82bfbb1bc85d320a00097391dbf8d9d49ca8faed5bb2ce32bc52cc86b6276b7ec857391f3924252ba4daeed0f15865c748c28fb6f97009d5a26af5ab90e6cd552d7647704da749432afdc0c865ec079209a548bc675d3e2fab60fb264070d9767d9bb1dfca57902f013c5bae8af7d7381501939feac19b0c3a14cc89cd785b71e1f8ac6af0cc79a1cdeb2abc6e1af095b60d10577becbafcbc0117b6809c89f5d4673a7d27b70002a643a38ca4ae0790279a73566927f585d178f996cefa5559b8cc01c070d6ef042b5bb13c3bd4bd857b9e3866d2674a37a2345d6ed4dc658088eb320c4000e3b9198d58842269682e6c8c29f91bfbf942f5af0b136af8f29b47752f05257896430c8ea0a4d4b784526096bc458493b9a7d9a82590bc6e1c7a0bc0e69432cd89ac2521f5c0e626e5b2333cab02678cef5b68214cca0f5764f8cfb437892ef0b42962f3244afa7c2cd2f405f62f0b53eb00ecba0d220dd8ac8042dbe5d9149b4426569352a6c27f1126dd542a1ea214473a27cdc91c803499056a8a6c6de175f00d433566e47d18c79ed77bfb5ed671b4cc221a8e5cd633e4d07d1d66f819939ace0fe34e4a63c02edae24e9f6dea5b750350c1221816370b315df0b24d7480b2c225e6c7fb13ee59e6e7e2df3f8c0b60b953f1206700ae635a46e2b20b251eec779ba150b757c8c61df0cdf9d5bd70daca69df8ff8a9cc132810a0901df13d1ae0adb83c56353a2831a8acb13e98d7da807a97af38f38f90871deaf87095f83f5b96eb764c377a1db3557e037bbd180898127ca8fd8aee15ed6c4777cca0424d64fb592fcd665d700b85bd6a2bffca5f4a01c8792d010359af82bf11ce7c3d6dfb0a504bd91ad7bd49393db9419be2ddf089231a08ce2dedd97e06635342c73ffc1516aeba64e5fbd1d7fa3155edeb5b927838e107db3a7de5151efc49062fb4efc9f2d2f448edd5ee75b5d9ce5547b3463f0b098ebb4d469c76941e69b57a8a863fbc6fad0fed6f1032e1809d1f1f9cfce6e26095737f504bef945dc00bf5bd3ea47ebd8e71f1441957573a2df7e01b9888a357d153e1ce9a753b4b219ccd73710e1d6c2496a15c4ab294070935f6c2ec69a75efb409a83e0fdaa6d321587dbf5ec2bd3eb0db1150c154651cae7d03fd18fe45a5b18acfa969e978a437ca0c122157b00cb66e31c8279863083b899854304066c8ab658e8b780b4b29f94961d5bc8b26d4dd49565ca463ef4965235e537a32ff0f8373741c91a2fc1fc0f159ef3128ee3f03fb3e021161918cad02222a81d51d0ae11d9decb961f8350569204be959c83db73f80d61eb0b4df79cf120a199c714e0cce57e18ca6b9efe69997e09d981a1dbfddc7423f090b2b07e0cb4a243f8c8ffd198f2d9aaaf5f62130f1cd0324dd6edae3b1e37c7dae33441b0c1df4932db83c266c1c136ce5f53c182be2b8bc6edcba172cca0e914a9258d11c0c4422035725ba1d2aa3b64e17b89f8b8f8d3219262d9aa716bd3cce9f93d86413ff70c92e499610b5bfec74186d9c457db72e0abb213eebafb64987d47c4576b3af19573ba978a1b3d33099431c0c38a32fb405ca1b4ee8a915431e35b677f1687f377eb60dd651c73a53ebf8a9e91817c13297c386254eaa7471dab8f0417ada17fcb7c6eee55914c688de5c91d2d871df14d2f36fb81d56488f03b732aa5ec16870ec994eedda790110cd9ca350afc2b01d5902fb88a3eb75683ad2ad1379a072ce38a7009ebb5e23a63e3f587bdf8c9b8e2b33dd5dd7adad3dbf53d5d7ea185191355a2181c202356b413f953f6a09bd22c27147198554787109ca4ab74d8ed269545a908e81f3344f78e6ea007980070b1cd456fcac2159bcc01f08b26e5afeb33c705e239e65100219ce5feeab4f5aea48b14e5ed8a62b338f54966e56ce07edab20f93d2893026bfca1a1537c879485dba1a5be3d4cdd13a02ca2883bff3da4a3bad3c48cf883bc16408e34364f2b3c762e911e27121b9f6f9976ace6311607d7484d56cfb894ec161183fd549c32c7096e3520ad80ac299119e62a2609b146dc7e59fd44956193b9fd0194801b4d8f45c9e2a5497fddf05a32c002a32af5b02ddd7670a4348d7187fbc30702abc8600e3ca23ea1ccc0b533ec427aa56162b9980c507a49900ea573c5bdf623d37219cfec99a258e1b3e94bbb0ea74a83a52e70cf409efb11fa3160ef64e197ea26ed86143857d1c0fc407b7fc6b54b9dbf939a1aeee62a46cb4eb2e24ffa7f717edb2216530f061ae3be355dea6b0ca0e288a384d7ba7aec131028cc6dc2510f8b76c96637250836244dfd5472be5fc1a998dd015bc3e9e1032b2b59cc2e17c83157cbd1547bda4a34525baa18f24736bff56abfc5a2d3e6ff90b8dd36bb2a9e5f20c2f987390586021bc19256fab004b68902b3e6d6d481b0456dae261fce56bdb711f7cc42a75ad880c96f74f2fcff53cb45529f336c84d3c8e9031cd81a655c8c73b302c41a18a6672a783d3ee21aa78026fc21fb5268559f11c4bf1bec857534ad07c56dd09120115da6701bb88b435eb31dda741c59f18086ef0bbd6afaa1ff316c57e489707935030e03dd810ab95f9486b3f3b6f4663b80d4fba642e72bebc67878c593d7848ba287b93912d002b335449815123b8624fecb9d5475c9c2a5f9ea9e5d0ff35d1cdb7283ba512378e0d15af5b9193c869d33e855eb3e67cdc66c34fe08e5429dc34a340b3a88167c6dc729f4f3e1ea4c4e20ba98c442a22108a6b81e9e49ff198fe44f4c8d8a318c0b41bb37afcd08f1febd63e6d381458a922aa8712322b19551720f37621e0bfa6171e4bb593a2a17eec057a3ab42283cc9fad770c646882443625fb0020a316c34d5c109d27dae05bd79ad7591db14e1b1ee5c1dcf7cfe92e7b8f8efe5249dcc52b2060509033225d90e5e3af036051b882795c324f4f94a4bb346f1afe85fabcedca7dcfc1817e20130c7150588496bc89b37c455bf76a99928c24fa108a5a0c4f816f2c155a17df8515f7edc0d85ead1a0cfe6f1f6c625d1e00c73e7d81af833743a88996e0924bd0c3f541ba57811fef509b1c679157c021dfa9ea189fefb68e05a1a294fb1914fa59a2e8bab07f19e841b39fb0dc4a982ac0b26a564242ac48d7e73988a5c0f425c52119d9c15a8557278e13fe5f255ee532f2146952add6794866c5b0525dcc0ab3e3e4f2a5062c632c65f96a36f7d7298d94aebe1021ea689c07944ad4619dc20991bdaa16a522e2e5cfb0f587fcac74fd0a82595919de464d532f1502d44ff95df17bd3be255dd497f48ac64dbb2ef48835137f089d160dbc7c930a8c7c2344fd01f0c1445ec1f82df6cf714bf7f0c796e06f81f30c992c4bc3317bd1515bb5ee7dd3b267eda4ecbbd84c35375b3da9ec17a366851e39def7b44034ae847acc0ebcadde27a1a299fcc1e120ae83e28cc0f1dd5255fd7a584a8fd68bae051fcd618a0e188b4e9c2e0581fae01d33c33d75fd4415cadbb27e21d314c3794e9a74e49609b6f27ca24af2bdb828ce878ebb5df0c63c114f579b06731fa7b6c8f88d7a91b5fad62f0499c928e519da2e926f4b678c765a7be2aef27ba4081f0be9d2d319d8d8d030bc45fa75ec343c7d6fe2b6d27a50c2d7693ea650cc817497e882a35a4296b1f23c78dd6f854a2e57eb60ecd4136c93643c7c105d883d77bca7347ec2e935f2c52cb374b8e10b8cc0a2594ffd22a3d8079c2e08cb1e9a61a7cf8baefffe10c01e2b8eee28caf154ffcceb34dcd02d9f2d08d54d1c787f5794fc138d8b2b13b83da0b33b29f38fc9533fbf3b29ab23d8d48f7d07bc83729ecea6ff0e215a61f902773dd49fdbdde637a79be25b9a9862978e1d8d21a744f7ecc8d93553be1c6477f5cf7c90e28125c65c9b4c13138b6685a3e5e37c54a8cb0a6842b09fbb2dbd212ea83622dab10f86eac82754aa45da8cad1a3b6bcdd022ef28ec0234224ce564642", 0x1000}, {&(0x7f00000015c0)="c8042b736aa954d702b2b7c79843d340e91f530933503d0bc3bbb483e80bcca4f1ba", 0x22}], 0x2, &(0x7f0000001640)=[@ip_retopts={{0x28, 0x0, 0x7, {[@noop, @rr={0x7, 0x17, 0x90, [@dev={0xac, 0x14, 0x14, 0x2e}, @loopback, @dev={0xac, 0x14, 0x14, 0x29}, @dev={0xac, 0x14, 0x14, 0x3b}, @loopback]}]}}}], 0x28}, 0x40) (async) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001700), r5) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r5, &(0x7f0000001800)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000017c0)={&(0x7f0000001740)={0x68, r7, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x880}, 0x20000080) r8 = socket$igmp6(0xa, 0x3, 0x2) sendmmsg$inet6(r8, &(0x7f0000001f00)=[{{&(0x7f0000001840)={0xa, 0x4e20, 0x6, @local, 0xd91}, 0x1c, &(0x7f0000001b80)=[{&(0x7f0000001880)="0f7ad4aa299b4592234adc4bcfa063a59ae16d1482134556ec9c48611d6db0f21b95ea1f6513a1423384eb74d3032ed0d498e655e6a20b22990d2ba4b352e7f90b016d8c80b59671731e867575c25b105d5ff002d43f27f5911fe52054a62d1bb084741d6fcf8dd81b01620d9c140ae55e829e3dfc3071eb8d58882619f772a1b453ded8e636baa211cebcbf770acfc3d2272d9f39d3f7eecc1565e48be839c4914302bfc7270cb518217773c9ee4455fcd95031dba2fbc76275d2b474bc1d3bca54a9efffb1382555e1913ea94c07dab3697eccddfdd228437d4438b43c7dcdf51f2a762be551e675f26e9f87b6c2b78783e542", 0xf4}, {&(0x7f0000001980)="ba3aae8969e27d781d6ac80d0f7b9feb9bb2957de9d717ccf57684c57808d2661636da06ba4efe92f266bd2391e2d959889c16bf106549e01a9b6f6decd11ddb398506c4d493270c612012a3aa109b25f42e66b11d5f1f8ab8b1577da6e1c83c4dbf6d4f84eff4688505aa7c5c88003c9d83b2bc6212a9949167425d85b4eda26a65cc91", 0x84}, {&(0x7f0000001a40)="be36a40d5c12d28cdf190a6af3928f8ad83e6b1768734b901d012f31a1989bd15862729e32368367a311fb699391473351d1091a53a5fad40bc2891504bf7389b8c7200f97ff29054fc79e9fe9afab1db68219c02edec6e8d4245565424c109e6be03b50ca5ef33d7517c6a114b2", 0x6e}, {&(0x7f0000001ac0)="e81c03accea9d5cac0beb0bfc7afe1bfe86c0621f9f577417ec5b7f9589dae57ebb1b3a72e202e18832e335f6675380c10ba99db98d24f3d1140f93fc46b8d615ce0fb22c1646d5783e8138b186c531ca2cfa560b5164df952fda55d91a72c66cb747db27082c1ca59446c2dd17ba8139a338502a742265b60989cb91f245399036672befe70ce57293acb13dacfc39bb0265262", 0x94}], 0x4, &(0x7f0000001bc0)=[@hopopts_2292={{0x100, 0x29, 0x36, {0x23, 0x1c, '\x00', [@calipso={0x7, 0x30, {0x3, 0xa, 0x5, 0x1, [0xee71, 0x7fffffffffffffff, 0x0, 0x6, 0x100]}}, @generic={0x80, 0x7d, "6e1649be4c942f9af1dd1f27c502a61dbf6ad5f7991515808be6f31225b956e0613e0769ef0331ea2c412d2c85a09b5c7b262b1fc374f6b68be2e2362489b6f437bcc1bc38fd9cf13fa3f4976c6d15bbe921405aa2a7e059546d65c07109b27c13c07a3965b896a577818f8431f300e95b567c0b714ea7b653cc7556b3"}, @ra={0x5, 0x2, 0x3}, @calipso={0x7, 0x30, {0x2, 0xa, 0x6, 0x1, [0x3, 0x10, 0x8001, 0x9, 0x7fffffffffffffff]}}]}}}, @hoplimit_2292={{0x14, 0x29, 0x8, 0xe2f}}], 0x118}}, {{&(0x7f0000001d00)={0xa, 0x4e21, 0xfffff70e, @remote, 0x800}, 0x1c, &(0x7f0000001e40)=[{&(0x7f0000001d40)="d1dddfd8526ec67030343bbd7e85b2652fc2fe6f3a960bc37be65f3ebe2907b249dfe8ee429d91cc06b644b303ecb017f212f4548a890f92b31324a6d11f200fb4fb4713b9558c7f5b2a823e6be4a53281ba1794aac08bae42d3dc3a9f726bd5fc27abc0bdcdd4ec2e84407ec4bd49027815f8e7f597136fbb57cb59bc6103ebb8dd42dd47178bcb3d02e16e386890b57ea9d3a70c82a71d5d4e10449759f60bbd3e22a33755aa95d1775a28d91b237177127d351e63f58e1777aa47aedc7ea618cdebf9dfacee650bfa833cb1ae5c28f18bb04f28cb3df65759", 0xda}], 0x1, &(0x7f0000001e80)=[@rthdr={{0x68, 0x29, 0x39, {0x0, 0xa, 0x1, 0x2, 0x0, [@mcast2, @dev={0xfe, 0x80, '\x00', 0x31}, @mcast1, @remote, @private0]}}}, @rthdr={{0x18, 0x29, 0x39, {0x73, 0x0, 0x1, 0xa}}}], 0x80}}], 0x2, 0x24004080) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001f80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000001fc0)={{r5}, 0xe61, 0x4, 0x9}) (async) r10 = openat$cgroup(0xffffffffffffffff, &(0x7f0000002000)='syz0\x00', 0x200002, 0x0) r11 = openat$cgroup_subtree(r10, &(0x7f0000002040), 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000020c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r5, &(0x7f00000021c0)={&(0x7f0000002080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002180)={&(0x7f0000002100)={0x50, 0x0, 0x800, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x6, 0x79}}}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xa}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x3b}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2f}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x2d}]}, 0x50}, 0x1, 0x0, 0x0, 0x8810}, 0x8000) ioctl$XFS_IOC_EXCHANGE_RANGE(r0, 0x40285881, &(0x7f0000002200)={r11, 0x0, 0x3, 0x3, 0x9e, 0x4}) (async) connect$inet6(r8, &(0x7f0000002240)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x3}, 0x1c) (async) socket$unix(0x1, 0x5, 0x0) (async) openat$cgroup(r10, &(0x7f0000002280)='syz0\x00', 0x200002, 0x0) (async) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r10, 0xc038943b, &(0x7f0000002300)={0x2, 0x10, '\x00', 0x0, &(0x7f00000022c0)=[0x0, 0x0]}) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000002340)={0x1, 0xffffffffffffffff, 0x80000}, &(0x7f0000002380)=0xc) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r13, 0x84, 0x1b, &(0x7f0000002440)={0x0, 0x64, "967579f8b31ed46f8e4e8cbe10a105540757f8c0f21767b8f745454b9d18e21b161dd573006c4d886d0f8923ef89a2952465297aca76552b2a589f6cb7c7cd44468b5ae78fce422a14eb421c0a9c5c30d65ef303d7550c37567c8a23d98b307095e5f874"}, &(0x7f00000024c0)=0x6c) 1m2.014704923s ago: executing program 0 (id=3500): socket$unix(0x1, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x0, 0x0, &(0x7f0000000740)='GPL\x00', 0x4}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x4048890) bind$tipc(0xffffffffffffffff, &(0x7f0000000380)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, 0x0, 0x0) close(0x3) bind$tipc(0xffffffffffffffff, &(0x7f0000000340)=@name={0x1e, 0x2, 0x9d3354bba4295a8d, {{0x41}}}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv6_newaddr={0x40, 0x14, 0x101, 0x70bd26, 0x25dffbf8, {0xa, 0x38, 0x78, 0xff, r1}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x40}, 0x1, 0x0, 0x0, 0x4004051}, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x70bd27, 0x25dfdbff, {0xa, 0x8, 0x0, 0xff, r6}, [@IFA_LOCAL={0x14, 0x2, @loopback}, @IFA_CACHEINFO={0x14, 0x6, {0x2, 0x8, 0x6, 0xf76}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2004c040}, 0x0) (fail_nth: 7) 1m1.756921262s ago: executing program 2 (id=3501): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000100180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000280)=""/222, 0x0, 0x8}, 0x78) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cgroup.stat\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[], 0x10448) syz_emit_ethernet(0x72, &(0x7f0000000480)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private=0xa010101, @local, {[@cipso={0x86, 0x29, 0x3, [{0x6, 0xd, "5e000000ff000000f58700"}, {0x0, 0x5, "0404a6"}, {0x0, 0x11, "960605390006fff5800000b61af93a"}]}, @rr={0x7, 0xb, 0x57, [@rand_addr=0x64010101, @broadcast]}]}}}}}}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc0000001800018014000200"], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r2 = socket(0x2, 0x2, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r2, 0x11, 0x1, 0x0, &(0x7f0000000400)) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f00000003c0)={'dummy0\x00', &(0x7f0000000440)=@ethtool_rxfh={0x15, 0x2, 0xb22, 0x0, 0x7, "33e4a8", 0x8000}}) r5 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x2, 0x12) 1m1.662487506s ago: executing program 1 (id=3502): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000240)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000300)={&(0x7f0000000340)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000440)}, 0x0) recvmsg(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/227, 0xe3}], 0x1}, 0x0) 1m1.662092277s ago: executing program 0 (id=3503): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000008800f76f20d6b9657d49609e6f0878dcb8"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 1m1.565959742s ago: executing program 3 (id=3504): sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, 0x0, 0x4008054) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x9, &(0x7f00000002c0)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0x2f}, {0x7, 0x0, 0xb, 0x9}}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000380)=r2, 0x4) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000000), r3) sendmsg$NLBL_CIPSOV4_C_LISTALL(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x14, r4, 0x309, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x4040000) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_GET(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)={0x44, r7, 0x1, 0x0, 0x0, {0x53}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0x6}}]}, 0x44}}, 0x0) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000001800)=r2, 0x4) syz_emit_ethernet(0x4a, &(0x7f0000001980)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x5, 0x0, @dev, @private=0xa010100, {[@timestamp_addr={0x44, 0xc, 0x5, 0x3, 0x0, [{@rand_addr=0x64010101}]}, @ssrr={0x89, 0x3, 0x79}, @generic={0x83, 0x2}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(r6, &(0x7f00000017c0)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001780)={&(0x7f00000006c0)={0x14, r8, 0x1, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000014}, 0x20004061) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xd, &(0x7f0000000140)=@raw=[@generic={0xb7, 0x2, 0x0, 0x0, 0x2}, @generic={0x73, 0xa, 0x2, 0xffc0}, @generic={0x63, 0xa, 0x2, 0xffc8}, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x200000a}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000400)='GPL\x00', 0x1, 0x1000, &(0x7f0000000780)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000001840)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f0000001900)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r10, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c000000000008000a80"], 0x134}}, 0x0) r11 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000001b00), 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001bc0)={0x11, 0xd, &(0x7f0000001a00)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x7}, @ldst={0x3, 0x2, 0x6, 0x0, 0x7, 0x30, 0xfffffffffffffffc}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x5, 0x5, 0x0, 0xf}, @alu={0x4, 0x0, 0xd, 0x5, 0x9, 0xfffffffffffffff4, 0x10}], &(0x7f0000001a80)='GPL\x00', 0x5, 0x0, &(0x7f0000001ac0), 0x40f00, 0x4, '\x00', r10, 0x0, r11, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001b40)={0x3, 0x7, 0x9b8, 0xffffffff}, 0x10, 0x0, 0x0, 0x3, 0x0, &(0x7f0000001b80)=[{0x2, 0x5, 0x5, 0x6}, {0x0, 0x1, 0xb, 0x3}, {0x2, 0x4, 0x2, 0x3}]}, 0x94) sendmsg$kcm(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000740)='.', 0x1}], 0x1}, 0x0) 1m1.458202014s ago: executing program 1 (id=3505): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000001640)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000400)=0x4) ioctl$PPPIOCSMAXCID(r2, 0x541b, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001780), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000017c0)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000001840)={&(0x7f0000001880)={0x4c, r3, 0x1, 0x70bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x1}, {0xe}, @device_b, @device_a, @initial, {0x3, 0x9}}, 0xfffd, @val={0x8c, 0x10, {0x283, "726712ea1b02", @short="acf28009ddef7a20"}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20040080}, 0x28008004) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, 0x0, 0x41) setsockopt(r0, 0x84, 0x81, &(0x7f00000001c0)="0000000000000002", 0x8) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000240)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000280)=@assoc_value={0x0}, &(0x7f00000002c0)=0x8) r8 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x14, &(0x7f00000014c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007500000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000001580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000340)={r7, 0x2}, 0x8) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r11, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) recvmmsg(r11, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x88b1}], 0x1, 0x40000120, 0x0) setsockopt$SO_TIMESTAMP(r11, 0x1, 0x40, 0x0, 0x0) clock_gettime(0xfffffffffffffffc, &(0x7f00000000c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xc, 0xe, &(0x7f0000000500)=ANY=[@ANYRESDEC=r9], &(0x7f0000001340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001380), 0x8, 0x10, &(0x7f00000013c0), 0x10}, 0x94) connect$inet(r10, &(0x7f0000000480)={0x2, 0x4e22, @local}, 0x10) 1m1.397950625s ago: executing program 0 (id=3506): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fd}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x3, &(0x7f0000001880)=ANY=[@ANYBLOB="1800000005000000000000000000000095"], &(0x7f00000018c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000280), &(0x7f00000002c0)=r2}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182300", @ANYRES32=r3, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 1m1.389472743s ago: executing program 2 (id=3507): r0 = socket$kcm(0xa, 0x1, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x6, &(0x7f0000000140), 0x4) sendmsg$kcm(r0, &(0x7f0000000180)={&(0x7f00000001c0)=@l2tp6={0xa, 0x0, 0x3, @remote, 0x5, 0x3}, 0x80, 0x0}, 0x2600c055) 1m1.283213232s ago: executing program 0 (id=3508): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000000100)=0xffffffff, 0x4) sendto$inet6(r0, &(0x7f0000001d40), 0x0, 0x24000045, &(0x7f0000001d80)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) 1m1.270155126s ago: executing program 2 (id=3509): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, &(0x7f0000000180)=0x4, 0x4) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) sendmsg$nl_xfrm(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000a80)=@newsa={0x138, 0x10, 0x800, 0x70bd27, 0x25dfdbfc, {{@in=@dev={0xac, 0x14, 0x14, 0x21}, @in6=@dev={0xfe, 0x80, '\x00', 0x25}, 0x4e22, 0x4086, 0x4e21, 0x280, 0x2, 0x80, 0x80, 0x1, r2}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d5, 0x33}, @in6=@private1, {0xf172, 0x200, 0x261, 0x1, 0x37ca, 0x2, 0x2, 0x80000001}, {0x9, 0x6, 0x100000000, 0x10000}, {0x1, 0x5, 0x8000}, 0x70bd26, 0x3506, 0xa, 0x1, 0x6f, 0x85}, [@tfcpad={0x8, 0x16, 0x7}, @replay_esn_val={0x40, 0x17, {0x9, 0x70bd27, 0x70bd29, 0x70bd2a, 0x70bd2b, 0x6, [0x7, 0xd4b, 0x9, 0x201, 0x2, 0x0, 0x9, 0x2, 0x66]}}]}, 0x138}, 0x1, 0x0, 0x0, 0x40881}, 0x4004000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x4, 0x4, 0x4, 0x10005, 0x800, 0xffffffffffffffff, 0x7fffffff}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000980)={r4, 0x58, &(0x7f00000009c0)={0x0, 0x0}}, 0x10) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000a40)={r5}, 0xc) close(r6) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1f, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000b70800000c300000638af8ff00000000b5e5c6847800000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008000000000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000740)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) unshare(0x20000400) r8 = socket(0x8, 0x4, 0x3) bind$inet(r8, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000780)=ANY=[@ANYBLOB="4403000010000100feffffbffedbdf2500000000000000000000000000000000ac1414bb000000000000000000000000000103944e230007000080003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe880000000000000000000000000101000004c46c000000ffffffff000000000000000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000060000000000000000000000000000001f00000000000000ff0100000000000006000000dcffffff000000002abd7000043500000a0001fd2000000000000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0015005a07350003000000"], 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x16, 0x10, &(0x7f0000000640)=ANY=[], &(0x7f0000000680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000006c0)={r9, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) recvmmsg$unix(r1, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) sendmsg$NL80211_CMD_DEL_MPATH(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r10, 0x2, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040811}, 0x800) 1m1.218263918s ago: executing program 3 (id=3510): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)={0x20, 0x28, 0x1, 0x470fd2b, 0x25dfdbfc, {0x4}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x5}, @typed={0x4, 0x5}]}, 0x20}, 0x1, 0x0, 0x0, 0x24040050}, 0x24000080) (fail_nth: 2) 1m1.207142155s ago: executing program 0 (id=3511): openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40a01, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000090000000500000004"], 0x50) unshare(0x20000400) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={&(0x7f0000000100), 0x0, 0x0, 0x0, 0x3, r1}, 0x38) getsockopt$inet_opts(r0, 0x6, 0x4, 0xffffffffffffffff, &(0x7f0000000000)=0x4b) r2 = socket(0x10, 0x803, 0x0) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000180)="580000001400ff2340834b80040d8c560a067f0258ff0000000000000006000000000000005f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090810ee0000408c56040000", 0x58}], 0x1) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000002d0007012bbd7000fbdbdf250a7c0000109f3e250be1bd9ad5bbfb0051d5d8a1d01658656dc404d1e6db4a54ea205277fad4d253e09842777c6d18046424ca02e740fbfd13365683e8849f264427dd6345c675b149c4a84939034243771730"], 0x14}, 0x1, 0x0, 0x0, 0x20048024}, 0x4008030) connect$unix(r4, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000340), 0x318, 0x0) recvmmsg(r4, 0x0, 0x0, 0x2, 0x0) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r5, &(0x7f0000000380)={0x40000004}) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r3, &(0x7f00000003c0)={0xa0000001}) ppoll(&(0x7f0000000400)=[{r8, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r5, &(0x7f0000000440)={0x4}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000203000000000000000100010000000900010073797b300000000048000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000100075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}, 0x1, 0x0, 0x0, 0x24004005}, 0x20004044) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000006c0)={'veth0_to_hsr\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x0, 0xffe1}, {0xb, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x9}}]}}]}, 0x48}}, 0xc840) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)=@newtfilter={0x70, 0x2c, 0xd2b, 0x70fd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x6}, {}, {0x7, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0x44, 0x2, [@TCA_U32_INDEV={0x14, 0x8, 'veth1_to_team\x00'}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xffc, 0xb709, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}, @TCA_U32_LINK={0x8}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004884}, 0x24040084) r11 = socket(0x2b, 0x1, 0x1) connect$inet6(r11, &(0x7f0000000900)={0xa, 0x4e22, 0xffffffff, @ipv4={'\x00', '\xff\xff', @empty}, 0x2}, 0x1c) 1m1.1826285s ago: executing program 4 (id=3512): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1200000003000000040000000100000000000000", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0005000000000800"/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1e, 0x11, &(0x7f0000000340)=ANY=[@ANYBLOB="bf16000000000000620afcff00000000bfa200000000000007020000fcffffff1851000000000000000000000000000085000000010000001500070000000000bf07000000000000bf61000000000000bf72000000000000b703000000000000850000007c000000bf710000000000008500000056000000b70000000100000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[r0], 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000480)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x9, 0x0, &(0x7f0000000500)="000000000000000002", 0x0}, 0x50) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xf}, @printk={@lu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1m1.132695036s ago: executing program 3 (id=3513): r0 = socket$kcm(0xa, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x10, 0x0, 0x1300) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000040)=@in6={0xa, 0x4e24, 0x3000000c, @loopback, 0x76bc}, 0x80, 0x0}, 0xc814) (fail_nth: 2) 1m0.944528667s ago: executing program 4 (id=3514): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) setsockopt$sock_int(r1, 0x1, 0x13, &(0x7f0000000040)=0x9, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18010000000000000000000004000000850000005e0000009500000000000000a30b406b5a2bc8900d74868f5f4d1098c19588a23d7ae496951cac6cba4fd5c344499902356fe555b769ad074a9c8526831ea54da16a35cf6b"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x12, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xa, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="bf16000000000000b70100003b0204007b1ae0ff00000000b7010000000000007b1ae8ff000000007b1af0ff00000000bf61000000000000b702000001000000bfa300000000000007030000e0ffffffb7040000180000008500000049000000b70000000000000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r2, 0x0, 0x36, 0x0, &(0x7f0000000540)="52540012345652540012345786dd600000000000bb4000000000000000002000000000000001fc000000000000000020000000000001", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x14, 0x36, 0x301, 0x70bd25, 0xfffffffc, {0x1}}, 0x14}}, 0x0) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000640), r3) r5 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000680)='ns/cgroup\x00') sendmsg$GTP_CMD_ECHOREQ(r3, &(0x7f00000006c0)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000780)={0x1c, r4, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x480}, 0x4000000) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@newlink={0x40, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0xb00, 0x46951}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vti={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @broadcast}, @IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}]}}}]}, 0x40}}, 0x2000000) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r6, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)={0x38, 0x1410, 0x8b7fbbc5948fecd9, 0x70bd29, 0x25dfd9fc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="60000000020601080000000000006f14e90a00001400078008001140000000000500150000000000050005000a000000050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970"], 0x60}}, 0x0) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b36, &(0x7f0000000b40)={'wlan1\x00', @random="000500000020"}) bpf$LINK_DETACH(0x22, &(0x7f0000000b80), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0x2, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB="b70000001c000000bca30000000000002403000020feffff620a00fef8ffffff71a400fe000000001f03000000000000e5000600000000002604fdffff02000015010000033800001d13fcff000000007a0af0ff0000001f0f13000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f0000001a00)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000001a40), 0xffffffffffffff97, 0x10, &(0x7f0000001a80)={0x0, 0x3}, 0xfffffffffffffd72, 0x0, 0xffffffffffffffff, 0x1a}, 0x48) r7 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x43, &(0x7f0000001ac0)={@link_local, @random="a538ae464632", @void, {@ipv4={0x800, @igmp={{0xb, 0x4, 0x0, 0x0, 0x57, 0x0, 0x0, 0x1, 0x2, 0x0, @local, @multicast1, {[@generic={0x3f, 0x11, "8e62a30ba630b472e66a75478a2453"}, @ra={0x94, 0x4, 0x1}]}}, {0x11, 0x0, 0x0, @multicast2, '\x00'}}}}}, 0x0) sendmsg(r7, &(0x7f0000001b40)={&(0x7f0000001b80)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000001c40)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000001c80)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000001cc0)={@void, @val={0x5, 0x80, 0x2, 0xe7b6, 0x5, 0x2}, @ipv4=@udp={{0x1e, 0x4, 0x2, 0x6, 0xf0, 0x68, 0x0, 0x8, 0x11, 0x0, @local, @local, {[@cipso={0x86, 0x6, 0x1}, @noop, @ra={0x94, 0x4, 0x2}, @lsrr={0x83, 0xb, 0xfd, [@local, @multicast1]}, @end, @cipso={0x86, 0x4b, 0x2, [{0x5, 0x7, "acd4f603bb"}, {0x1, 0xf, "29e9997683de25bb99cee4ac51"}, {0x7, 0x8, "a10a390d4f50"}, {0x5, 0x2}, {0x6, 0x7, "6f96201736"}, {0x1, 0x4, "30a0"}, {0x7, 0x5, "4a9b2d"}, {0x6, 0x9, "0f88e3f0fc8d7b"}, {0x5, 0xc, "c93079b12adc99e78aa4"}]}]}}, {0x4e21, 0x4e23, 0x78, 0x0, @gue={{0x1, 0x0, 0x0, 0xff, 0x0, @void}, "c705d553f4205a13dffbcb106c350be150dca0b287ec7e53fd09c2a9c16d5efd7fbfe94ed8a86cd50c925d5d4748e6bc5681ecd3901317248dae2879d8cb381313c2492d6516a61be3fb5feeac9517795b7830199b561d61fe3bc915bfb0c023191fc23b76a6f3f2589716d2"}}}}, 0xfa) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x6, &(0x7f0000000400)=ANY=[@ANYBLOB="b700000000000000bf160000000000007961610000000000150101000000000085000000c400000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m0.944418677s ago: executing program 3 (id=3515): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000240)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000000300)={&(0x7f0000000340)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000000440)}, 0x0) recvmsg(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=""/227, 0xe3}], 0x1}, 0x0) 1m0.602911408s ago: executing program 3 (id=3516): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000007000000000000001f00000091117a000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x1, 0x4, 0x6, 0x40c}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xb, 0x8, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xd, &(0x7f00000004c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xae}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000540)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000580)={r3, r2}, 0xc) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x1, 0xffffffffffffffff, 0x80000}, &(0x7f0000000380)=0xc) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000005c0)={0x0, 0x10, &(0x7f0000000600)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000640)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000680)={0x1, [0x0]}, &(0x7f00000006c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x84, &(0x7f0000000700)={r6, @in6={{0x2, 0x4e24, 0x0, @local, 0x8}}, 0x8, 0x806}, &(0x7f00000007c0)=0x90) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000800)=@assoc_value={r6, 0xfffff9bd}, 0x8) read(r1, &(0x7f0000000000)=""/243, 0xf3) close(r0) 1m0.360041409s ago: executing program 1 (id=3517): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000200)=@raw={'raw\x00', 0x8, 0x3, 0x3d0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x300, 0xffffffff, 0xffffffff, 0x300, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast1, [0xff, 0x0, 0xffffffff, 0xffffffff], [0xff000000, 0xffffff00, 0xffffff00], 'macvtap0\x00', 'pimreg0\x00', {0xff}, {0xff}, 0x3b, 0x5, 0x0, 0x25}, 0x0, 0xd8, 0xf8, 0x60030000, {0x0, 0xff000000}, [@common=@frag={{0x30}, {[0x800, 0x1], 0x3, 0x10, 0x2}}]}, @unspec=@TRACE={0x20}}, {{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private2, [0xffffff00, 0xff000000, 0x0, 0xffffff00], [0x0, 0x0, 0xffffffff, 0xff000000], 'team_slave_0\x00', 'pim6reg0\x00', {0xff}, {0x101}, 0x11, 0x2, 0x5, 0x5}, 0x0, 0x1d0, 0x208, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x3, 0x4, 0x2, 0x1, 0x7}}, @common=@inet=@recent0={{0xf8}, {0x4, 0x6, 0x4, 0x0, 'syz0\x00'}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x1, 0x4}, {0x0, 0xb, 0x6}, {0xffffffffffffffff, 0x1, 0x6}, 0xce, 0x6}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000001c0)={0x1, 0xffffffffffffffff}, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000900)=@raw={'raw\x00', 0x3c1, 0x3, 0x498, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x3c8, 0x2e8, 0x2e8, 0x3c8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, [0x0, 0xffffff00, 0x0, 0xffffffff], [0xffffffff, 0x0, 0x0, 0xff], 'vlan0\x00', 'geneve1\x00', {}, {0xff}, 0x5c}, 0x0, 0x248, 0x268, 0x0, {0x0, 0x2000000000000}, [@common=@hbh={{0x48}, {0x3, 0x0, 0x0, [0xfffb, 0xada, 0xffff, 0x3998, 0x4, 0x1, 0x4, 0x8, 0x101, 0xda28, 0x4, 0x10, 0x8, 0xfffd, 0xf8, 0xec00], 0x10}}, @common=@inet=@hashlimit3={{0x158}, {'vxcan1\x00', {0x23, 0xfffffffffffffffd, 0x40, 0x1, 0x2, 0x40, 0x4, 0x0, 0x0, 0x40}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x13}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4f8) r3 = socket$inet6(0xa, 0x800000000000002, 0x0) syz_emit_ethernet(0xfe, &(0x7f0000000e00)={@random="cf702e8cf675", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xc8, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x14, "002b228078c8e10a87cf10a0e37bbe3522e2a0d5812008b645088f2672636368285a5538b713f5ab1d5b71e89a6c3f0890a2bdec87949dbe3e6283e5dee7833bd36cf9eb41d293a9dbc1a8096375d96f244eda9dd1b1435ac7241701e58e05d46b50b0a12c58673757640be944806693a698a9bba6018624eefa98f28e3cfee5d951fcf227c6c8d55d58fcee8d57c51500dfdc5ec9179e731fd90ef87a45"}]}}}}}}, 0x0) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x1d, &(0x7f0000000140)=0x7, 0x4) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x41, &(0x7f0000000180)=0x6bb3, 0x4) sendmmsg$inet6(r3, &(0x7f0000000780)=[{{&(0x7f00000007c0)={0xa, 0x4e03, 0x800, @mcast2}, 0x1c, 0x0}}], 0x1, 0x60040000) recvmmsg(r3, &(0x7f0000000800)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)=""/10, 0xa}, 0x400}], 0x1, 0x40002062, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001340)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000001400)={@in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_int(r4, 0x6, 0x20, &(0x7f0000001500)=0x2, 0xf6) r5 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r5, &(0x7f0000000f00), 0x10) listen(r5, 0x0) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000f40), 0x10) setsockopt$sock_linger(r6, 0x1, 0x3c, &(0x7f0000000f80)={0x1, 0x5}, 0x8) sendmmsg(r6, &(0x7f0000000fc0)=[{{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000001040)="4b5fd0e56f6d4ff115119357ba16f437963ed3f171b16d4ff9bbaccac7600fe5b6d7819000e0551d0387707c9d09a52592cb81d3794d95f17a337d73814659ebeee3fd5e00c0240a2d10f5c75affac584aff978e3feda0ae9b5404cf96e6957fc2e8e004e47473863be3046b61657b117d", 0x71}, {&(0x7f00000010c0)="22cdfad373f59d02162d6fc447e109b41dd1dcb33a9cbfd7a5e786a63d1117eb78d576a86846bc5bb756c5a39fe2", 0x2e}, {&(0x7f0000001100)="cd25b97f7eee9d9f2974fdc46a05851f54899ff1f6f64b9c3cdf2da358e4698d1139f91589d2c958adb39bb19997fd6f82a97d37b9aafd0d1b0a798870c4da43b41c2bd9367cb657bb921de4df7de7414a79a71380474bc2a248d07413610af42b3e7c638496214aadaad39204d8df7096b8a02ba1b120c7b9dec7c577a03e7c382025f90f116024d16acba8f4127d8921da462f747702e67f01ea0e47846e02abe8e96051eef6425c8c5d0d1b72a1c10bbdd390bb6c882a56a1ea75bf644068cd96f8dbc46b96d7c0c3fc00dbbd72844e9327b2dfa97c28a32d424eb681a4dfeffb5cef8d127b98d5304d4e6c49f06d74849e0199d2c23347df6d5e90642ae440398f9edf55000000000b97d92cb8de0ff51e271085e2cedc78c3363a378344cb4936c089b03e646651e20ab7140cff85864d71dae5d20a133577b5d982b7fa75b572d0e52db3317ddf295095db60cd6dfe96ed728d2ac17d0940f17a3fb861df7aafd34f97d7c1e333c053280134d5f52303c84fb7fcfc93801697e31021d223c07fc8a63655fc8e8cf26c467c7f7639e1fe95b726cbd6f4780a3c72f6ffb789f315659ccd31fe117ece8c797b5fb14c6ff7", 0xfd3e}, {&(0x7f00000012c0)="32002e1dd424df2ec8041bf76dfd65054028f73475cdce5329993227736d1b8aa87ef8c0419b72ce8099fd0f284443f7a909f9a59746d4f4e889192ecd849319142c35cb93f0b9a3b9c9c5c9b9ec70185633837696263b7682a20a15d091c3467340f6dc60f2202699d22805961a6a786b95af90f860df4580", 0x79}], 0x4}}], 0x1, 0x4008040) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000680)={0x1, 0xffffffffffffffff}, 0x4) syz_emit_ethernet(0x52, &(0x7f0000000880)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0xc, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_addr={0x44, 0x14, 0xa, 0x1, 0x0, [{@remote}, {@private=0xa010100}]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x11, 0x18, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@generic={0xfe, 0x2, 0x0, 0xd, 0x1000}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x2}, @map_idx={0x18, 0xb, 0x5, 0x0, 0x9}, @map_fd={0x18, 0x2, 0x1, 0x0, r1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}}, @generic={0x9, 0x2, 0xf, 0x100, 0x101}]}, &(0x7f0000000640)='syzkaller\x00', 0x1, 0x0, 0x0, 0x41000, 0x27, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000}, 0x94) 1m0.22634744s ago: executing program 4 (id=3518): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x41000, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3fd}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="2200000004"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x3, &(0x7f0000001880)=ANY=[@ANYBLOB="1800000005000000000000000000000095"], &(0x7f00000018c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xf}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000280), &(0x7f00000002c0)=r2}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r1}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb702000008000000182300", @ANYRES32=r3, @ANYBLOB="0000000000020000b7050000080000001c00000000000000bf980000000000000d080000000000008500000006000000b70000000200000095"], &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) 1m0.17152371s ago: executing program 0 (id=3519): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @empty}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac47037fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5ed838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b60b23cc613b68fcfdb27d4015a8e7fea999a9686fb7e607a98e8f21e41cd1ac96628e66378f4cea241309cd125d29cdcc73f1e02cbb7a655ca34d00dff11b617550d2873b08f16eec3b3ae4806d6e5472bd7600facaf04bae6bef384568a96fa0d4d31dfecc9c0559656dfbdab64b60f2e2e2dd3d9f2d130fa676e70e18543946dd8ed05ba41f74f01be37b4f55e6876ea284800e0e0c7f0f2accb46d4908", 0x1dd}], 0x1}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)="32d33a47d96ceacc565129f837dfc4ec8df24612082800303fbc4c7dae05b96c2dc595b8a5423e", 0x27}, {&(0x7f0000000500)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb74bf114e1a95c71a81b46d5d333aef5db36219c3bd7f905a25f5bb07bd3055d210022f04b5acf6a8e20086a71b6b5c7bb87d9c7a209b7f0e56dac72bf77c9773d1b702c45c9460829ffbf704fbbe1635b301183a8867463de2a0fae686630b7db109ed374", 0xc2}], 0x2}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740)=0xdf8, 0x4) writev(r0, &(0x7f0000001d40)=[{&(0x7f0000002d80)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc756cbc9ef90ee5477c529105548e84a9fa4cba55b8fe48ef33e206952e5be378ef8df0c7c024080b8961d49a6b863cd8f4e29dd1c66fd9f93ea18010b541133f792fde35c33b0bd8ef50f205193ac4c223f6f5e9659ff679a132fee9cf1769ecef53bc2ed1b3feaa0306025a68e87a88f7bf740a457024963ef1dac67dbd1bae5aec6604b8440e5f3cf21d1c4187db1a1f205054ec1f9dd4d86977bdd6c4c30ef70e2f96fca9ad0cd08dd057286fb658aa836f5a0b1e0c0b86e5", 0x2cf}], 0x1) 59.948339825s ago: executing program 4 (id=3520): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1f, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r2}, 0xc) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000000c80)={'ip6gre0\x00', &(0x7f0000000cc0)=@ethtool_cmd={0x3a, 0x0, 0x7, 0x0, 0x0, 0xf, 0xd8, 0x0, 0x87, 0x0, 0x80001, 0x0, 0x1, 0x1, 0x0, 0x0, [0xb, 0x6]}}) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000006c0)={'erspan0\x00', 0x0}) setsockopt$packet_add_memb(r5, 0x107, 0x1, &(0x7f0000000700)={r7, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_drop_memb(r5, 0x107, 0x2, &(0x7f0000000740)={r7, 0x1, 0x6, @multicast}, 0x10) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f0000000d00)=ANY=[@ANYBLOB="9feb01001800000000000000000006000000010000000000000e02000000020000000b00000003000006040000000e0000000104000001000000000400000a000000080000000000522e300000000000000082a2034942a1c7f7a138d73353199599e47c4fc94ac921378ccdafb42f66dbf7219e0f3e7d5f5e9a16c8ac8a513f871c1e3f192b7b7a821a28d640258ae126aa69f7ed0bc01782fb7fdf5a64541c36eb1d6c05a26c12d6e8a2cde90f847949d1b14b66"], &(0x7f0000000800)=""/20, 0x52, 0x14, 0x0, 0x9}, 0x28) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000880), 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000008c0)='devices.list\x00', 0x0, 0x0) preadv(r10, &(0x7f0000000900)=[{&(0x7f0000000940)=""/121, 0x79}], 0x1, 0x0, 0xffffffff) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r11, 0x6, 0x6, &(0x7f0000000180), &(0x7f0000000880)=0x3) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)={0x3, 0x4, 0x4, 0xa, 0x0, r0, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x2, 0x19, &(0x7f00000004c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@jmp={0x5, 0x0, 0x9, 0x8, 0x2, 0x20, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x1}}}, &(0x7f00000005c0)='GPL\x00', 0x7fff, 0xb3, &(0x7f0000000600)=""/179, 0x40f00, 0x10, '\x00', r7, @fallback=0x36, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r10, 0x5, &(0x7f0000000a40)=[r1, r12, r0, r0], &(0x7f0000000a80)=[{0x1, 0x4, 0x3, 0xa}, {0x3, 0x2, 0x8, 0x5}, {0x1, 0x4, 0x6, 0x9}, {0x5, 0x2, 0x2, 0x5}, {0x0, 0x4, 0x8}], 0x10, 0x10000}, 0x94) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000040)={0x61, 0x1, 0xc, 0xb, 0x5a4, 0x81}) r13 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$XFS_IOC_SCRUBV_METADATA(0xffffffffffffffff, 0xc0285840, &(0x7f0000000140)={0x6, 0x0, 0x200, 0x0, 0x4, 0x1, 0x0, &(0x7f0000000100)=[{0x19, 0x1ff, 0x5}]}) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r13, 0x894b, &(0x7f00000000c0)) pipe(&(0x7f0000000380)={0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_GET_FEATURES(r14, 0x80189439, &(0x7f0000000780)) r15 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000007c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r15, 0x8933, &(0x7f0000000dc0)={'wg0\x00'}) 59.895467077s ago: executing program 1 (id=3521): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet6_int(r0, 0x29, 0x2, &(0x7f0000000100)=0xffffffff, 0x4) sendto$inet6(r0, &(0x7f0000001d40), 0x0, 0x24000045, &(0x7f0000001d80)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) 0s ago: executing program 32 (id=3519): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @empty}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001600)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac47037fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5ed838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b60b23cc613b68fcfdb27d4015a8e7fea999a9686fb7e607a98e8f21e41cd1ac96628e66378f4cea241309cd125d29cdcc73f1e02cbb7a655ca34d00dff11b617550d2873b08f16eec3b3ae4806d6e5472bd7600facaf04bae6bef384568a96fa0d4d31dfecc9c0559656dfbdab64b60f2e2e2dd3d9f2d130fa676e70e18543946dd8ed05ba41f74f01be37b4f55e6876ea284800e0e0c7f0f2accb46d4908", 0x1dd}], 0x1}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000240)="32d33a47d96ceacc565129f837dfc4ec8df24612082800303fbc4c7dae05b96c2dc595b8a5423e", 0x27}, {&(0x7f0000000500)="9cf1495e028e22049259947af71c968820aac2153e36e05237044004130a31b25cd08e4a582dd094e3cd495eb7e28321e85d8e7da6651a68cb993498df2236fcab1ea0a1cc628ddbe16ac9191d6917ee7f319afaae6058b0a13fa0258fb74bf114e1a95c71a81b46d5d333aef5db36219c3bd7f905a25f5bb07bd3055d210022f04b5acf6a8e20086a71b6b5c7bb87d9c7a209b7f0e56dac72bf77c9773d1b702c45c9460829ffbf704fbbe1635b301183a8867463de2a0fae686630b7db109ed374", 0xc2}], 0x2}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740)=0xdf8, 0x4) writev(r0, &(0x7f0000001d40)=[{&(0x7f0000002d80)="fb7ef3f08d8f0d64c4636b96073c171a2926f00a2baa2c2752e6ba348df7c6cb64a0a5dbc368e6e57135b7c7f20a1e4ca2d0c293b9df5480df71d6dcdd9beb4fa3247b3b7e38346fa0436ee2d9c57c41af42a71188cbd6b252eb449052ef2d76f3c0ab72b88db15921409f4efe9fe517430ec288238072967546e6a834ac62fec1df765d0147d8d2993dceb59f5b66b848a8f1d09a0d8108e7ef271311ea18df574e3e0b9242dd27f45258cb3bb762582f5737efdc15dabfa031673c84696ab886bdd35bb35a5346cf472e001e71c5384fc353b3181775acb185307d6f762e564b7fd4f06f875fc919c3ebb015f673a3cb380b03abbbfe30c781bd8b17292a1e2b748107e60e568c1e1f86a0cf01e30772b6b2146cd4d1f2e9fc7b5bcefded909fe7bf723490ced2d106004e3a0cd7b9c3519b05741751325fe8538085cc1f902fa544dcc929f10469fe39c3cf61f786254a373316923186fa08ef3c8917d4c2df0d3e41c32b6948177e71b23c3a9eb9c30db62011da02d48da9318c20a438f6ba2962ce066b8793e16831c350a379f8c54c5de2eab0b0117e3dc30f5c27c87b2eb33b43215bdcabb7185b1ca317dc967cfdfdcbf92a4e196bcf0d6ba1cea19dd296b4de3625a95ea0ee82efc84379be3125e84d8183ebce42f98654f44f86d49b13529b6cec5acbe93af52987080df30eed17685881b67777877226704091bd1f07b76c3af968b6afc17751d27756d8df673ee1cc756cbc9ef90ee5477c529105548e84a9fa4cba55b8fe48ef33e206952e5be378ef8df0c7c024080b8961d49a6b863cd8f4e29dd1c66fd9f93ea18010b541133f792fde35c33b0bd8ef50f205193ac4c223f6f5e9659ff679a132fee9cf1769ecef53bc2ed1b3feaa0306025a68e87a88f7bf740a457024963ef1dac67dbd1bae5aec6604b8440e5f3cf21d1c4187db1a1f205054ec1f9dd4d86977bdd6c4c30ef70e2f96fca9ad0cd08dd057286fb658aa836f5a0b1e0c0b86e5", 0x2cf}], 0x1) kernel console output (not intermixed with test programs): ode [ 392.463710][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.464075][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.464407][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.464739][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.466209][T13839] FAULT_INJECTION: forcing a failure. [ 392.466209][T13839] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.466274][T13839] CPU: 1 UID: 0 PID: 13839 Comm: syz.1.2758 Not tainted syzkaller #0 PREEMPT(full) [ 392.466299][T13839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 392.466318][T13839] Call Trace: [ 392.466327][T13839] [ 392.466337][T13839] dump_stack_lvl+0xe8/0x150 [ 392.466379][T13839] should_fail_ex+0x3eb/0x540 [ 392.466413][T13839] _copy_from_user+0x2d/0xb0 [ 392.466443][T13839] ___sys_sendmsg+0x1c6/0x360 [ 392.466470][T13839] ? __lock_acquire+0x747/0x2de0 [ 392.466505][T13839] ? __pfx____sys_sendmsg+0x10/0x10 [ 392.466617][T13839] ? __fget_files+0x3a2/0x420 [ 392.466644][T13839] ? __fget_files+0x2a/0x420 [ 392.466683][T13839] __x64_sys_sendmsg+0x1b1/0x290 [ 392.466712][T13839] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 392.466761][T13839] do_syscall_64+0x166/0x520 [ 392.466787][T13839] ? trace_irq_disable+0x3b/0x140 [ 392.466818][T13839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.466841][T13839] ? clear_bhb_loop+0x70/0xc0 [ 392.466870][T13839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.466899][T13839] RIP: 0033:0x7fee3699fb19 [ 392.466922][T13839] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 392.466941][T13839] RSP: 002b:00007fee37937028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 392.466966][T13839] RAX: ffffffffffffffda RBX: 00007fee36c25fa0 RCX: 00007fee3699fb19 [ 392.466983][T13839] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 392.466998][T13839] RBP: 00007fee37937090 R08: 0000000000000000 R09: 0000000000000000 [ 392.467012][T13839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 392.467038][T13839] R13: 00007fee36c26038 R14: 00007fee36c25fa0 R15: 00007ffc26f31678 [ 392.467136][T13839] [ 392.470372][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.511673][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.511805][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.511834][T13836] IPv6: NLM_F_CREATE should be set when creating new route [ 392.517306][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.561355][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.562081][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.562180][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.583891][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.584072][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.584842][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.584948][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.619314][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.619439][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.620427][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.643595][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.644538][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.644642][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.645649][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.646923][T13833] ip_tables: iptables: counters copy to user failed while replacing table [ 392.675882][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.676001][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.676913][T13836] netlink: 'syz.2.2756': attribute type 1 has an invalid length. [ 392.677012][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.709790][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.713673][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.736269][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.755572][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.756458][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.798737][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.799677][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.809861][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.821749][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.848120][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.848785][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.862895][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.864193][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.918903][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.919925][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.961249][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.962037][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.982469][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 392.983423][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.006137][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.006461][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.006579][T13845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2757'. [ 393.006744][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.039623][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.040486][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.067505][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.087984][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.088353][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.089165][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.089466][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.089746][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.092557][T13845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2757'. [ 393.115456][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.125388][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.126153][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.143258][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.149975][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.159406][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.160189][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.176736][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.179163][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.201698][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.202562][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.203187][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.225114][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.225430][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.225740][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.226097][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.241147][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.241974][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.250024][T13836] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 393.325571][T13835] syzkaller1: entered promiscuous mode [ 393.325594][T13835] syzkaller1: entered allmulticast mode [ 393.524016][T13858] FAULT_INJECTION: forcing a failure. [ 393.524016][T13858] name failslab, interval 1, probability 0, space 0, times 0 [ 393.524048][T13858] CPU: 1 UID: 0 PID: 13858 Comm: syz.1.2765 Not tainted syzkaller #0 PREEMPT(full) [ 393.524072][T13858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 393.524085][T13858] Call Trace: [ 393.524093][T13858] [ 393.524103][T13858] dump_stack_lvl+0xe8/0x150 [ 393.524146][T13858] should_fail_ex+0x3eb/0x540 [ 393.524177][T13858] ? __alloc_skb+0x1db/0x7a0 [ 393.524209][T13858] should_failslab+0xa8/0x100 [ 393.524243][T13858] ? __alloc_skb+0x1db/0x7a0 [ 393.524273][T13858] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 393.524299][T13858] ? __alloc_skb+0x18d/0x7a0 [ 393.524344][T13858] ? __alloc_skb+0x1db/0x7a0 [ 393.524382][T13858] __alloc_skb+0x1db/0x7a0 [ 393.524417][T13858] netlink_sendmsg+0x5cd/0xb20 [ 393.524455][T13858] ? __pfx_netlink_sendmsg+0x10/0x10 [ 393.524495][T13858] ? aa_sock_msg_perm+0x144/0x210 [ 393.524520][T13858] ? apparmor_socket_sendmsg+0x98/0x360 [ 393.524552][T13858] ? __pfx_netlink_sendmsg+0x10/0x10 [ 393.524581][T13858] sock_sendmsg_nosec+0x14e/0x190 [ 393.524612][T13858] ____sys_sendmsg+0x54e/0x850 [ 393.524639][T13858] ? __pfx_____sys_sendmsg+0x10/0x10 [ 393.524671][T13858] ? import_iovec+0x73/0xa0 [ 393.524700][T13858] ___sys_sendmsg+0x2a5/0x360 [ 393.524719][T13858] ? __lock_acquire+0x747/0x2de0 [ 393.524750][T13858] ? __pfx____sys_sendmsg+0x10/0x10 [ 393.524810][T13858] ? __fget_files+0x3a2/0x420 [ 393.524833][T13858] ? __fget_files+0x2a/0x420 [ 393.524866][T13858] __x64_sys_sendmsg+0x1b1/0x290 [ 393.524892][T13858] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 393.524936][T13858] do_syscall_64+0x166/0x520 [ 393.524959][T13858] ? trace_irq_disable+0x3b/0x140 [ 393.524988][T13858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.525009][T13858] ? clear_bhb_loop+0x70/0xc0 [ 393.525034][T13858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 393.525054][T13858] RIP: 0033:0x7fee3699fb19 [ 393.525074][T13858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 393.525092][T13858] RSP: 002b:00007fee37937028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 393.525113][T13858] RAX: ffffffffffffffda RBX: 00007fee36c25fa0 RCX: 00007fee3699fb19 [ 393.525128][T13858] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 393.525140][T13858] RBP: 00007fee37937090 R08: 0000000000000000 R09: 0000000000000000 [ 393.525152][T13858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 393.525164][T13858] R13: 00007fee36c26038 R14: 00007fee36c25fa0 R15: 00007ffc26f31678 [ 393.525195][T13858] [ 393.941848][T13871] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2770'. [ 394.169397][T13878] tipc: Enabled bearer , priority 0 [ 394.202571][T13885] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2774'. [ 394.206679][T13885] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2774'. [ 394.247714][T13878] syzkaller0: entered promiscuous mode [ 394.247743][T13878] syzkaller0: entered allmulticast mode [ 394.248464][T13878] tipc: Resetting bearer [ 394.251209][T13887] tipc: Enabled bearer , priority 0 [ 394.338878][T13882] syzkaller0: entered promiscuous mode [ 394.338902][T13882] syzkaller0: entered allmulticast mode [ 394.339588][T13882] tipc: Resetting bearer [ 394.358440][T13877] tipc: Resetting bearer [ 394.738356][T13897] FAULT_INJECTION: forcing a failure. [ 394.738356][T13897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 394.738386][T13897] CPU: 0 UID: 0 PID: 13897 Comm: syz.3.2781 Not tainted syzkaller #0 PREEMPT(full) [ 394.738429][T13897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 394.738442][T13897] Call Trace: [ 394.738451][T13897] [ 394.738460][T13897] dump_stack_lvl+0xe8/0x150 [ 394.738503][T13897] should_fail_ex+0x3eb/0x540 [ 394.738536][T13897] _copy_from_user+0x2d/0xb0 [ 394.738564][T13897] generic_map_update_batch+0x6b1/0xad0 [ 394.738608][T13897] ? __pfx_generic_map_update_batch+0x10/0x10 [ 394.738635][T13897] ? __fget_files+0x3a2/0x420 [ 394.738660][T13897] ? __fget_files+0x2a/0x420 [ 394.738691][T13897] ? fdget+0x1ac/0x250 [ 394.738717][T13897] ? __pfx_generic_map_update_batch+0x10/0x10 [ 394.738746][T13897] bpf_map_do_batch+0x391/0x630 [ 394.738786][T13897] __sys_bpf+0x977/0xe00 [ 394.738814][T13897] ? __pfx___sys_bpf+0x10/0x10 [ 394.738853][T13897] ? __fget_files+0x2a/0x420 [ 394.738895][T13897] ? ksys_write+0x242/0x270 [ 394.738924][T13897] ? __pfx_ksys_write+0x10/0x10 [ 394.738955][T13897] __x64_sys_bpf+0xba/0xd0 [ 394.738990][T13897] do_syscall_64+0x166/0x520 [ 394.739014][T13897] ? trace_irq_disable+0x3b/0x140 [ 394.739046][T13897] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.739085][T13897] ? clear_bhb_loop+0x70/0xc0 [ 394.739130][T13897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 394.739152][T13897] RIP: 0033:0x7f23e039fb19 [ 394.739172][T13897] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 394.739192][T13897] RSP: 002b:00007f23e1199028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 394.739216][T13897] RAX: ffffffffffffffda RBX: 00007f23e0625fa0 RCX: 00007f23e039fb19 [ 394.739233][T13897] RDX: 0000000000000038 RSI: 0000200000000080 RDI: 000000000000001a [ 394.739249][T13897] RBP: 00007f23e1199090 R08: 0000000000000000 R09: 0000000000000000 [ 394.739263][T13897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 394.739276][T13897] R13: 00007f23e0626038 R14: 00007f23e0625fa0 R15: 00007ffd3f4e6928 [ 394.739311][T13897] [ 395.039100][ T5643] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 395.043958][ T5643] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 395.048621][ T5643] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 395.058362][ T5643] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 395.061801][ T5643] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 395.410353][T13916] net_ratelimit: 78 callbacks suppressed [ 395.410373][T13916] ip_tables: iptables: counters copy to user failed while replacing table [ 396.463621][T13926] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2788'. [ 396.465712][T13926] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2788'. [ 396.626935][T13877] tipc: Disabling bearer [ 396.678336][ T201] tipc: Resetting bearer [ 396.679337][T13879] tipc: Resetting bearer [ 396.755189][T13931] siw: device registration error -23 [ 396.889307][T13937] trusted_key: syz.0.2792 sent an empty control message without MSG_MORE. [ 397.085257][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.085472][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.085670][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.086162][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.086365][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.086607][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.087148][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.087358][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.087588][T13941] Dead loop on virtual device lo (net 36), fix it urgently! [ 397.173539][ T5644] Bluetooth: hci5: command tx timeout [ 398.363260][T13879] tipc: Disabling bearer [ 398.409522][T13907] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2783'. [ 398.409666][ T5759] tipc: Node number set to 3161452457 [ 398.538559][T13959] sctp: [Deprecated]: syz.2.2798 (pid 13959) Use of int in max_burst socket option deprecated. [ 398.538559][T13959] Use struct sctp_assoc_value instead [ 398.871775][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.988462][T13970] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2800'. [ 398.988542][T13970] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2800'. [ 399.032932][T13963] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2800'. [ 399.032976][T13963] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2800'. [ 399.089747][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.251969][ T5644] Bluetooth: hci5: command tx timeout [ 399.287501][ T13] team0: Port device netdevsim1 removed [ 399.288431][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.465755][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.521916][T13996] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2808'. [ 399.565398][T13900] hsr0 speed is unknown, defaulting to 1000 [ 399.889943][ T13] bridge_slave_1: left allmulticast mode [ 399.889983][ T13] bridge_slave_1: left promiscuous mode [ 399.891029][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.912040][T14016] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input26 [ 399.924097][ T13] bridge_slave_0: left allmulticast mode [ 399.924159][ T13] bridge_slave_0: left promiscuous mode [ 399.927424][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 400.037167][T14016] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2815'. [ 400.327782][T14033] validate_nla: 49 callbacks suppressed [ 400.327804][T14033] netlink: 'syz.2.2822': attribute type 1 has an invalid length. [ 400.351947][T14033] sctp: [Deprecated]: syz.2.2822 (pid 14033) Use of int in max_burst socket option. [ 400.351947][T14033] Use struct sctp_assoc_value instead [ 400.475899][T14039] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2823'. [ 400.505462][T14040] net_ratelimit: 46 callbacks suppressed [ 400.505484][T14040] IPv6: addrconf: prefix option has invalid lifetime [ 400.509937][T14040] netlink: 'syz.2.2824': attribute type 1 has an invalid length. [ 400.759195][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 400.778441][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 400.791052][ T13] bond0 (unregistering): Released all slaves [ 400.798193][ T13] bond1 (unregistering): Released all slaves [ 400.816677][ T201] smbdirect: ib_dev[syz1] removed [ 400.935024][T14040] syzkaller0: entered allmulticast mode [ 400.935259][ T10] infiniband syz1: ib_query_port failed (-19) [ 401.033246][ T13] tipc: Left network mode [ 401.137149][T14058] openvswitch: netlink: IPv4 tunnel dst address is zero [ 401.195491][T14059] nbd: must specify a size in bytes for the device [ 401.330879][ T5644] Bluetooth: hci5: command tx timeout [ 401.474450][T14070] netlink: 'syz.3.2833': attribute type 1 has an invalid length. [ 401.494657][T14070] sctp: [Deprecated]: syz.3.2833 (pid 14070) Use of int in max_burst socket option. [ 401.494657][T14070] Use struct sctp_assoc_value instead [ 401.497079][T14070] siw: device registration error -23 [ 401.767451][T14081] __nla_validate_parse: 2 callbacks suppressed [ 401.767475][T14081] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2835'. [ 401.797855][T14081] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2835'. [ 402.158658][ T13] hsr_slave_0: left promiscuous mode [ 402.166308][ T13] hsr_slave_1: left promiscuous mode [ 402.169108][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 402.169146][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 402.191994][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 402.192018][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 402.226009][ T13] veth1_macvtap: left promiscuous mode [ 402.226065][ T13] veth0_macvtap: left promiscuous mode [ 402.250856][T14098] IPv6: addrconf: prefix option has invalid lifetime [ 402.256072][T14098] netlink: 'syz.0.2840': attribute type 1 has an invalid length. [ 402.256092][T14098] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.2840'. [ 402.669653][T14112] netlink: 'syz.4.2845': attribute type 1 has an invalid length. [ 402.683525][T14112] sctp: [Deprecated]: syz.4.2845 (pid 14112) Use of int in max_burst socket option. [ 402.683525][T14112] Use struct sctp_assoc_value instead [ 402.686255][T14112] siw: device registration error -23 [ 402.866635][T14119] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2848'. [ 402.868914][T14119] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2848'. [ 402.997345][ T13] team0 (unregistering): Port device team_slave_1 removed [ 403.027406][ T13] team0 (unregistering): Port device team_slave_0 removed [ 403.159329][T14128] netlink: 'syz.2.2851': attribute type 23 has an invalid length. [ 403.264779][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 403.411965][ T5644] Bluetooth: hci5: command tx timeout [ 403.448136][T13900] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.448227][T13900] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.448369][T13900] bridge_slave_0: entered allmulticast mode [ 403.472305][T13900] bridge_slave_0: entered promiscuous mode [ 403.479583][T13900] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.480033][T13900] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.480397][T13900] bridge_slave_1: entered allmulticast mode [ 403.494350][T13900] bridge_slave_1: entered promiscuous mode [ 403.615053][T13900] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 403.638938][T13900] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 403.797763][T13900] team0: Port device team_slave_0 added [ 403.817050][ T13] IPVS: stop unused estimator thread 0... [ 403.824343][T13900] team0: Port device team_slave_1 added [ 403.910244][T13900] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 403.910265][T13900] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 403.910292][T13900] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 403.966930][T13900] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 403.966950][T13900] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 403.966980][T13900] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 404.208456][T14158] netlink: 'syz.0.2859': attribute type 11 has an invalid length. [ 404.253357][T14154] gretap1: entered promiscuous mode [ 404.253977][T14159] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input27 [ 404.282367][T14166] netlink: 'syz.0.2859': attribute type 11 has an invalid length. [ 404.303888][T13900] hsr_slave_0: entered promiscuous mode [ 404.305500][T13900] hsr_slave_1: entered promiscuous mode [ 404.306249][T13900] debugfs: 'hsr0' already exists in 'hsr' [ 404.306269][T13900] Cannot create hsr debugfs directory [ 404.418922][T14165] IPv6: addrconf: prefix option has invalid lifetime [ 404.444581][T14165] netlink: 'syz.3.2863': attribute type 1 has an invalid length. [ 404.444613][T14165] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.2863'. [ 404.497450][T14175] FAULT_INJECTION: forcing a failure. [ 404.497450][T14175] name failslab, interval 1, probability 0, space 0, times 0 [ 404.497483][T14175] CPU: 1 UID: 0 PID: 14175 Comm: syz.4.2864 Not tainted syzkaller #0 PREEMPT(full) [ 404.497508][T14175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 404.497521][T14175] Call Trace: [ 404.497529][T14175] [ 404.497539][T14175] dump_stack_lvl+0xe8/0x150 [ 404.497581][T14175] should_fail_ex+0x3eb/0x540 [ 404.497615][T14175] should_failslab+0xa8/0x100 [ 404.497650][T14175] __kvmalloc_node_noprof+0x171/0x820 [ 404.497684][T14175] ? check_max_stack_depth+0x69/0x2d40 [ 404.497709][T14175] ? check_max_stack_depth+0x69/0x2d40 [ 404.497744][T14175] check_max_stack_depth+0x69/0x2d40 [ 404.497779][T14175] ? kasan_quarantine_put+0xbb/0x1f0 [ 404.497807][T14175] ? lockdep_hardirqs_on+0x7b/0x110 [ 404.497838][T14175] ? bpf_remove_fastcall_spills_fills+0xb00/0xb40 [ 404.497880][T14175] bpf_check+0x1d92/0x34e0 [ 404.497916][T14175] ? ktime_get_with_offset+0x93/0x2d0 [ 404.497948][T14175] ? ktime_get_with_offset+0x93/0x2d0 [ 404.497979][T14175] ? __pfx_bpf_check+0x10/0x10 [ 404.498005][T14175] ? bpf_obj_name_cpy+0x194/0x1e0 [ 404.498038][T14175] bpf_prog_load+0x14da/0x1c60 [ 404.498074][T14175] ? __pfx_bpf_prog_load+0x10/0x10 [ 404.498123][T14175] ? __might_fault+0xaf/0x130 [ 404.498154][T14175] __sys_bpf+0xd86/0xe00 [ 404.498185][T14175] ? __pfx___sys_bpf+0x10/0x10 [ 404.498219][T14175] ? __fget_files+0x2a/0x420 [ 404.498264][T14175] ? ksys_write+0x242/0x270 [ 404.498296][T14175] ? __pfx_ksys_write+0x10/0x10 [ 404.498333][T14175] __x64_sys_bpf+0xba/0xd0 [ 404.498368][T14175] do_syscall_64+0x166/0x520 [ 404.498393][T14175] ? trace_irq_disable+0x3b/0x140 [ 404.498424][T14175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.498447][T14175] ? clear_bhb_loop+0x70/0xc0 [ 404.498476][T14175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 404.498498][T14175] RIP: 0033:0x7f4e63d9fb19 [ 404.498519][T14175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 404.498538][T14175] RSP: 002b:00007f4e64cf2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 404.498563][T14175] RAX: ffffffffffffffda RBX: 00007f4e64025fa0 RCX: 00007f4e63d9fb19 [ 404.498580][T14175] RDX: 0000000000000094 RSI: 0000200000000340 RDI: 0000000000000005 [ 404.498595][T14175] RBP: 00007f4e64cf2090 R08: 0000000000000000 R09: 0000000000000000 [ 404.498609][T14175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 404.498623][T14175] R13: 00007f4e64026038 R14: 00007f4e64025fa0 R15: 00007ffe3105a0b8 [ 404.498658][T14175] [ 404.655793][T14165] syzkaller0: entered allmulticast mode [ 405.138605][T14190] netlink: 'syz.0.2870': attribute type 11 has an invalid length. [ 405.235758][T14192] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2871'. [ 405.322398][T14200] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2874'. [ 405.579692][T14206] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2876'. [ 405.879963][T13900] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 405.913630][T13900] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 405.914841][T13900] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 405.940129][T13900] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 405.948861][T13900] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 405.973855][T13900] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 405.976543][T13900] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 405.980155][T14225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2881'. [ 406.027324][T13900] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 406.407474][T13900] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.470492][T13900] 8021q: adding VLAN 0 to HW filter on device team0 [ 406.519601][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.519715][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 406.539516][T14255] xt_TPROXY: Can be used only with -p tcp or -p udp [ 406.558820][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.558910][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.136908][T14280] ipip0: entered promiscuous mode [ 407.181446][T14284] __nla_validate_parse: 5 callbacks suppressed [ 407.181479][T14284] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2901'. [ 407.374907][T14290] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2902'. [ 407.486363][T14302] ip_tables: iptables: counters copy to user failed while replacing table [ 407.567612][T14298] syzkaller0: entered promiscuous mode [ 407.567638][T14298] syzkaller0: entered allmulticast mode [ 410.287095][T14367] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 410.287140][T14367] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 410.288766][T14367] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 410.601676][T13900] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 410.650178][T14380] netlink: 'syz.0.2924': attribute type 27 has an invalid length. [ 410.661425][T14380] Bluetooth: hci0: unsupported parameter 5135 [ 410.661452][T14380] Bluetooth: hci0: unsupported parameter 8192 [ 410.661467][T14380] Bluetooth: hci0: unsupported parameter 5135 [ 410.661482][T14380] Bluetooth: hci0: unsupported parameter 8192 [ 410.744808][T13900] veth0_vlan: entered promiscuous mode [ 410.773888][T13900] veth1_vlan: entered promiscuous mode [ 410.824643][T14388] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2927'. [ 410.825048][T13900] veth0_macvtap: entered promiscuous mode [ 410.854054][T13900] veth1_macvtap: entered promiscuous mode [ 410.905674][T13900] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 410.933538][T13900] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 410.976969][T14392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2929'. [ 411.003942][T14392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2929'. [ 411.025404][ T201] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.025451][ T201] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.025507][ T201] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.025542][ T201] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.160398][ T31] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.160421][ T31] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.235945][ T1025] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.235970][ T1025] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.370188][T14399] syzkaller0: entered promiscuous mode [ 411.370215][T14399] syzkaller0: entered allmulticast mode [ 411.522552][T14408] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2933'. [ 411.788128][T14414] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 413.428419][T14426] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2939'. [ 413.668687][T14435] ip_tables: iptables: counters copy to user failed while replacing table [ 413.696528][T14436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2942'. [ 413.714317][T14436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2942'. [ 413.878227][ T5643] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 413.885477][ T5643] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 413.888339][ T5643] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 413.905384][ T5643] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 413.906987][ T5643] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 414.139155][ T1025] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.181811][T14452] ip_tables: iptables: counters copy to user failed while replacing table [ 414.315250][T14451] syzkaller0: entered promiscuous mode [ 414.315278][T14451] syzkaller0: entered allmulticast mode [ 414.455303][ T1025] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.974662][ T5644] Bluetooth: hci1: command tx timeout [ 416.021319][T14472] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2953'. [ 416.095227][ T1025] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.181322][T14438] hsr0 speed is unknown, defaulting to 1000 [ 416.278934][ T1025] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 416.391098][T14479] tipc: Enabled bearer , priority 0 [ 416.598708][T14479] syzkaller0: entered promiscuous mode [ 416.598734][T14479] syzkaller0: entered allmulticast mode [ 416.613892][T14479] tipc: Resetting bearer [ 416.671956][T14478] tipc: Resetting bearer [ 416.799318][T14503] ip_tables: iptables: counters copy to user failed while replacing table [ 417.161131][T14510] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2965'. [ 418.060715][ T5644] Bluetooth: hci1: command tx timeout [ 418.574440][T14478] tipc: Disabling bearer [ 418.605041][T14506] veth12: entered allmulticast mode [ 418.654680][T14515] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2966'. [ 418.656000][T14023] tipc: Node number set to 1622789297 [ 419.025755][T14535] netlink: 'syz.4.2972': attribute type 1 has an invalid length. [ 419.044881][T14537] netlink: 'syz.4.2972': attribute type 1 has an invalid length. [ 419.066461][T14538] Bluetooth: MGMT ver 1.23 [ 419.228854][T14549] openvswitch: netlink: Flow actions attr not present in new flow. [ 419.603424][T14570] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 419.975647][ T1025] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 419.975676][ T1025] bridge1 (unregistering): left promiscuous mode [ 420.035414][ T1025] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 420.035445][ T1025] bridge2 (unregistering): left promiscuous mode [ 420.035465][ T1025] bridge2 (unregistering): left allmulticast mode [ 420.065851][ T1025] bond0 (unregistering): Released all slaves [ 420.103979][ T1025] bond1 (unregistering): Released all slaves [ 420.124727][ T1025] bond2 (unregistering): Released all slaves [ 420.130754][ T5644] Bluetooth: hci1: command tx timeout [ 420.245618][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 420.343503][ T1025] tipc: Disabling bearer [ 420.347152][ T1025] tipc: Left network mode [ 420.410402][ T1025] IPVS: stopping master sync thread 9610 ... [ 420.584608][T14587] syzkaller0: entered promiscuous mode [ 420.584636][T14587] syzkaller0: entered allmulticast mode [ 422.216194][ T5644] Bluetooth: hci1: command tx timeout [ 422.428476][T14604] bond2: option ad_select: invalid value (34) [ 422.439562][T14604] bond2 (unregistering): Released all slaves [ 422.566530][T14626] ip_tables: iptables: counters copy to user failed while replacing table [ 422.567372][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 422.628021][T14604] netlink: 208 bytes leftover after parsing attributes in process `syz.2.2986'. [ 422.948298][T14438] bridge0: port 1(bridge_slave_0) entered blocking state [ 422.948485][T14438] bridge0: port 1(bridge_slave_0) entered disabled state [ 422.948622][T14438] bridge_slave_0: entered allmulticast mode [ 422.980278][T14438] bridge_slave_0: entered promiscuous mode [ 422.993959][T14438] bridge0: port 2(bridge_slave_1) entered blocking state [ 422.994144][T14438] bridge0: port 2(bridge_slave_1) entered disabled state [ 422.994306][T14438] bridge_slave_1: entered allmulticast mode [ 423.018422][T14438] bridge_slave_1: entered promiscuous mode [ 423.345198][T14438] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 423.361638][T14438] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 423.621100][ T1025] hsr_slave_0: left promiscuous mode [ 423.626208][ T1025] hsr_slave_1: left promiscuous mode [ 423.646527][ T1025] veth1_macvtap: left promiscuous mode [ 423.646567][ T1025] veth0_macvtap: left promiscuous mode [ 423.774806][T14670] ip_tables: iptables: counters copy to user failed while replacing table [ 424.561848][ T5296] 8021q: adding VLAN 0 to HW filter on device eth5 [ 424.699415][T14438] team0: Port device team_slave_0 added [ 424.706397][T14438] team0: Port device team_slave_1 added [ 424.825151][T14697] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3003'. [ 424.836227][T14695] bond0: entered promiscuous mode [ 424.836250][T14695] bond_slave_0: entered promiscuous mode [ 424.836664][T14695] bond_slave_1: entered promiscuous mode [ 424.859354][T14695] bond0: left promiscuous mode [ 424.859376][T14695] bond_slave_0: left promiscuous mode [ 424.859594][T14695] bond_slave_1: left promiscuous mode [ 424.926669][T14438] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 424.926689][T14438] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 424.926720][T14438] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 424.968868][T14438] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 424.968886][T14438] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 424.968915][T14438] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 425.068457][ T1025] IPVS: stop unused estimator thread 0... [ 425.278056][T14438] hsr_slave_0: entered promiscuous mode [ 425.290446][T14438] hsr_slave_1: entered promiscuous mode [ 425.295756][T14438] debugfs: 'hsr0' already exists in 'hsr' [ 425.295813][T14438] Cannot create hsr debugfs directory [ 425.461443][T14716] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input28 [ 425.488223][T14724] ip_tables: iptables: counters copy to user failed while replacing table [ 425.575272][T14716] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3008'. [ 425.854547][T14736] tipc: Enabled bearer , priority 0 [ 425.968258][T14739] syzkaller0: entered promiscuous mode [ 425.968285][T14739] syzkaller0: entered allmulticast mode [ 425.968991][T14739] tipc: Resetting bearer [ 426.077442][T14735] tipc: Resetting bearer [ 426.097649][T14745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3017'. [ 426.127437][T14747] ip_tables: iptables: counters copy to user failed while replacing table [ 427.679531][T14735] tipc: Disabling bearer [ 427.694224][ T5296] 8021q: adding VLAN 0 to HW filter on device eth6 [ 427.767863][T14753] veth14: entered allmulticast mode [ 428.081000][T14771] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3025'. [ 428.183797][T14776] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 428.185907][T14776] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 428.447828][T14783] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3030'. [ 428.547589][T14783] ipvlan2: entered promiscuous mode [ 428.559631][T14789] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3032'. [ 428.577803][T14787] siw: device registration error -23 [ 429.089074][T14438] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 429.119812][T14438] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 429.129823][T14438] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 429.148341][T14438] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 429.166071][T14438] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 429.194388][T14438] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 429.195415][T14438] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 429.234856][T14438] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 429.235232][T14810] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 429.254652][T14818] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 429.455458][T14833] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3041'. [ 429.534451][T14819] tipc: Enabling of bearer rejected, failed to enable media [ 429.816474][T14438] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.821031][T14847] IPv6: addrconf: prefix option has invalid lifetime [ 429.837019][T14847] netlink: 'syz.0.3043': attribute type 1 has an invalid length. [ 429.837043][T14847] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3043'. [ 429.879016][T14847] syzkaller0: entered allmulticast mode [ 429.931536][T14438] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.953381][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.953484][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.987940][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.988048][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.064283][T14858] FAULT_INJECTION: forcing a failure. [ 430.064283][T14858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 430.064306][T14858] CPU: 1 UID: 0 PID: 14858 Comm: syz.2.3046 Not tainted syzkaller #0 PREEMPT(full) [ 430.064324][T14858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 430.064334][T14858] Call Trace: [ 430.064340][T14858] [ 430.064346][T14858] dump_stack_lvl+0xe8/0x150 [ 430.064378][T14858] should_fail_ex+0x3eb/0x540 [ 430.064401][T14858] _copy_from_iter+0x1d3/0x1680 [ 430.064419][T14858] ? __alloc_skb+0x27a/0x7a0 [ 430.064448][T14858] ? __alloc_skb+0x27a/0x7a0 [ 430.064474][T14858] ? __alloc_skb+0x27a/0x7a0 [ 430.064499][T14858] ? __pfx__copy_from_iter+0x10/0x10 [ 430.064515][T14858] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 430.064533][T14858] ? __alloc_skb+0x27a/0x7a0 [ 430.064556][T14858] ? __alloc_skb+0x27a/0x7a0 [ 430.064584][T14858] ? netlink_sendmsg+0x64f/0xb20 [ 430.064608][T14858] ? skb_put+0x112/0x210 [ 430.064625][T14858] netlink_sendmsg+0x6bb/0xb20 [ 430.064653][T14858] ? __pfx_netlink_sendmsg+0x10/0x10 [ 430.064682][T14858] ? aa_sock_msg_perm+0x144/0x210 [ 430.064702][T14858] ? apparmor_socket_sendmsg+0x98/0x360 [ 430.064728][T14858] ? __pfx_netlink_sendmsg+0x10/0x10 [ 430.064751][T14858] sock_sendmsg_nosec+0x14e/0x190 [ 430.064775][T14858] ____sys_sendmsg+0x54e/0x850 [ 430.064796][T14858] ? __pfx_____sys_sendmsg+0x10/0x10 [ 430.064820][T14858] ? import_iovec+0x73/0xa0 [ 430.064843][T14858] ___sys_sendmsg+0x2a5/0x360 [ 430.064858][T14858] ? __lock_acquire+0x747/0x2de0 [ 430.064895][T14858] ? __pfx____sys_sendmsg+0x10/0x10 [ 430.064938][T14858] ? __fget_files+0x3a2/0x420 [ 430.064957][T14858] ? __fget_files+0x2a/0x420 [ 430.064983][T14858] __x64_sys_sendmsg+0x1b1/0x290 [ 430.065001][T14858] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 430.065034][T14858] do_syscall_64+0x166/0x520 [ 430.065052][T14858] ? trace_irq_disable+0x3b/0x140 [ 430.065101][T14858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.065123][T14858] ? clear_bhb_loop+0x70/0xc0 [ 430.065150][T14858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.065185][T14858] RIP: 0033:0x7f7154b9fb19 [ 430.065200][T14858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.065213][T14858] RSP: 002b:00007f71559e2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 430.065229][T14858] RAX: ffffffffffffffda RBX: 00007f7154e25fa0 RCX: 00007f7154b9fb19 [ 430.065240][T14858] RDX: 0000000000040080 RSI: 0000200000000000 RDI: 0000000000000007 [ 430.065249][T14858] RBP: 00007f71559e2090 R08: 0000000000000000 R09: 0000000000000000 [ 430.065259][T14858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 430.065268][T14858] R13: 00007f7154e26038 R14: 00007f7154e25fa0 R15: 00007ffc93bef408 [ 430.065292][T14858] [ 431.039950][T14890] IPv6: addrconf: prefix option has invalid lifetime [ 431.053517][T14890] netlink: 'syz.0.3056': attribute type 1 has an invalid length. [ 431.053539][T14890] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3056'. [ 431.058248][T14890] syzkaller0: entered allmulticast mode [ 431.859471][T14438] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 431.933750][T14918] FAULT_INJECTION: forcing a failure. [ 431.933750][T14918] name failslab, interval 1, probability 0, space 0, times 0 [ 431.933781][T14918] CPU: 1 UID: 0 PID: 14918 Comm: syz.4.3060 Not tainted syzkaller #0 PREEMPT(full) [ 431.933806][T14918] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 431.933819][T14918] Call Trace: [ 431.933827][T14918] [ 431.933836][T14918] dump_stack_lvl+0xe8/0x150 [ 431.933876][T14918] should_fail_ex+0x3eb/0x540 [ 431.933906][T14918] ? __alloc_skb+0x1db/0x7a0 [ 431.933938][T14918] should_failslab+0xa8/0x100 [ 431.933972][T14918] ? __alloc_skb+0x1db/0x7a0 [ 431.934002][T14918] kmem_cache_alloc_node_noprof+0x9c/0x600 [ 431.934028][T14918] ? __alloc_skb+0x18d/0x7a0 [ 431.934061][T14918] ? __alloc_skb+0x1db/0x7a0 [ 431.934099][T14918] __alloc_skb+0x1db/0x7a0 [ 431.934137][T14918] netlink_sendmsg+0x5cd/0xb20 [ 431.934176][T14918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 431.934211][T14918] ? aa_sock_msg_perm+0x144/0x210 [ 431.934238][T14918] ? apparmor_socket_sendmsg+0x18b/0x360 [ 431.934270][T14918] ? __pfx_netlink_sendmsg+0x10/0x10 [ 431.934301][T14918] sock_sendmsg_nosec+0x14e/0x190 [ 431.934331][T14918] ____sys_sendmsg+0x54e/0x850 [ 431.934360][T14918] ? __pfx_____sys_sendmsg+0x10/0x10 [ 431.934393][T14918] ? import_iovec+0x73/0xa0 [ 431.934423][T14918] ___sys_sendmsg+0x2a5/0x360 [ 431.934443][T14918] ? __lock_acquire+0x747/0x2de0 [ 431.934476][T14918] ? __pfx____sys_sendmsg+0x10/0x10 [ 431.934539][T14918] ? __fget_files+0x3a2/0x420 [ 431.934574][T14918] ? __fget_files+0x2a/0x420 [ 431.934612][T14918] __x64_sys_sendmsg+0x1b1/0x290 [ 431.934639][T14918] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 431.934683][T14918] do_syscall_64+0x166/0x520 [ 431.934707][T14918] ? trace_irq_disable+0x3b/0x140 [ 431.934736][T14918] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.934759][T14918] ? clear_bhb_loop+0x70/0xc0 [ 431.934786][T14918] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.934807][T14918] RIP: 0033:0x7f4e63d9fb19 [ 431.934827][T14918] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.934845][T14918] RSP: 002b:00007f4e64cf2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 431.934868][T14918] RAX: ffffffffffffffda RBX: 00007f4e64025fa0 RCX: 00007f4e63d9fb19 [ 431.934883][T14918] RDX: 0000000020000084 RSI: 0000200000000940 RDI: 0000000000000003 [ 431.934896][T14918] RBP: 00007f4e64cf2090 R08: 0000000000000000 R09: 0000000000000000 [ 431.934909][T14918] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 431.934922][T14918] R13: 00007f4e64026038 R14: 00007f4e64025fa0 R15: 00007ffe3105a0b8 [ 431.934958][T14918] [ 432.271301][T14438] veth0_vlan: entered promiscuous mode [ 432.280037][T14438] veth1_vlan: entered promiscuous mode [ 432.390186][T14438] veth0_macvtap: entered promiscuous mode [ 432.404337][T14438] veth1_macvtap: entered promiscuous mode [ 432.427927][T14438] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 432.453912][T14438] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 432.475072][T14928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3063'. [ 432.511724][ T201] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.511771][ T201] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.511808][ T201] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.575065][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.700518][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 432.700541][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 432.748615][T14934] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3065'. [ 432.788427][T14934] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3065'. [ 432.809582][T14934] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3065'. [ 432.865646][T14934] vlan2: entered allmulticast mode [ 432.865666][T14934] dummy0: entered allmulticast mode [ 432.896161][ T31] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 432.896184][ T31] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 432.949912][T14945] netlink: 'syz.4.3068': attribute type 1 has an invalid length. [ 432.949937][T14945] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3068'. [ 432.980172][T14945] syzkaller0: entered allmulticast mode [ 433.147193][T14952] siw: device registration error -23 [ 433.822838][ T5643] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 433.827196][ T5643] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 433.828716][ T5643] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 433.856472][T14971] openvswitch: netlink: Message has -3 unknown bytes. [ 433.857367][ T5643] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 433.858066][ T5643] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 434.253738][T14987] ip_tables: iptables: counters copy to user failed while replacing table [ 434.699430][ T1012] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.726116][T15008] netlink: 'syz.4.3082': attribute type 1 has an invalid length. [ 434.726139][T15008] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.3082'. [ 434.997019][ T1012] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.050886][T15008] syzkaller0: entered allmulticast mode [ 435.145964][ T1012] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.213200][T15028] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3088'. [ 435.213257][T15028] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3088'. [ 435.268600][T15021] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3086'. [ 435.327002][T15032] FAULT_INJECTION: forcing a failure. [ 435.327002][T15032] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.327034][T15032] CPU: 0 UID: 0 PID: 15032 Comm: syz.4.3089 Not tainted syzkaller #0 PREEMPT(full) [ 435.327059][T15032] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 435.327073][T15032] Call Trace: [ 435.327081][T15032] [ 435.327091][T15032] dump_stack_lvl+0xe8/0x150 [ 435.327132][T15032] should_fail_ex+0x3eb/0x540 [ 435.327165][T15032] _copy_from_user+0x2d/0xb0 [ 435.327194][T15032] __sys_bpf+0x2e7/0xe00 [ 435.327226][T15032] ? __pfx___sys_bpf+0x10/0x10 [ 435.327261][T15032] ? __fget_files+0x2a/0x420 [ 435.327306][T15032] ? ksys_write+0x242/0x270 [ 435.327337][T15032] ? __pfx_ksys_write+0x10/0x10 [ 435.327372][T15032] __x64_sys_bpf+0xba/0xd0 [ 435.327408][T15032] do_syscall_64+0x166/0x520 [ 435.327432][T15032] ? trace_irq_disable+0x3b/0x140 [ 435.327462][T15032] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.327485][T15032] ? clear_bhb_loop+0x70/0xc0 [ 435.327511][T15032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.327533][T15032] RIP: 0033:0x7f4e63d9fb19 [ 435.327552][T15032] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.327570][T15032] RSP: 002b:00007f4e64cf2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 435.327593][T15032] RAX: ffffffffffffffda RBX: 00007f4e64025fa0 RCX: 00007f4e63d9fb19 [ 435.327609][T15032] RDX: 0000000000000094 RSI: 0000200000000080 RDI: 0000000000000005 [ 435.327623][T15032] RBP: 00007f4e64cf2090 R08: 0000000000000000 R09: 0000000000000000 [ 435.327637][T15032] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.327650][T15032] R13: 00007f4e64026038 R14: 00007f4e64025fa0 R15: 00007ffe3105a0b8 [ 435.327685][T15032] [ 435.494820][ T1012] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 435.625326][T15026] syzkaller1: entered promiscuous mode [ 435.625351][T15026] syzkaller1: entered allmulticast mode [ 435.726969][T14977] hsr0 speed is unknown, defaulting to 1000 [ 435.874069][T15048] netlink: 'syz.1.3092': attribute type 1 has an invalid length. [ 435.874093][T15048] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3092'. [ 435.911639][T15048] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3092'. [ 435.911679][T15048] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3092'. [ 435.970893][ T5644] Bluetooth: hci3: command tx timeout [ 436.229440][T15052] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3093'. [ 436.337934][ T1012] bridge_slave_1: left allmulticast mode [ 436.337962][ T1012] bridge_slave_1: left promiscuous mode [ 436.338179][ T1012] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.390155][ T1012] bridge_slave_0: left allmulticast mode [ 436.390189][ T1012] bridge_slave_0: left promiscuous mode [ 436.391847][ T1012] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.425843][T15056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3094'. [ 436.453253][T15056] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3094'. [ 436.744860][T15064] netlink: 'syz.1.3096': attribute type 1 has an invalid length. [ 436.744884][T15064] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3096'. [ 436.837410][ T1012] bond2 (unregistering): (slave ip6gretap1): Removing an active aggregator [ 436.837934][ T1012] bond2 (unregistering): (slave ip6gretap1): Releasing backup interface [ 436.861765][ T1012] ip6gretap1 (unregistering): left allmulticast mode [ 436.976805][T15077] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 436.977036][T15077] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 437.406818][ T1012] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 437.406849][ T1012] bridge1 (unregistering): left promiscuous mode [ 437.456414][ T1012] bond1 (unregistering): Released all slaves [ 437.480013][ T1012] bond2 (unregistering): Released all slaves [ 437.691958][T15074] syzkaller0: entered allmulticast mode [ 437.711992][ T1012] tipc: Left network mode [ 437.797516][T15066] netlink: 'syz.1.3096': attribute type 1 has an invalid length. [ 437.798297][T15069] netlink: 'syz.4.3097': attribute type 1 has an invalid length. [ 437.827051][T15098] netlink: 'syz.3.3103': attribute type 1 has an invalid length. [ 438.050848][ T5644] Bluetooth: hci3: command tx timeout [ 439.195165][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 439.536463][T15155] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input29 [ 440.133141][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.133793][ T5644] Bluetooth: hci3: command tx timeout [ 440.206520][ T1012] hsr_slave_0: left promiscuous mode [ 440.222900][ T1012] hsr_slave_1: left promiscuous mode [ 440.223881][ T1012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 440.223904][ T1012] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 440.242193][ T1012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 440.242270][ T1012] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 440.306704][ T1012] veth1_macvtap: left promiscuous mode [ 440.306746][ T1012] veth0_macvtap: left promiscuous mode [ 440.306868][ T1012] veth1_vlan: left promiscuous mode [ 440.311919][ T1012] veth0_vlan: left promiscuous mode [ 440.459797][T15197] __nla_validate_parse: 8 callbacks suppressed [ 440.459821][T15197] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.3124'. [ 440.530805][ T5644] Bluetooth: hci4: command 0x0405 tx timeout [ 440.899827][T13968] smc: removing ib device syz0 [ 441.009993][T15208] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3126'. [ 441.296990][ T1012] team0 (unregistering): Port device team_slave_1 removed [ 441.316385][ T1012] team0 (unregistering): Port device team_slave_0 removed [ 441.582634][T14977] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.582847][T14977] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.582990][T14977] bridge_slave_0: entered allmulticast mode [ 441.589022][T14977] bridge_slave_0: entered promiscuous mode [ 441.624600][T14977] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.624706][T14977] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.624874][T14977] bridge_slave_1: entered allmulticast mode [ 441.648355][T14977] bridge_slave_1: entered promiscuous mode [ 441.722577][T13968] smbdirect: ib_dev[syz0] removed [ 441.842046][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 441.844212][T14023] infiniband syz0: ib_query_port failed (-19) [ 442.146687][T14977] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 442.192685][T14977] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 442.215838][ T5644] Bluetooth: hci3: command tx timeout [ 442.375827][T15234] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3136'. [ 442.410103][T14977] team0: Port device team_slave_0 added [ 442.469773][T14977] team0: Port device team_slave_1 added [ 442.617276][T15243] FAULT_INJECTION: forcing a failure. [ 442.617276][T15243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 442.617308][T15243] CPU: 0 UID: 0 PID: 15243 Comm: syz.4.3139 Not tainted syzkaller #0 PREEMPT(full) [ 442.617332][T15243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 442.617345][T15243] Call Trace: [ 442.617354][T15243] [ 442.617363][T15243] dump_stack_lvl+0xe8/0x150 [ 442.617404][T15243] should_fail_ex+0x3eb/0x540 [ 442.617435][T15243] _copy_from_user+0x2d/0xb0 [ 442.617464][T15243] __sys_bpf+0x2e7/0xe00 [ 442.617496][T15243] ? __pfx___sys_bpf+0x10/0x10 [ 442.617533][T15243] ? __fget_files+0x2a/0x420 [ 442.617580][T15243] ? ksys_write+0x242/0x270 [ 442.617611][T15243] ? __pfx_ksys_write+0x10/0x10 [ 442.617656][T15243] __x64_sys_bpf+0xba/0xd0 [ 442.617706][T15243] do_syscall_64+0x166/0x520 [ 442.617745][T15243] ? trace_irq_disable+0x3b/0x140 [ 442.617772][T15243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.617793][T15243] ? clear_bhb_loop+0x70/0xc0 [ 442.617819][T15243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 442.617840][T15243] RIP: 0033:0x7f4e63d9fb19 [ 442.617858][T15243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 442.617876][T15243] RSP: 002b:00007f4e64cf2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 442.617898][T15243] RAX: ffffffffffffffda RBX: 00007f4e64025fa0 RCX: 00007f4e63d9fb19 [ 442.617912][T15243] RDX: 000000000000004c RSI: 0000200000000a80 RDI: 000000000000000a [ 442.617925][T15243] RBP: 00007f4e64cf2090 R08: 0000000000000000 R09: 0000000000000000 [ 442.617938][T15243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 442.617949][T15243] R13: 00007f4e64026038 R14: 00007f4e64025fa0 R15: 00007ffe3105a0b8 [ 442.617983][T15243] [ 442.963231][T14977] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 442.963252][T14977] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.963281][T14977] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 442.988733][T14977] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 442.988783][T14977] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 442.988855][T14977] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 443.106989][T15259] FAULT_INJECTION: forcing a failure. [ 443.106989][T15259] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 443.107025][T15259] CPU: 0 UID: 0 PID: 15259 Comm: syz.3.3145 Not tainted syzkaller #0 PREEMPT(full) [ 443.107050][T15259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 443.107064][T15259] Call Trace: [ 443.107073][T15259] [ 443.107082][T15259] dump_stack_lvl+0xe8/0x150 [ 443.107123][T15259] should_fail_ex+0x3eb/0x540 [ 443.107155][T15259] prepare_alloc_pages+0x21e/0x5f0 [ 443.107200][T15259] __alloc_frozen_pages_noprof+0x17c/0x410 [ 443.107235][T15259] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 443.107263][T15259] ? __alloc_frozen_pages_noprof+0x24c/0x410 [ 443.107296][T15259] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 443.107338][T15259] __alloc_pages_noprof+0x10/0x100 [ 443.107369][T15259] alloc_pages_bulk_noprof+0x67a/0x8a0 [ 443.107408][T15259] ? alloc_pages_noprof+0x140/0x2b0 [ 443.107448][T15259] __kasan_populate_vmalloc+0xb7/0x1c0 [ 443.107495][T15259] alloc_vmap_area+0xd10/0x1410 [ 443.107534][T15259] ? __pfx_alloc_vmap_area+0x10/0x10 [ 443.107552][T15259] ? __kmalloc_cache_node_noprof+0x3cc/0x620 [ 443.107581][T15259] ? __kmalloc_cache_node_noprof+0x1f2/0x620 [ 443.107607][T15259] ? __get_vm_area_node+0x155/0x2f0 [ 443.107634][T15259] __get_vm_area_node+0x200/0x2f0 [ 443.107664][T15259] __vmalloc_node_range_noprof+0x36e/0x16f0 [ 443.107690][T15259] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 443.107713][T15259] ? lock_acquire+0x115/0x350 [ 443.107742][T15259] ? __lock_acquire+0x747/0x2de0 [ 443.107804][T15259] ? hook_capable+0x1c3/0x5e0 [ 443.107839][T15259] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 443.107874][T15259] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 443.107895][T15259] __vmalloc_noprof+0xd2/0x120 [ 443.107918][T15259] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 443.107943][T15259] bpf_prog_alloc_no_stats+0x47/0x550 [ 443.107963][T15259] ? bpf_prog_alloc+0x2a/0x1a0 [ 443.107987][T15259] bpf_prog_alloc+0x3c/0x1a0 [ 443.108012][T15259] bpf_prog_load+0x7f8/0x1c60 [ 443.108048][T15259] ? __pfx_bpf_prog_load+0x10/0x10 [ 443.108088][T15259] ? __might_fault+0xaf/0x130 [ 443.108119][T15259] __sys_bpf+0xd86/0xe00 [ 443.108149][T15259] ? __pfx___sys_bpf+0x10/0x10 [ 443.108190][T15259] ? __fget_files+0x2a/0x420 [ 443.108236][T15259] ? ksys_write+0x242/0x270 [ 443.108268][T15259] ? __pfx_ksys_write+0x10/0x10 [ 443.108303][T15259] __x64_sys_bpf+0xba/0xd0 [ 443.108340][T15259] do_syscall_64+0x166/0x520 [ 443.108365][T15259] ? trace_irq_disable+0x3b/0x140 [ 443.108396][T15259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.108418][T15259] ? clear_bhb_loop+0x70/0xc0 [ 443.108445][T15259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.108468][T15259] RIP: 0033:0x7f630679fb19 [ 443.108489][T15259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.108508][T15259] RSP: 002b:00007f6307712028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 443.108532][T15259] RAX: ffffffffffffffda RBX: 00007f6306a25fa0 RCX: 00007f630679fb19 [ 443.108549][T15259] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 443.108564][T15259] RBP: 00007f6307712090 R08: 0000000000000000 R09: 0000000000000000 [ 443.108578][T15259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.108591][T15259] R13: 00007f6306a26038 R14: 00007f6306a25fa0 R15: 00007ffeab66ce28 [ 443.108626][T15259] [ 443.108721][T15259] syz.3.3145: vmalloc error: size 4096, align 0x1, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 443.108803][T15259] CPU: 0 UID: 0 PID: 15259 Comm: syz.3.3145 Not tainted syzkaller #0 PREEMPT(full) [ 443.108828][T15259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 443.108841][T15259] Call Trace: [ 443.108850][T15259] [ 443.108859][T15259] dump_stack_lvl+0xe8/0x150 [ 443.108896][T15259] warn_alloc+0x24d/0x270 [ 443.108926][T15259] ? lockdep_hardirqs_on+0x7b/0x110 [ 443.108953][T15259] ? __pfx_warn_alloc+0x10/0x10 [ 443.108979][T15259] ? kfree+0x1c5/0x650 [ 443.109008][T15259] ? __get_vm_area_node+0x219/0x2f0 [ 443.109040][T15259] __vmalloc_node_range_noprof+0x396/0x16f0 [ 443.109068][T15259] ? lock_acquire+0x115/0x350 [ 443.109098][T15259] ? __lock_acquire+0x747/0x2de0 [ 443.109141][T15259] ? hook_capable+0x1c3/0x5e0 [ 443.109175][T15259] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 443.109219][T15259] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 443.109240][T15259] __vmalloc_noprof+0xd2/0x120 [ 443.109263][T15259] ? bpf_prog_alloc_no_stats+0x47/0x550 [ 443.109289][T15259] bpf_prog_alloc_no_stats+0x47/0x550 [ 443.109309][T15259] ? bpf_prog_alloc+0x2a/0x1a0 [ 443.109332][T15259] bpf_prog_alloc+0x3c/0x1a0 [ 443.109354][T15259] bpf_prog_load+0x7f8/0x1c60 [ 443.109390][T15259] ? __pfx_bpf_prog_load+0x10/0x10 [ 443.109430][T15259] ? __might_fault+0xaf/0x130 [ 443.109460][T15259] __sys_bpf+0xd86/0xe00 [ 443.109487][T15259] ? __pfx___sys_bpf+0x10/0x10 [ 443.109517][T15259] ? __fget_files+0x2a/0x420 [ 443.109560][T15259] ? ksys_write+0x242/0x270 [ 443.109592][T15259] ? __pfx_ksys_write+0x10/0x10 [ 443.109627][T15259] __x64_sys_bpf+0xba/0xd0 [ 443.109661][T15259] do_syscall_64+0x166/0x520 [ 443.109685][T15259] ? trace_irq_disable+0x3b/0x140 [ 443.109717][T15259] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.109739][T15259] ? clear_bhb_loop+0x70/0xc0 [ 443.109767][T15259] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.109789][T15259] RIP: 0033:0x7f630679fb19 [ 443.109808][T15259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.109827][T15259] RSP: 002b:00007f6307712028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 443.109850][T15259] RAX: ffffffffffffffda RBX: 00007f6306a25fa0 RCX: 00007f630679fb19 [ 443.109866][T15259] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 443.109880][T15259] RBP: 00007f6307712090 R08: 0000000000000000 R09: 0000000000000000 [ 443.109895][T15259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.109908][T15259] R13: 00007f6306a26038 R14: 00007f6306a25fa0 R15: 00007ffeab66ce28 [ 443.109944][T15259] [ 443.109960][T15259] Mem-Info: [ 443.109971][T15259] active_anon:5650 inactive_anon:0 isolated_anon:0 [ 443.109971][T15259] active_file:322 inactive_file:43409 isolated_file:0 [ 443.109971][T15259] unevictable:0 dirty:356 writeback:0 [ 443.109971][T15259] slab_reclaimable:11293 slab_unreclaimable:97149 [ 443.109971][T15259] mapped:29734 shmem:526 pagetables:1253 [ 443.109971][T15259] sec_pagetables:0 bounce:0 [ 443.109971][T15259] kernel_misc_reclaimable:0 [ 443.109971][T15259] free:1318814 free_pcp:10149 free_cma:0 [ 443.110038][T15259] Node 0 active_anon:22600kB inactive_anon:0kB active_file:1288kB inactive_file:173436kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:118936kB dirty:1420kB writeback:0kB shmem:2104kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:11672kB pagetables:4884kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 443.110100][T15259] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 443.110156][T15259] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 443.110228][T15259] lowmem_reserve[]: 0 2463 2465 2465 2465 [ 443.110268][T15259] Node 0 DMA32 free:1329356kB boost:0kB min:33936kB low:42420kB high:50904kB reserved_highatomic:0kB free_highatomic:0kB active_anon:22600kB inactive_anon:0kB active_file:1288kB inactive_file:173436kB unevictable:0kB writepending:1420kB zspages:0kB present:3129332kB managed:2523116kB mlocked:0kB bounce:0kB free_pcp:40592kB local_pcp:19984kB free_cma:0kB [ 443.110336][T15259] lowmem_reserve[]: 0 0 1 1 1 [ 443.110373][T15259] Node 0 Normal free:0kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1660kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 443.110436][T15259] lowmem_reserve[]: 0 0 0 0 0 [ 443.110473][T15259] Node 1 Normal free:3930540kB boost:0kB min:55940kB low:69924kB high:83908kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 443.110538][T15259] lowmem_reserve[]: 0 0 0 0 0 [ 443.234151][T15259] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 443.234532][T15259] Node 0 DMA32: 703*4kB (UME) 168*8kB (UME) 1219*16kB (UME) 1115*32kB (UME) 328*64kB (UME) 57*128kB (UME) 35*256kB (UME) 22*512kB (UME) 13*1024kB (UME) 2*2048kB (M) 294*4096kB (UM) = 1329484kB [ 443.235057][T15259] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 443.235335][T15259] Node 1 Normal: 1*4kB (M) 1*8kB (M) 10*16kB (UM) 12*32kB (UM) 8*64kB (UM) 3*128kB (UM) 4*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 0*2048kB 958*4096kB (UM) = 3930540kB [ 443.235604][T15259] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 443.235648][T15259] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 443.247527][T15259] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 443.247587][T15259] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 443.247631][T15259] 44253 total pagecache pages [ 443.247663][T15259] 0 pages in swap cache [ 443.247704][T15259] Free swap = 124996kB [ 443.247725][T15259] Total swap = 124996kB [ 443.247762][T15259] 2097051 pages RAM [ 443.247783][T15259] 0 pages HighMem/MovableOnly [ 443.247810][T15259] 434241 pages reserved [ 443.247832][T15259] 0 pages cma reserved [ 444.275200][T14977] hsr_slave_0: entered promiscuous mode [ 444.291678][T14977] hsr_slave_1: entered promiscuous mode [ 444.319994][T15257] tc_dump_action: action bad kind [ 445.169144][T15290] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3153'. [ 445.199372][ T5296] 8021q: adding VLAN 0 to HW filter on device eth5 [ 445.437097][T15293] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 445.551921][T15293] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 445.639432][T15303] ip_tables: iptables: counters copy to user failed while replacing table [ 445.927042][T15314] ip_tables: iptables: counters copy to user failed while replacing table [ 446.646682][ T201] IPVS: starting estimator thread 0... [ 446.732824][T15338] IPVS: using max 26 ests per chain, 62400 per kthread [ 446.765583][ T1012] IPVS: stop unused estimator thread 0... [ 446.991641][T15341] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3165'. [ 447.075309][T15345] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3166'. [ 447.106260][T15341] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3165'. [ 447.133159][T14977] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 447.162912][T14977] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 447.173884][T14977] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 447.209546][T14977] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 447.221211][T14977] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 447.257046][T14977] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 447.259853][T14977] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 447.298300][T14977] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 447.421891][T15352] siw: device registration error -23 [ 447.459112][T14977] 8021q: adding VLAN 0 to HW filter on device bond0 [ 447.504911][T14977] 8021q: adding VLAN 0 to HW filter on device team0 [ 447.538100][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.538219][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 447.569750][T13968] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.569900][T13968] bridge0: port 2(bridge_slave_1) entered forwarding state [ 447.784286][T15369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3170'. [ 448.145332][T15381] IPv6: addrconf: prefix option has invalid lifetime [ 448.167721][T15381] netlink: 'syz.2.3173': attribute type 1 has an invalid length. [ 448.167745][T15381] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.3173'. [ 448.192489][T15381] syzkaller0: entered allmulticast mode [ 448.193835][T15376] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 448.197250][T15378] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3172'. [ 448.209253][T15376] netlink: 'syz.1.3171': attribute type 11 has an invalid length. [ 448.674637][T15402] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3177'. [ 448.716675][T15402] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3177'. [ 449.059293][T15414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3182'. [ 449.116172][T14977] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 449.197470][T15418] sctp: [Deprecated]: syz.2.3183 (pid 15418) Use of struct sctp_assoc_value in delayed_ack socket option. [ 449.197470][T15418] Use struct sctp_sack_info instead [ 449.380699][T14977] veth0_vlan: entered promiscuous mode [ 449.436304][T14977] veth1_vlan: entered promiscuous mode [ 449.585445][T14977] veth0_macvtap: entered promiscuous mode [ 449.616071][T14977] veth1_macvtap: entered promiscuous mode [ 449.697160][T14977] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 449.735915][T14977] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 449.793208][T13968] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.793627][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.793665][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.793702][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.867159][T15437] FAULT_INJECTION: forcing a failure. [ 449.867159][T15437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 449.867202][T15437] CPU: 1 UID: 0 PID: 15437 Comm: syz.1.3186 Not tainted syzkaller #0 PREEMPT(full) [ 449.867226][T15437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 449.867240][T15437] Call Trace: [ 449.867250][T15437] [ 449.867259][T15437] dump_stack_lvl+0xe8/0x150 [ 449.867300][T15437] should_fail_ex+0x3eb/0x540 [ 449.867334][T15437] _copy_from_user+0x2d/0xb0 [ 449.867363][T15437] ___sys_sendmsg+0x1c6/0x360 [ 449.867386][T15437] ? __lock_acquire+0x747/0x2de0 [ 449.867421][T15437] ? __pfx____sys_sendmsg+0x10/0x10 [ 449.867486][T15437] ? __fget_files+0x3a2/0x420 [ 449.867514][T15437] ? __fget_files+0x2a/0x420 [ 449.867550][T15437] __x64_sys_sendmsg+0x1b1/0x290 [ 449.867579][T15437] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 449.867623][T15437] do_syscall_64+0x166/0x520 [ 449.867649][T15437] ? trace_irq_disable+0x3b/0x140 [ 449.867679][T15437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.867703][T15437] ? clear_bhb_loop+0x70/0xc0 [ 449.867732][T15437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.867754][T15437] RIP: 0033:0x7fdd36b9fb19 [ 449.867774][T15437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 449.867792][T15437] RSP: 002b:00007fdd37a0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 449.867816][T15437] RAX: ffffffffffffffda RBX: 00007fdd36e25fa0 RCX: 00007fdd36b9fb19 [ 449.867832][T15437] RDX: 0000000020000001 RSI: 0000200000000100 RDI: 0000000000000003 [ 449.867846][T15437] RBP: 00007fdd37a0f090 R08: 0000000000000000 R09: 0000000000000000 [ 449.867861][T15437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 449.867874][T15437] R13: 00007fdd36e26038 R14: 00007fdd36e25fa0 R15: 00007ffe7e583b78 [ 449.867909][T15437] [ 450.075075][T15443] siw: device registration error -23 [ 450.319039][T15451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3191'. [ 450.319486][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.319505][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.494781][T13968] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 450.494804][T13968] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 450.716648][T15462] ip_tables: iptables: counters copy to user failed while replacing table [ 451.088665][T15470] sctp: [Deprecated]: syz.1.3197 (pid 15470) Use of struct sctp_assoc_value in delayed_ack socket option. [ 451.088665][T15470] Use struct sctp_sack_info instead [ 451.507943][T15488] ip_tables: iptables: counters copy to user failed while replacing table [ 451.571495][T15488] syzkaller1: entered promiscuous mode [ 451.571521][T15488] syzkaller1: entered allmulticast mode [ 451.601780][T15488] netlink: 'syz.3.3201': attribute type 3 has an invalid length. [ 451.626657][ T5643] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 451.628821][ T5643] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 451.641686][ T5643] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 451.656630][ T5643] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 451.657365][ T5643] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 452.385950][T15518] __nla_validate_parse: 3 callbacks suppressed [ 452.385983][T15518] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3207'. [ 452.386192][T15520] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3206'. [ 452.401452][T15520] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3206'. [ 452.759621][T15536] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3213'. [ 452.759744][T15536] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3213'. [ 453.088865][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 453.106348][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 453.109677][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 453.223260][T15556] ip_tables: iptables: counters copy to user failed while replacing table [ 453.475825][T15563] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3221'. [ 453.501131][T15563] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3221'. [ 453.598143][ T201] IPVS: starting estimator thread 0... [ 453.650206][T15489] infiniband rxe0: set active [ 453.650229][T15489] infiniband rxe0: added rxe_eth0 [ 453.652045][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 453.691386][T15566] IPVS: using max 24 ests per chain, 57600 per kthread [ 453.694865][T15565] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3222'. [ 453.694917][T15565] openvswitch: netlink: Missing key (keys=40, expected=80) [ 453.712780][T15565] sch_tbf: burst 3 is lower than device ip6tnl0 mtu (1452) ! [ 453.732443][ T5644] Bluetooth: hci0: command tx timeout [ 453.740330][T15489] smbdirect: ib_dev[rxe0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 453.740369][T15489] smbdirect: ib_dev[rxe0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 453.740419][T15489] smbdirect: ib_dev[rxe0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 453.842236][T15489] RDS/IB: rxe0: added [ 453.842290][T15489] smc: adding ib device rxe0 with port count 1 [ 453.842308][T15489] smc: ib device rxe0 port 1 has no pnetid [ 453.884639][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 453.885365][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 454.146937][T15583] Bluetooth: MGMT ver 1.23 [ 454.181967][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 454.207103][T15584] erspan1: entered promiscuous mode [ 454.487905][T15596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3233'. [ 454.503593][T15596] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3233'. [ 454.641634][T15600] FAULT_INJECTION: forcing a failure. [ 454.641634][T15600] name failslab, interval 1, probability 0, space 0, times 0 [ 454.641665][T15600] CPU: 0 UID: 0 PID: 15600 Comm: syz.3.3236 Not tainted syzkaller #0 PREEMPT(full) [ 454.641689][T15600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 454.641703][T15600] Call Trace: [ 454.641711][T15600] [ 454.641720][T15600] dump_stack_lvl+0xe8/0x150 [ 454.641762][T15600] should_fail_ex+0x3eb/0x540 [ 454.641797][T15600] should_failslab+0xa8/0x100 [ 454.641837][T15600] __kmalloc_noprof+0xf9/0x710 [ 454.641863][T15600] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 454.641886][T15600] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 454.641916][T15600] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 454.641948][T15600] genl_family_rcv_msg_doit+0xda/0x340 [ 454.641977][T15600] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 454.642008][T15600] ? apparmor_capable+0x126/0x170 [ 454.642034][T15600] ? bpf_lsm_capable+0x9/0x20 [ 454.642052][T15600] ? security_capable+0x7e/0x2c0 [ 454.642087][T15600] genl_rcv_msg+0x614/0x7a0 [ 454.642115][T15600] ? __pfx_genl_rcv_msg+0x10/0x10 [ 454.642136][T15600] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 454.642172][T15600] netlink_rcv_skb+0x226/0x4a0 [ 454.642201][T15600] ? __pfx_genl_rcv_msg+0x10/0x10 [ 454.642224][T15600] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 454.642273][T15600] ? down_read+0x2b9/0x320 [ 454.642302][T15600] genl_rcv+0x28/0x40 [ 454.642323][T15600] netlink_unicast+0x8ef/0xa80 [ 454.642365][T15600] netlink_sendmsg+0x7f0/0xb20 [ 454.642399][T15600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 454.642430][T15600] ? aa_sock_msg_perm+0x144/0x210 [ 454.642455][T15600] ? apparmor_socket_sendmsg+0x98/0x360 [ 454.642484][T15600] ? __pfx_netlink_sendmsg+0x10/0x10 [ 454.642514][T15600] sock_sendmsg_nosec+0x14e/0x190 [ 454.642542][T15600] ____sys_sendmsg+0x54e/0x850 [ 454.642571][T15600] ? __pfx_____sys_sendmsg+0x10/0x10 [ 454.642606][T15600] ? import_iovec+0x73/0xa0 [ 454.642638][T15600] ___sys_sendmsg+0x2a5/0x360 [ 454.642659][T15600] ? __lock_acquire+0x747/0x2de0 [ 454.642692][T15600] ? __pfx____sys_sendmsg+0x10/0x10 [ 454.642753][T15600] ? __fget_files+0x3a2/0x420 [ 454.642777][T15600] ? __fget_files+0x2a/0x420 [ 454.642821][T15600] __x64_sys_sendmsg+0x1b1/0x290 [ 454.642849][T15600] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 454.642900][T15600] do_syscall_64+0x166/0x520 [ 454.642924][T15600] ? trace_irq_disable+0x3b/0x140 [ 454.642955][T15600] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.642979][T15600] ? clear_bhb_loop+0x70/0xc0 [ 454.643008][T15600] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.643031][T15600] RIP: 0033:0x7f630679fb19 [ 454.643053][T15600] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.643073][T15600] RSP: 002b:00007f6307712028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 454.643103][T15600] RAX: ffffffffffffffda RBX: 00007f6306a25fa0 RCX: 00007f630679fb19 [ 454.643120][T15600] RDX: 0000000004008094 RSI: 0000200000000040 RDI: 0000000000000003 [ 454.643135][T15600] RBP: 00007f6307712090 R08: 0000000000000000 R09: 0000000000000000 [ 454.643149][T15600] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.643162][T15600] R13: 00007f6306a26038 R14: 00007f6306a25fa0 R15: 00007ffeab66ce28 [ 454.643196][T15600] [ 455.062417][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 455.463838][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 455.686993][T15623] openvswitch: netlink: IPv4 tunnel dst address is zero [ 455.721001][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 455.811826][ T5644] Bluetooth: hci0: command tx timeout [ 455.956684][T15591] siw: device registration error -23 [ 456.054398][T15630] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 456.082121][T15489] hsr0 speed is unknown, defaulting to 1000 [ 456.088731][T15489] rxe_eth0 speed is unknown, defaulting to 1000 [ 457.230111][T15668] hsr0 speed is unknown, defaulting to 1000 [ 457.287788][T15668] rxe_eth0 speed is unknown, defaulting to 1000 [ 457.288746][T15670] netlink: 'syz.0.3252': attribute type 5 has an invalid length. [ 457.327726][T15489] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.329441][T15489] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.329589][T15489] bridge_slave_0: entered allmulticast mode [ 457.354200][T15489] bridge_slave_0: entered promiscuous mode [ 457.363692][T15489] bridge0: port 2(bridge_slave_1) entered blocking state [ 457.365393][T15489] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.365550][T15489] bridge_slave_1: entered allmulticast mode [ 457.367293][T15489] bridge_slave_1: entered promiscuous mode [ 457.406031][T15678] netlink: 'syz.1.3254': attribute type 4 has an invalid length. [ 457.406052][T15678] __nla_validate_parse: 1 callbacks suppressed [ 457.406065][T15678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3254'. [ 457.406084][T15678] nbd: must specify an index to disconnect [ 457.484109][T15489] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 457.488433][T15489] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 457.554263][T15489] team0: Port device team_slave_0 added [ 457.567531][T15489] team0: Port device team_slave_1 added [ 457.636962][T15489] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 457.636982][T15489] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.637011][T15489] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 457.668462][T15489] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 457.668527][T15489] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 457.684194][T15489] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 457.890760][ T5643] Bluetooth: hci0: command tx timeout [ 457.973058][T15489] hsr_slave_0: entered promiscuous mode [ 457.976267][T15489] hsr_slave_1: entered promiscuous mode [ 457.980323][T15489] debugfs: 'hsr0' already exists in 'hsr' [ 457.980346][T15489] Cannot create hsr debugfs directory [ 458.058760][T15689] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3255'. [ 458.317951][T15696] ip_tables: iptables: counters copy to user failed while replacing table [ 458.551467][T15489] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.723787][T15489] netdevsim netdevsim2 netdevsim2 (unregistering): left allmulticast mode [ 458.724954][T15489] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.797998][T15489] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.883253][T15489] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 458.943821][T15710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3261'. [ 458.943869][T15710] openvswitch: netlink: IP tunnel dst address not specified [ 459.073973][T15716] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3264'. [ 459.271081][T15718] netlink: 'syz.0.3265': attribute type 1 has an invalid length. [ 459.287653][T15718] sctp: [Deprecated]: syz.0.3265 (pid 15718) Use of int in max_burst socket option. [ 459.287653][T15718] Use struct sctp_assoc_value instead [ 459.291463][T15718] siw: device registration error -23 [ 459.436778][T15489] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 459.467414][T15489] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 459.479458][T15489] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 459.496409][T15489] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 459.507394][T15489] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 459.529371][T15489] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 459.538809][T15489] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 459.556892][T15489] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 459.591524][T15730] netlink: 'syz.4.3271': attribute type 1 has an invalid length. [ 459.632826][T15730] sctp: [Deprecated]: syz.4.3271 (pid 15730) Use of int in max_burst socket option. [ 459.632826][T15730] Use struct sctp_assoc_value instead [ 459.653997][T15730] siw: device registration error -23 [ 459.687308][T15742] erspan1: entered promiscuous mode [ 459.758332][T15748] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3273'. [ 459.924417][T15744] syzkaller1: entered promiscuous mode [ 459.924438][T15744] syzkaller1: entered allmulticast mode [ 459.972494][ T5643] Bluetooth: hci0: command 0x0419 tx timeout [ 460.057038][T15489] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.082755][T15762] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3276'. [ 460.086643][T15763] ip_tables: iptables: counters copy to user failed while replacing table [ 460.121752][T15489] 8021q: adding VLAN 0 to HW filter on device team0 [ 460.152109][ T65] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.152212][ T65] bridge0: port 1(bridge_slave_0) entered forwarding state [ 460.198472][ T65] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.198587][ T65] bridge0: port 2(bridge_slave_1) entered forwarding state [ 460.428432][T15770] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3278'. [ 460.428669][T15771] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3278'. [ 460.574390][T15776] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3279'. [ 461.023960][ T30] audit: type=1800 audit(1793946476.384:4): pid=15791 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3280" name="blkio.bfq.time_recursive" dev="tmpfs" ino=3044 res=0 errno=-22 [ 461.359492][T15811] netlink: 'syz.1.3284': attribute type 1 has an invalid length. [ 461.376912][T15811] sctp: [Deprecated]: syz.1.3284 (pid 15811) Use of int in max_burst socket option. [ 461.376912][T15811] Use struct sctp_assoc_value instead [ 461.380474][T15811] siw: device registration error -23 [ 461.432731][T15489] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 461.599048][T15489] veth0_vlan: entered promiscuous mode [ 461.625576][T15489] veth1_vlan: entered promiscuous mode [ 461.678682][T15489] veth0_macvtap: entered promiscuous mode [ 461.689460][T15815] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3287'. [ 461.702827][T15489] veth1_macvtap: entered promiscuous mode [ 461.759702][T15489] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 461.793391][T15489] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 461.862061][ T1012] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.896150][T13966] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.922866][T15823] ip_tables: iptables: counters copy to user failed while replacing table [ 461.940889][T13966] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.941291][T13966] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 462.043451][T13966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 462.043476][T13966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 462.058663][ T5644] Bluetooth: hci0: command 0x0419 tx timeout [ 462.179804][ T65] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 462.179828][ T65] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 462.420830][T15845] __nla_validate_parse: 2 callbacks suppressed [ 462.420845][T15845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3294'. [ 462.429272][T15845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3294'. [ 462.881813][T15865] IPv6: addrconf: prefix option has invalid lifetime [ 462.888183][T15865] netlink: 'syz.0.3300': attribute type 1 has an invalid length. [ 462.888208][T15865] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3300'. [ 462.896789][T15865] syzkaller0: entered allmulticast mode [ 463.044682][T15859] sctp: [Deprecated]: syz.2.3299 (pid 15859) Use of struct sctp_assoc_value in delayed_ack socket option. [ 463.044682][T15859] Use struct sctp_sack_info instead [ 463.529700][ T5643] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 463.543118][ T5643] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 463.544246][ T5643] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 463.546201][ T5643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 463.550300][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 464.560389][T15892] erspan1: entered promiscuous mode [ 464.876033][T15905] syzkaller0: entered promiscuous mode [ 464.876062][T15905] syzkaller0: entered allmulticast mode [ 464.982782][T13966] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 464.990039][T15929] ip_tables: iptables: counters copy to user failed while replacing table [ 465.651506][ T5644] Bluetooth: hci2: command tx timeout [ 467.730852][ T5644] Bluetooth: hci2: command tx timeout [ 467.766772][T15915] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 467.954414][T15938] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3313'. [ 468.184669][T15944] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 468.196460][T15944] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 469.811970][ T5644] Bluetooth: hci2: command tx timeout [ 470.286086][T13966] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.484913][T13966] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.586480][T13966] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.639781][T15960] batman_adv: batadv0: Adding interface: syzkaller0 [ 470.639802][T15960] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 470.639836][T15960] batman_adv: batadv0: Interface activated: syzkaller0 [ 470.719565][T15884] hsr0 speed is unknown, defaulting to 1000 [ 470.729320][T15884] rxe_eth0 speed is unknown, defaulting to 1000 [ 471.382973][T15954] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 471.420199][ T5644] Bluetooth: hci0: connection err: -111 [ 471.459549][T15954] batman_adv: batadv0: Removing interface: syzkaller0 [ 471.469675][T15982] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3328'. [ 471.684599][T15991] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 471.701812][T15987] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 471.852048][T15997] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3330'. [ 471.890670][ T5644] Bluetooth: hci2: command tx timeout [ 471.918203][T13966] bridge_slave_1: left allmulticast mode [ 471.918230][T13966] bridge_slave_1: left promiscuous mode [ 471.918467][T13966] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.954952][T13966] bridge_slave_0: left allmulticast mode [ 471.954982][T13966] bridge_slave_0: left promiscuous mode [ 471.955217][T13966] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.995629][T16002] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input30 [ 472.066028][T16002] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3332'. [ 472.082170][T13966] batman_adv: batadv0: Removing interface: ip6gretap1 [ 472.657159][T13966] bond0 (unregistering): left promiscuous mode [ 472.657186][T13966] bond_slave_0: left promiscuous mode [ 472.657423][T13966] bond_slave_1: left promiscuous mode [ 472.700758][T13966] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.716010][T13966] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 472.723550][ T1012] smbdirect: ib_dev[syz1] removed [ 472.740286][T13966] bond0 (unregistering): Released all slaves [ 472.793477][T13966] bond1 (unregistering): Released all slaves [ 472.980320][T13966] tipc: Left network mode [ 473.202346][ T5296] 8021q: adding VLAN 0 to HW filter on device eth3 [ 473.426478][T16038] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input31 [ 473.550813][T16037] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3338'. [ 473.668926][T16046] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3340'. [ 473.700031][T15884] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.700157][T15884] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.700342][T15884] bridge_slave_0: entered allmulticast mode [ 473.725343][T15884] bridge_slave_0: entered promiscuous mode [ 473.734686][T15884] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.734863][T15884] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.735006][T15884] bridge_slave_1: entered allmulticast mode [ 473.736794][T15884] bridge_slave_1: entered promiscuous mode [ 473.877403][T16052] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 473.879575][T16052] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 473.912457][T15884] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 473.948192][T15884] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 473.980010][T16059] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3343'. [ 474.019185][T16059] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3343'. [ 474.128402][T16063] x_tables: unsorted underflow at hook 3 [ 474.142509][T16063] x_tables: duplicate underflow at hook 2 [ 474.235524][T15884] team0: Port device team_slave_0 added [ 474.250278][T15884] team0: Port device team_slave_1 added [ 474.314567][T16068] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3345'. [ 474.398043][T16071] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3346'. [ 474.429466][T13966] batadv0: left promiscuous mode [ 474.436588][T13966] hsr_slave_0: left promiscuous mode [ 474.437510][T13966] hsr_slave_1: left promiscuous mode [ 474.438487][T13966] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 474.441201][T13966] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 474.810421][T13966] team0 (unregistering): Port device team_slave_1 removed [ 474.843076][T13966] team0 (unregistering): Port device team_slave_0 removed [ 474.955379][T16086] ip_tables: iptables: counters copy to user failed while replacing table [ 475.072614][T15884] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 475.072635][T15884] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.072665][T15884] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 475.169906][T15884] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 475.169926][T15884] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.169955][T15884] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 475.228688][ T5296] 8021q: adding VLAN 0 to HW filter on device eth4 [ 475.398091][T15884] hsr_slave_0: entered promiscuous mode [ 475.399280][T15884] hsr_slave_1: entered promiscuous mode [ 475.400034][T15884] debugfs: 'hsr0' already exists in 'hsr' [ 475.400054][T15884] Cannot create hsr debugfs directory [ 475.579385][T16099] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3350'. [ 475.623828][T16101] netlink: 'syz.0.3352': attribute type 8 has an invalid length. [ 475.624288][T13966] IPVS: stop unused estimator thread 0... [ 475.628349][T16099] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3350'. [ 475.945702][T16107] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3354'. [ 475.964150][T16108] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 475.971246][T16108] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 476.471307][T16134] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3361'. [ 476.498391][T16119] syzkaller0: entered promiscuous mode [ 476.498418][T16119] syzkaller0: entered allmulticast mode [ 476.704970][T16139] ip_tables: iptables: counters copy to user failed while replacing table [ 477.157028][T16154] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 477.177718][T16154] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 478.563976][T16161] __nla_validate_parse: 2 callbacks suppressed [ 478.563997][T16161] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3370'. [ 478.721660][T16165] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3372'. [ 478.943139][T15884] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 478.963908][T15884] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 478.965045][T15884] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 478.982573][T15884] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 478.985749][T15884] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 479.014841][T15884] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 479.018646][T15884] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 479.045813][T15884] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 479.309588][T16181] syzkaller0: entered promiscuous mode [ 479.309617][T16181] syzkaller0: entered allmulticast mode [ 479.390404][T16193] smbdirect: ib_dev[syz1]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 479.390443][T16193] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 479.390495][T16193] smbdirect: ib_dev[syz1]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 479.973107][T16215] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3380'. [ 481.431668][T15884] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.515467][T15884] 8021q: adding VLAN 0 to HW filter on device team0 [ 481.640429][T16225] syzkaller0: entered promiscuous mode [ 481.640454][T16225] syzkaller0: entered allmulticast mode [ 481.655803][T16239] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input32 [ 481.717313][T16239] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3383'. [ 481.750344][T16235] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3384'. [ 481.954655][T16249] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3385'. [ 483.806595][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.806706][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 483.842668][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.842779][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 484.109548][T16293] netlink: 'syz.3.3391': attribute type 1 has an invalid length. [ 484.127384][T16293] sctp: [Deprecated]: syz.3.3391 (pid 16293) Use of int in max_burst socket option. [ 484.127384][T16293] Use struct sctp_assoc_value instead [ 484.151522][T16293] siw: device registration error -23 [ 484.201785][T16288] siw: device registration error -23 [ 485.083219][T16318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3395'. [ 485.088898][T16318] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3395'. [ 485.154339][T15884] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 485.361284][T16321] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3397'. [ 485.508732][T16324] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3398'. [ 485.757733][T16336] netlink: 67 bytes leftover after parsing attributes in process `syz.3.3402'. [ 485.829643][T16342] IPv6: addrconf: prefix option has invalid lifetime [ 485.839351][T16342] netlink: 'syz.1.3405': attribute type 1 has an invalid length. [ 485.839374][T16342] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3405'. [ 485.859127][T16342] syzkaller0: entered allmulticast mode [ 485.905498][T16336] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3402'. [ 486.152494][T15884] veth0_vlan: entered promiscuous mode [ 486.175272][T15884] veth1_vlan: entered promiscuous mode [ 486.194391][T16352] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3408'. [ 486.307226][T15884] veth0_macvtap: entered promiscuous mode [ 486.330633][T15884] veth1_macvtap: entered promiscuous mode [ 486.407315][T15884] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 486.437416][T15884] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 486.483300][ T65] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.483494][ T65] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.483532][ T65] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.513099][T13966] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 486.685022][T16370] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3414'. [ 487.024334][ T65] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 487.024377][ T65] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 487.080025][ T1012] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 487.080048][ T1012] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 487.347469][T16381] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.3303'. [ 487.684119][T16403] netlink: 'syz.0.3425': attribute type 10 has an invalid length. [ 488.670376][T16437] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 488.751751][T16437] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 488.965549][T16447] FAULT_INJECTION: forcing a failure. [ 488.965549][T16447] name failslab, interval 1, probability 0, space 0, times 0 [ 488.965588][T16447] CPU: 1 UID: 0 PID: 16447 Comm: syz.0.3442 Not tainted syzkaller #0 PREEMPT(full) [ 488.965617][T16447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 488.965633][T16447] Call Trace: [ 488.965643][T16447] [ 488.965654][T16447] dump_stack_lvl+0xe8/0x150 [ 488.965694][T16447] should_fail_ex+0x3eb/0x540 [ 488.965728][T16447] should_failslab+0xa8/0x100 [ 488.965761][T16447] ? skb_clone+0x212/0x3a0 [ 488.965786][T16447] kmem_cache_alloc_noprof+0x9c/0x600 [ 488.965810][T16447] ? lock_acquire+0x115/0x350 [ 488.965840][T16447] ? skb_clone+0x212/0x3a0 [ 488.965882][T16447] skb_clone+0x212/0x3a0 [ 488.965905][T16447] ? dev_queue_xmit_nit+0x25c/0xac0 [ 488.965930][T16447] dev_queue_xmit_nit+0x28d/0xac0 [ 488.965953][T16447] ? dev_queue_xmit_nit+0x2d/0xac0 [ 488.965985][T16447] dev_hard_start_xmit+0x1c1/0x830 [ 488.966013][T16447] ? validate_xmit_skb+0xecb/0x1a60 [ 488.966055][T16447] __dev_queue_xmit+0x14d1/0x3920 [ 488.966092][T16447] ? __dev_queue_xmit+0x29b/0x3920 [ 488.966141][T16447] ? __pfx___dev_queue_xmit+0x10/0x10 [ 488.966180][T16447] ? __copy_skb_header+0xa3/0x4a0 [ 488.966229][T16447] ? skb_clone+0x246/0x3a0 [ 488.966259][T16447] __netlink_deliver_tap+0x4f1/0x6e0 [ 488.966306][T16447] ? netlink_deliver_tap+0x2e/0x1b0 [ 488.966341][T16447] netlink_deliver_tap+0x19c/0x1b0 [ 488.966375][T16447] netlink_unicast+0x8c1/0xa80 [ 488.966427][T16447] netlink_sendmsg+0x7f0/0xb20 [ 488.966468][T16447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 488.966513][T16447] ? aa_sock_msg_perm+0x144/0x210 [ 488.966543][T16447] ? apparmor_socket_sendmsg+0x98/0x360 [ 488.966578][T16447] ? __pfx_netlink_sendmsg+0x10/0x10 [ 488.966610][T16447] sock_sendmsg_nosec+0x14e/0x190 [ 488.966644][T16447] ____sys_sendmsg+0x54e/0x850 [ 488.966676][T16447] ? __pfx_____sys_sendmsg+0x10/0x10 [ 488.966712][T16447] ? import_iovec+0x73/0xa0 [ 488.966746][T16447] ___sys_sendmsg+0x2a5/0x360 [ 488.966767][T16447] ? __lock_acquire+0x747/0x2de0 [ 488.966803][T16447] ? __pfx____sys_sendmsg+0x10/0x10 [ 488.966880][T16447] ? __fget_files+0x3a2/0x420 [ 488.966907][T16447] ? __fget_files+0x2a/0x420 [ 488.966946][T16447] __x64_sys_sendmsg+0x1b1/0x290 [ 488.966975][T16447] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 488.967027][T16447] do_syscall_64+0x166/0x520 [ 488.967053][T16447] ? trace_irq_disable+0x3b/0x140 [ 488.967085][T16447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.967109][T16447] ? clear_bhb_loop+0x70/0xc0 [ 488.967156][T16447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 488.967180][T16447] RIP: 0033:0x7f5743f9fb19 [ 488.967201][T16447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 488.967222][T16447] RSP: 002b:00007f5744e8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 488.967247][T16447] RAX: ffffffffffffffda RBX: 00007f5744225fa0 RCX: 00007f5743f9fb19 [ 488.967264][T16447] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000006 [ 488.967279][T16447] RBP: 00007f5744e8d090 R08: 0000000000000000 R09: 0000000000000000 [ 488.967294][T16447] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 488.967308][T16447] R13: 00007f5744226038 R14: 00007f5744225fa0 R15: 00007ffd24dff678 [ 488.967347][T16447] [ 489.700540][T16471] netlink: 'syz.0.3451': attribute type 1 has an invalid length. [ 489.748165][T16471] sctp: [Deprecated]: syz.0.3451 (pid 16471) Use of int in max_burst socket option. [ 489.748165][T16471] Use struct sctp_assoc_value instead [ 489.775434][T16471] siw: device registration error -23 [ 489.911773][T16477] lo: entered promiscuous mode [ 490.251254][T16486] __nla_validate_parse: 15 callbacks suppressed [ 490.251276][T16486] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3457'. [ 490.251323][T16486] openvswitch: netlink: Missing key (keys=40, expected=80) [ 490.354097][T16490] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input33 [ 490.394277][T16490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3459'. [ 490.439387][T16468] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 490.584072][T16496] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3460'. [ 490.670017][T16504] ip_tables: iptables: counters copy to user failed while replacing table [ 490.692215][T16505] netlink: 'syz.3.3463': attribute type 1 has an invalid length. [ 490.717844][T16505] sctp: [Deprecated]: syz.3.3463 (pid 16505) Use of int in max_burst socket option. [ 490.717844][T16505] Use struct sctp_assoc_value instead [ 490.726424][T16505] siw: device registration error -23 [ 490.775113][T16509] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3465'. [ 490.835911][T16506] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3465'. [ 490.867394][T16509] 8021q: adding VLAN 0 to HW filter on device bond1 [ 490.921022][T16513] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3466'. [ 490.993641][T16517] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3466'. [ 491.036168][T16516] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3467'. [ 491.295099][T16524] batadv0: entered promiscuous mode [ 491.299573][T16524] macsec1: entered allmulticast mode [ 491.299595][T16524] batadv0: entered allmulticast mode [ 491.302701][T16524] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 491.316482][T16524] batadv0: left allmulticast mode [ 491.316566][T16524] batadv0: left promiscuous mode [ 491.643330][T16531] siw: device registration error -23 [ 491.669737][T16534] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input34 [ 491.700021][T16534] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3475'. [ 491.736788][T16535] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3474'. [ 491.808239][T16537] erspan1: entered promiscuous mode [ 492.165331][T16556] FAULT_INJECTION: forcing a failure. [ 492.165331][T16556] name failslab, interval 1, probability 0, space 0, times 0 [ 492.165363][T16556] CPU: 1 UID: 0 PID: 16556 Comm: syz.3.3485 Not tainted syzkaller #0 PREEMPT(full) [ 492.165388][T16556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 492.165401][T16556] Call Trace: [ 492.165409][T16556] [ 492.165418][T16556] dump_stack_lvl+0xe8/0x150 [ 492.165458][T16556] should_fail_ex+0x3eb/0x540 [ 492.165491][T16556] should_failslab+0xa8/0x100 [ 492.165527][T16556] __kvmalloc_node_noprof+0x171/0x820 [ 492.165561][T16556] ? alloc_netdev_mqs+0xb01/0x1240 [ 492.165588][T16556] ? alloc_netdev_mqs+0xb01/0x1240 [ 492.165624][T16556] alloc_netdev_mqs+0xb01/0x1240 [ 492.165668][T16556] ieee80211_if_add+0x425/0x1600 [ 492.165709][T16556] ieee80211_add_iface+0xb4/0x5c0 [ 492.165731][T16556] ? __kmalloc_node_track_caller_noprof+0x2e6/0x720 [ 492.165758][T16556] ? nl80211_new_interface+0x682/0x1080 [ 492.165788][T16556] ? __pfx_ieee80211_add_iface+0x10/0x10 [ 492.165816][T16556] ? __alloc_skb+0x4d0/0x7a0 [ 492.165855][T16556] nl80211_new_interface+0x7c5/0x1080 [ 492.165904][T16556] ? __pfx_nl80211_new_interface+0x10/0x10 [ 492.165937][T16556] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 492.165972][T16556] genl_family_rcv_msg_doit+0x233/0x340 [ 492.166003][T16556] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 492.166041][T16556] ? bpf_lsm_capable+0x9/0x20 [ 492.166059][T16556] ? security_capable+0x7e/0x2c0 [ 492.166097][T16556] genl_rcv_msg+0x614/0x7a0 [ 492.166127][T16556] ? __pfx_genl_rcv_msg+0x10/0x10 [ 492.166148][T16556] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 492.166168][T16556] ? __pfx_nl80211_new_interface+0x10/0x10 [ 492.166192][T16556] ? __pfx_nl80211_post_doit+0x10/0x10 [ 492.166230][T16556] netlink_rcv_skb+0x226/0x4a0 [ 492.166260][T16556] ? __pfx_genl_rcv_msg+0x10/0x10 [ 492.166284][T16556] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 492.166330][T16556] ? down_read+0x2b9/0x320 [ 492.166361][T16556] genl_rcv+0x28/0x40 [ 492.166380][T16556] netlink_unicast+0x8ef/0xa80 [ 492.166426][T16556] netlink_sendmsg+0x7f0/0xb20 [ 492.166463][T16556] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.166497][T16556] ? aa_sock_msg_perm+0x144/0x210 [ 492.166524][T16556] ? apparmor_socket_sendmsg+0x98/0x360 [ 492.166574][T16556] ? __pfx_netlink_sendmsg+0x10/0x10 [ 492.166605][T16556] sock_sendmsg_nosec+0x14e/0x190 [ 492.166637][T16556] ____sys_sendmsg+0x54e/0x850 [ 492.166674][T16556] ? __pfx_____sys_sendmsg+0x10/0x10 [ 492.166708][T16556] ? import_iovec+0x73/0xa0 [ 492.166740][T16556] ___sys_sendmsg+0x2a5/0x360 [ 492.166761][T16556] ? __lock_acquire+0x747/0x2de0 [ 492.166814][T16556] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.166883][T16556] ? __fget_files+0x3a2/0x420 [ 492.166909][T16556] ? __fget_files+0x2a/0x420 [ 492.166948][T16556] __x64_sys_sendmsg+0x1b1/0x290 [ 492.166976][T16556] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 492.167027][T16556] do_syscall_64+0x166/0x520 [ 492.167052][T16556] ? trace_irq_disable+0x3b/0x140 [ 492.167083][T16556] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.167106][T16556] ? clear_bhb_loop+0x70/0xc0 [ 492.167135][T16556] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.167159][T16556] RIP: 0033:0x7f630679fb19 [ 492.167179][T16556] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.167199][T16556] RSP: 002b:00007f6307712028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.167224][T16556] RAX: ffffffffffffffda RBX: 00007f6306a25fa0 RCX: 00007f630679fb19 [ 492.167241][T16556] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000003 [ 492.167255][T16556] RBP: 00007f6307712090 R08: 0000000000000000 R09: 0000000000000000 [ 492.167269][T16556] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 492.167283][T16556] R13: 00007f6306a26038 R14: 00007f6306a25fa0 R15: 00007ffeab66ce28 [ 492.167320][T16556] [ 492.405622][T16557] ip_tables: iptables: counters copy to user failed while replacing table [ 492.804225][T16574] netlink: 'syz.0.3489': attribute type 1 has an invalid length. [ 492.857204][T16581] netlink: 'syz.0.3489': attribute type 10 has an invalid length. [ 492.865614][T16574] 8021q: adding VLAN 0 to HW filter on device bond2 [ 492.923532][T16575] bond2: (slave veth3): Enslaving as an active interface with a down link [ 492.923797][T16581] dummy0: entered promiscuous mode [ 493.171879][T16597] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 493.305738][T16599] FAULT_INJECTION: forcing a failure. [ 493.305738][T16599] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 493.305768][T16599] CPU: 0 UID: 0 PID: 16599 Comm: syz.1.3497 Not tainted syzkaller #0 PREEMPT(full) [ 493.305791][T16599] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 493.305804][T16599] Call Trace: [ 493.305811][T16599] [ 493.305820][T16599] dump_stack_lvl+0xe8/0x150 [ 493.305857][T16599] should_fail_ex+0x3eb/0x540 [ 493.305888][T16599] _copy_from_user+0x2d/0xb0 [ 493.305916][T16599] bpf_test_init+0xd8/0x150 [ 493.305949][T16599] bpf_prog_test_run_skb+0x31e/0x22c0 [ 493.305978][T16599] ? lock_acquire+0x115/0x350 [ 493.306013][T16599] ? __fget_files+0x2a/0x420 [ 493.306041][T16599] ? __fget_files+0x2a/0x420 [ 493.306065][T16599] ? __fget_files+0x3a2/0x420 [ 493.306106][T16599] ? __fget_files+0x2a/0x420 [ 493.306139][T16599] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 493.306175][T16599] bpf_prog_test_run+0x2c5/0x340 [ 493.306209][T16599] __sys_bpf+0xb1e/0xe00 [ 493.306258][T16599] ? __pfx___sys_bpf+0x10/0x10 [ 493.306293][T16599] ? __fget_files+0x2a/0x420 [ 493.306341][T16599] ? ksys_write+0x242/0x270 [ 493.306374][T16599] ? __pfx_ksys_write+0x10/0x10 [ 493.306417][T16599] __x64_sys_bpf+0xba/0xd0 [ 493.306454][T16599] do_syscall_64+0x166/0x520 [ 493.306480][T16599] ? trace_irq_disable+0x3b/0x140 [ 493.306515][T16599] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.306539][T16599] ? clear_bhb_loop+0x70/0xc0 [ 493.306568][T16599] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.306591][T16599] RIP: 0033:0x7fdd36b9fb19 [ 493.306612][T16599] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.306630][T16599] RSP: 002b:00007fdd37a0f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 493.306654][T16599] RAX: ffffffffffffffda RBX: 00007fdd36e25fa0 RCX: 00007fdd36b9fb19 [ 493.306671][T16599] RDX: 000000000000004c RSI: 0000200000000240 RDI: 000000000000000a [ 493.306685][T16599] RBP: 00007fdd37a0f090 R08: 0000000000000000 R09: 0000000000000000 [ 493.306699][T16599] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.306712][T16599] R13: 00007fdd36e26038 R14: 00007fdd36e25fa0 R15: 00007ffe7e583b78 [ 493.306749][T16599] [ 494.249638][T16647] FAULT_INJECTION: forcing a failure. [ 494.249638][T16647] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 494.249672][T16647] CPU: 0 UID: 0 PID: 16647 Comm: syz.3.3513 Not tainted syzkaller #0 PREEMPT(full) [ 494.249697][T16647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 494.249710][T16647] Call Trace: [ 494.249718][T16647] [ 494.249727][T16647] dump_stack_lvl+0xe8/0x150 [ 494.249767][T16647] should_fail_ex+0x3eb/0x540 [ 494.249800][T16647] _copy_from_user+0x2d/0xb0 [ 494.249829][T16647] __copy_msghdr+0x390/0x590 [ 494.249867][T16647] ___sys_sendmsg+0x213/0x360 [ 494.249889][T16647] ? __lock_acquire+0x747/0x2de0 [ 494.249922][T16647] ? __pfx____sys_sendmsg+0x10/0x10 [ 494.249987][T16647] ? __fget_files+0x3a2/0x420 [ 494.250014][T16647] ? __fget_files+0x2a/0x420 [ 494.250050][T16647] __x64_sys_sendmsg+0x1b1/0x290 [ 494.250078][T16647] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 494.250140][T16647] do_syscall_64+0x166/0x520 [ 494.250163][T16647] ? trace_irq_disable+0x3b/0x140 [ 494.250191][T16647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.250212][T16647] ? clear_bhb_loop+0x70/0xc0 [ 494.250237][T16647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.250256][T16647] RIP: 0033:0x7f630679fb19 [ 494.250275][T16647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.250293][T16647] RSP: 002b:00007f6307712028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 494.250315][T16647] RAX: ffffffffffffffda RBX: 00007f6306a25fa0 RCX: 00007f630679fb19 [ 494.250331][T16647] RDX: 000000000000c814 RSI: 0000200000000000 RDI: 0000000000000003 [ 494.250342][T16647] RBP: 00007f6307712090 R08: 0000000000000000 R09: 0000000000000000 [ 494.250354][T16647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.250366][T16647] R13: 00007f6306a26038 R14: 00007f6306a25fa0 R15: 00007ffeab66ce28 [ 494.250399][T16647] [ 494.677335][T16650] siw: device registration error -23 [ 495.265733][T16659] SET target dimension over the limit! [ 495.267441][T16659] xt_hashlimit: invalid interval [ 500.340585][ C1] sched: DL replenish lagged too much [ 502.885939][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 545.195250][ T5643] Bluetooth: hci5: command 0x0406 tx timeout [ 563.403830][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.052373][ T5643] Bluetooth: hci3: command 0x0406 tx timeout [ 576.981984][ T5644] Bluetooth: hci0: command 0x0419 tx timeout [ 624.705862][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.286637][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 696.364751][ T5644] Bluetooth: hci1: command tx timeout [ 696.364793][ T5644] Bluetooth: hci2: command 0x0406 tx timeout [ 739.660932][ T33] INFO: task kworker/R-wg-cr:14636 blocked for more than 143 seconds. [ 739.660970][ T33] Not tainted syzkaller #0 [ 739.660981][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 739.660992][ T33] task:kworker/R-wg-cr state:D stack:30040 pid:14636 tgid:14636 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 739.661064][ T33] Call Trace: [ 739.661072][ T33] [ 739.661088][ T33] __schedule+0x17dd/0x5830 [ 739.661149][ T33] ? __pfx___schedule+0x10/0x10 [ 739.661184][ T33] ? schedule+0x90/0x2b0 [ 739.661211][ T33] schedule+0x164/0x2b0 [ 739.661237][ T33] schedule_preempt_disabled+0x13/0x30 [ 739.661261][ T33] __mutex_lock+0x7c4/0x15a0 [ 739.661293][ T33] ? __mutex_lock+0x5cd/0x15a0 [ 739.661324][ T33] ? worker_attach_to_pool+0x31/0x390 [ 739.661362][ T33] ? __pfx___mutex_lock+0x10/0x10 [ 739.661413][ T33] worker_attach_to_pool+0x31/0x390 [ 739.661447][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 739.661474][ T33] rescuer_thread+0x336/0x12a0 [ 739.661505][ T33] ? rescuer_thread+0xb8/0x12a0 [ 739.661548][ T33] kthread+0x38b/0x480 [ 739.661575][ T33] ? __pfx_rescuer_thread+0x10/0x10 [ 739.661596][ T33] ? __pfx_kthread+0x10/0x10 [ 739.661623][ T33] ret_from_fork+0x514/0xb70 [ 739.661652][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 739.661678][ T33] ? __switch_to+0xc78/0x1410 [ 739.661716][ T33] ? __pfx_kthread+0x10/0x10 [ 739.661744][ T33] ret_from_fork_asm+0x1a/0x30 [ 739.661787][ T33] [ 739.661814][ T33] INFO: task kworker/R-wg-cr:16044 blocked for more than 143 seconds. [ 739.661830][ T33] Not tainted syzkaller #0 [ 739.661841][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 739.661850][ T33] task:kworker/R-wg-cr state:D stack:30040 pid:16044 tgid:16044 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 739.661913][ T33] Call Trace: [ 739.661919][ T33] [ 739.661950][ T33] __schedule+0x17dd/0x5830 [ 739.662013][ T33] ? __pfx___schedule+0x10/0x10 [ 739.662049][ T33] ? schedule+0x90/0x2b0 [ 739.662075][ T33] schedule+0x164/0x2b0 [ 739.662102][ T33] schedule_preempt_disabled+0x13/0x30 [ 739.662126][ T33] __mutex_lock+0x7c4/0x15a0 [ 739.662157][ T33] ? __mutex_lock+0x5cd/0x15a0 [ 739.662190][ T33] ? worker_attach_to_pool+0x31/0x390 [ 739.662228][ T33] ? __pfx___mutex_lock+0x10/0x10 [ 739.662281][ T33] worker_attach_to_pool+0x31/0x390 [ 739.662315][ T33] ? _raw_spin_unlock_irq+0x23/0x50 [ 739.662342][ T33] rescuer_thread+0x336/0x12a0 [ 739.662374][ T33] ? rescuer_thread+0xb8/0x12a0 [ 739.662419][ T33] kthread+0x38b/0x480 [ 739.662445][ T33] ? __pfx_rescuer_thread+0x10/0x10 [ 739.662467][ T33] ? __pfx_kthread+0x10/0x10 [ 739.662495][ T33] ret_from_fork+0x514/0xb70 [ 739.662519][ T33] ? save_fpregs_to_fpstate+0x176/0x200 [ 739.662554][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 739.662581][ T33] ? __switch_to+0xc78/0x1410 [ 739.662619][ T33] ? __pfx_kthread+0x10/0x10 [ 739.662648][ T33] ret_from_fork_asm+0x1a/0x30 [ 739.662691][ T33] [ 739.662706][ T33] INFO: task kworker/u8:14:16670 blocked for more than 143 seconds. [ 739.662723][ T33] Not tainted syzkaller #0 [ 739.662734][ T33] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 739.662744][ T33] task:kworker/u8:14 state:D stack:30944 pid:16670 tgid:16670 ppid:2 task_flags:0x4208040 flags:0x00080000 [ 739.662816][ T33] Call Trace: [ 739.662824][ T33] [ 739.662838][ T33] __schedule+0x17dd/0x5830 [ 739.662863][ T33] ? __lock_acquire+0x747/0x2de0 [ 739.662900][ T33] ? update_protect_slice+0x45/0x320 [ 739.662944][ T33] ? __pfx___schedule+0x10/0x10 [ 739.662974][ T33] ? lock_acquire+0x115/0x350 [ 739.663013][ T33] ? schedule+0x90/0x2b0 [ 739.663041][ T33] schedule+0x164/0x2b0 [ 739.663079][ T33] schedule_preempt_disabled+0x13/0x30 [ 739.663103][ T33] kthread+0x260/0x480 [ 739.663128][ T33] ? __pfx_worker_thread+0x10/0x10 [ 739.663160][ T33] ? __pfx_kthread+0x10/0x10 [ 739.663188][ T33] ret_from_fork+0x514/0xb70 [ 739.663216][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 739.663241][ T33] ? __switch_to+0xc78/0x1410 [ 739.663279][ T33] ? __pfx_kthread+0x10/0x10 [ 739.663307][ T33] ret_from_fork_asm+0x1a/0x30 [ 739.663349][ T33] [ 739.663368][ T33] [ 739.663368][ T33] Showing all locks held in the system: [ 739.663377][ T33] locks held by kworker/R-rcu_g/4: 1, on CPU#1: [ 739.663394][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.663467][ T33] locks held by kworker/R-kvfre/6: 1, on CPU#1: [ 739.663482][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.663547][ T33] locks held by kworker/0:0/9: 3, last CPU#0: [ 739.663562][ T33] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.663625][ T33] #1: ffffc900000e7c40 (drain_vmap_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.663686][ T33] #2: ffffffff90090620 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 [ 739.663746][ T33] locks held by kworker/0:1/10: 4, last CPU#0: [ 739.663761][ T33] #0: ffff88807f989548 ((wq_completion)wg-kex-wg2#14){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.663830][ T33] #1: ffffc900000f7c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.663911][ T33] #2: ffff8880323c8d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 739.663975][ T33] #3: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 739.664032][ T33] locks held by kworker/u8:0/12: 3, last CPU#1: [ 739.664048][ T33] #0: ffff88813fe0a948 ((wq_completion)kvfree_rcu_reclaim){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664111][ T33] #1: ffffc90000117c40 ((work_completion)(&(&krcp->krw_arr[i].rcu_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664176][ T33] #2: ffffffff8ff5a440 (rcu_callback){....}-{0:0}, at: kvfree_rcu_bulk+0x6d/0x180 [ 739.664228][ T33] locks held by kworker/u8:1/13: 3, last CPU#1: [ 739.664243][ T33] #0: ffff8880339d6148 ((wq_completion)krds_cp_wq#8/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664306][ T33] #1: ffffc90000127c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664369][ T33] #2: ffff88803652a180 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 [ 739.664425][ T33] locks held by kworker/R-mm_pe/14: 1, on CPU#0: [ 739.664441][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 739.664495][ T33] locks held by kworker/1:1/29: 4, last CPU#1: [ 739.664511][ T33] #0: ffff8880271e4948 ((wq_completion)wg-kex-wg1#20){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664578][ T33] #1: ffffc90000a47c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664659][ T33] #2: ffff88802c481480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 739.664714][ T33] #3: ffff8880323cd270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 739.664769][ T33] locks held by kworker/u8:2/31: 3, last CPU#1: [ 739.664784][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664849][ T33] #1: ffffc90000a77c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.664912][ T33] #2: ffff888054460800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.664977][ T33] locks held by khungtaskd/33: 1, last CPU#1: [ 739.664992][ T33] #0: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 739.665047][ T33] locks held by kworker/R-write/35: 1, on CPU#0: [ 739.665063][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.665129][ T33] locks held by kworker/u8:5/65: 3, last CPU#1: [ 739.665145][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665207][ T33] #1: ffffc9000206fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665271][ T33] #2: ffff8880510b0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.665328][ T33] locks held by kswapd0/90: 2, last CPU#1: [ 739.665344][ T33] #0: ffffffff90094cc0 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0xa53/0x3a20 [ 739.665418][ T33] #1: ffff8880348620e8 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_cache_scan+0x94/0x4a0 [ 739.665491][ T33] locks held by kworker/R-ksmbd/116: 1, on CPU#1: [ 739.665507][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.665576][ T33] locks held by kworker/u8:6/201: 3, last CPU#1: [ 739.665593][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665659][ T33] #1: ffffc9000308fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665724][ T33] #2: ffff888056210800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.665786][ T33] locks held by kworker/u8:7/1012: 3, last CPU#1: [ 739.665803][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665868][ T33] #1: ffffc9000485fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.665933][ T33] #2: ffff88807d920800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.665999][ T33] locks held by kworker/u8:8/1025: 3, last CPU#1: [ 739.666015][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666080][ T33] #1: ffffc90005017c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666146][ T33] #2: ffff888079010800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.666207][ T33] locks held by kworker/u8:9/1118: 3, last CPU#1: [ 739.666223][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666290][ T33] #1: ffffc90005297c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666356][ T33] #2: ffff88801cf30800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.666416][ T33] locks held by kworker/u8:10/1389: 3, last CPU#1: [ 739.666432][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666495][ T33] #1: ffffc900059a7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666561][ T33] #2: ffff8880728c0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 739.666631][ T33] locks held by kworker/R-krxrp/3214: 1, on CPU#0: [ 739.666647][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.666715][ T33] locks held by kworker/R-bat_e/3229: 4, last CPU#0: [ 739.666732][ T33] #0: ffff88803325e148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666797][ T33] #1: ffffc9000ed97c40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 739.666864][ T33] #2: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 [ 739.666930][ T33] #3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 [ 739.667001][ T33] locks held by kworker/R-ext4-/4965: 1, on CPU#0: [ 739.667018][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 739.667086][ T33] locks held by udevd/5001: 4, last CPU#1: [ 739.667102][ T33] #0: ffffffff9003a4f0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 739.667163][ T33] #1: ffff88807fd62800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x18a/0x1e10 [ 739.667218][ T33] #2: ffff88807c8bd900 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x277/0x1e10 [ 739.667278][ T33] #3: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 739.667338][ T33] locks held by dhcpcd/5295: 2, last CPU#1: [ 739.667354][ T33] #0: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 739.667412][ T33] #1: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 739.667475][ T33] locks held by dhcpcd/5296: 4, last CPU#1: [ 739.667491][ T33] #0: ffffffff9003a4f0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 [ 739.667552][ T33] #1: ffff88813ff7d900 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x18a/0x1e10 [ 739.667607][ T33] #2: ffff88807cde0340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x277/0x1e10 [ 739.667667][ T33] #3: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 739.667725][ T33] locks held by kworker/0:3/5367: 3, last CPU#0: [ 742.023920][ T33] #0: ffff888067fedd48 ((wq_completion)wg-kex-wg1#12){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024006][ T33] #1: ffffc900035efc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024089][ T33] #2: ffff88802b5bd480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 742.024148][ T33] locks held by getty/5391: 2, on CPU#0: [ 742.024164][ T33] #0: ffff8880370f40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 742.024220][ T33] #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 742.024292][ T33] locks held by syz-executor/5622: 2, last CPU#1: [ 742.024308][ T33] #0: ffff888033699ce0 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x21/0x50 [ 742.024364][ T33] #1: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 742.024421][ T33] locks held by kworker/u9:4/5643: 5, on CPU#1: [ 742.024444][ T33] #0: ffff88807e045948 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024507][ T33] #1: ffffc9000461fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024570][ T33] #2: ffff888054ea4ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 [ 742.024627][ T33] #3: ffff888054ea40b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 [ 742.024679][ T33] #4: ffffffff8ff609a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 [ 742.024732][ T33] locks held by kworker/u9:6/5650: 1, on CPU#0: [ 742.024747][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.024815][ T33] locks held by kworker/1:4/5759: 3, last CPU#1: [ 742.024830][ T33] #0: ffff888066c45948 ((wq_completion)wg-kex-wg0#20){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024898][ T33] #1: ffffc9000496fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.024979][ T33] #2: ffff888027277028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 742.025034][ T33] locks held by kworker/0:7/5786: 2, last CPU#0: [ 742.025049][ T33] #0: ffff888067a26d48 ((wq_completion)wg-crypt-wg2#10){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025115][ T33] #1: ffffc90004b1fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025179][ T33] locks held by kworker/1:5/5818: 1, on CPU#1: [ 742.025194][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.025266][ T33] locks held by kworker/1:6/5824: 4, on CPU#1: [ 742.025281][ T33] #0: ffff88807f989548 ((wq_completion)wg-kex-wg2#14){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025369][ T33] #1: ffffc90004bdfc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025455][ T33] #2: ffff888079249480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 [ 742.025512][ T33] #3: ffff8880323c8d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x59c/0x9b0 [ 742.025571][ T33] locks held by syz-executor/13900: 2, last CPU#1: [ 742.025588][ T33] #0: ffff888033244080 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x19c/0xa40 [ 742.025642][ T33] #1: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 [ 742.025706][ T33] locks held by kworker/u8:3/13966: 3, last CPU#1: [ 742.025722][ T33] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025787][ T33] #1: ffffc900048efc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.025865][ T33] #2: ffff888066930800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 742.025923][ T33] locks held by kworker/u8:4/13967: 3, last CPU#1: [ 742.025938][ T33] #0: ffff88805536c948 ((wq_completion)krds_cp_wq#12/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026001][ T33] #1: ffffc900033ffc40 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026065][ T33] #2: ffff88802cb8f060 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_sock_set_cork+0x2c/0x2d0 [ 742.026125][ T33] locks held by kworker/u8:11/13968: 4, on CPU#1: [ 742.026141][ T33] #0: ffff88807cb4c148 ((wq_completion)wg-kex-wg2#13){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026208][ T33] #1: ffffc90004cffc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026280][ T33] #2: ffff888079249480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 742.026334][ T33] #3: ffff8880323c8d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 742.026388][ T33] locks held by kworker/1:0/14023: 3, last CPU#1: [ 742.026422][ T33] #0: ffff888055eb5948 ((wq_completion)wg-kex-wg1#16){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026493][ T33] #1: ffffc9000332fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.026578][ T33] #2: ffff8880272734b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x36/0xbf0 [ 742.026635][ T33] locks held by kworker/R-wg-cr/14135: 1, on CPU#1: [ 742.026652][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.026706][ T33] locks held by kworker/R-wg-cr/14136: 1, on CPU#0: [ 742.026722][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.026788][ T33] locks held by kworker/R-wg-cr/14137: 1, on CPU#0: [ 742.026804][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.026860][ T33] locks held by syz-executor/14438: 1, last CPU#1: [ 742.026877][ T33] #0: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 742.026936][ T33] locks held by kworker/R-wg-cr/14633: 1, on CPU#1: [ 742.026952][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.027019][ T33] locks held by kworker/R-wg-cr/14635: 1, on CPU#1: [ 742.027035][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.027102][ T33] locks held by kworker/R-wg-cr/14636: 1, on CPU#0: [ 742.027118][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.027187][ T33] locks held by kworker/R-wg-cr/15177: 1, on CPU#0: [ 742.027203][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.027296][ T33] locks held by kworker/R-wg-cr/15182: 1, on CPU#0: [ 742.027313][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.027367][ T33] locks held by kworker/R-wg-cr/15184: 1, on CPU#1: [ 742.027383][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.027438][ T33] locks held by syz-executor/15489: 4, last CPU#1: [ 742.027455][ T33] #0: ffff88807dfa8460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 742.036466][ T33] #1: ffff888013472d30 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 [ 742.036548][ T33] #2: ffffffff90701b18 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 [ 742.036630][ T33] #3: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 742.036690][ T33] locks held by kworker/R-wg-cr/15671: 1, last CPU#0: [ 742.036707][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.036775][ T33] locks held by kworker/R-wg-cr/15673: 1, on CPU#0: [ 742.036792][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.036846][ T33] locks held by kworker/R-wg-cr/15675: 1, on CPU#1: [ 742.036862][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.036919][ T33] locks held by kworker/0:2/15827: 2, last CPU#0: [ 742.036935][ T33] #0: ffff88802d205548 ((wq_completion)wg-crypt-wg0#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.037005][ T33] #1: ffffc9000310fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.037092][ T33] locks held by syz-executor/15884: 2, last CPU#1: [ 742.037108][ T33] #0: ffff8880326222e0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x55/0x400 [ 742.037170][ T33] #1: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 742.037229][ T33] locks held by kworker/R-wg-cr/16039: 1, on CPU#0: [ 742.037253][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.037308][ T33] locks held by kworker/R-wg-cr/16043: 1, on CPU#0: [ 742.037324][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 [ 742.037378][ T33] locks held by kworker/R-wg-cr/16044: 1, on CPU#0: [ 742.037394][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.037463][ T33] locks held by kworker/R-bond2/16576: 1, on CPU#1: [ 742.037479][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.037546][ T33] locks held by kworker/u8:12/16668: 4, last CPU#1: [ 742.037562][ T33] #0: ffff888077711948 ((wq_completion)wg-kex-wg0#11){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.037632][ T33] #1: ffffc90004a5fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 742.037699][ T33] #2: ffff88802c485480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 [ 742.037756][ T33] #3: ffff888027270330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 [ 742.037823][ T33] locks held by kworker/u8:13/16669: 1, on CPU#0: [ 742.037839][ T33] #0: ffffffff8fdf6480 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 [ 742.037903][ T33] locks held by syz-executor/16673: 3, last CPU#1: [ 742.037919][ T33] #0: ffff88807c8bf180 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1ed/0x520 [ 742.037973][ T33] #1: ffffffff900b1950 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 [ 742.038029][ T33] #2: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 742.038091][ T33] [ 742.038097][ T33] ============================================= [ 742.038097][ T33] [ 742.038119][ T33] NMI backtrace for cpu 1 [ 742.038133][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 742.038156][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 742.038168][ T33] Call Trace: [ 742.038177][ T33] [ 742.038187][ T33] dump_stack_lvl+0xe8/0x150 [ 742.038223][ T33] nmi_cpu_backtrace+0x274/0x2d0 [ 742.038264][ T33] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 742.038292][ T33] nmi_trigger_cpumask_backtrace+0x17d/0x390 [ 742.038331][ T33] sys_info+0x135/0x170 [ 742.038359][ T33] watchdog+0x1073/0x10f0 [ 742.038397][ T33] ? watchdog+0x209/0x10f0 [ 742.038434][ T33] kthread+0x38b/0x480 [ 742.038460][ T33] ? __pfx_watchdog+0x10/0x10 [ 742.038487][ T33] ? __pfx_kthread+0x10/0x10 [ 742.038514][ T33] ret_from_fork+0x514/0xb70 [ 742.038541][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 742.038564][ T33] ? __switch_to+0xc78/0x1410 [ 742.038600][ T33] ? __pfx_kthread+0x10/0x10 [ 742.038626][ T33] ret_from_fork_asm+0x1a/0x30 [ 742.038667][ T33] [ 742.038675][ T33] Sending NMI from CPU 1 to CPUs 0: [ 742.038709][ C0] NMI backtrace for cpu 0 [ 742.038721][ C0] CPU: 0 UID: 0 PID: 3229 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) [ 742.038749][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 742.038761][ C0] Workqueue: bat_events batadv_dat_purge [ 742.038791][ C0] RIP: 0010:debug_smp_processor_id+0x0/0x20 [ 742.038817][ C0] Code: 40 d6 03 90 4c 89 f6 e8 0e a9 28 f9 e9 67 ff ff ff cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 c7 c7 20 8c 8e 8c 48 c7 c6 60 8c 8e 8c eb 1c 66 66 [ 742.038833][ C0] RSP: 0018:ffffc900000072a0 EFLAGS: 00000282 [ 742.038848][ C0] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffff8880334c8000 [ 742.038861][ C0] RDX: ffff8880334c8000 RSI: 0000000000000001 RDI: 0000000000000000 [ 742.038873][ C0] RBP: 1ffff1103148de52 R08: 0000000000000100 R09: 0000000000000000 [ 742.038885][ C0] R10: 0000000000000003 R11: 8000000000000100 R12: dffffc0000000000 [ 742.038898][ C0] R13: ffff888078f7e000 R14: ffff88818a46f280 R15: 0000000000000001 [ 742.038912][ C0] FS: 0000000000000000(0000) GS:ffff88812361f000(0000) knlGS:0000000000000000 [ 742.038927][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 742.038940][ C0] CR2: 00005555632bb4e8 CR3: 000000000fd48000 CR4: 00000000003526f0 [ 742.038956][ C0] Call Trace: [ 742.038963][ C0] [ 742.038969][ C0] rcu_is_watching+0x16/0xb0 [ 742.038999][ C0] rcu_read_lock_held+0x15/0x50 [ 742.039016][ C0] ip_output+0x188/0x450 [ 742.039035][ C0] ? ip_output+0x5a/0x450 [ 742.039053][ C0] synproxy_send_client_synack+0x89b/0xde0 [ 742.039085][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 742.039107][ C0] ? nft_osf_eval+0x2f4/0x880 [ 742.039129][ C0] ? synproxy_pernet+0x45/0x270 [ 742.039157][ C0] nft_synproxy_eval_v4+0x362/0x4e0 [ 742.039185][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 742.039211][ C0] ? nf_ip_checksum+0x13c/0x510 [ 742.039237][ C0] nft_synproxy_do_eval+0x389/0x5d0 [ 742.039266][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 742.039291][ C0] ? __lock_acquire+0x747/0x2de0 [ 742.039322][ C0] nft_do_chain+0x48d/0x1b10 [ 742.039355][ C0] ? __lock_acquire+0x747/0x2de0 [ 742.039377][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 742.039406][ C0] ? __local_bh_enable_ip+0xd6/0x140 [ 742.039431][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 742.039467][ C0] nft_do_chain_ipv4+0x195/0x290 [ 742.039491][ C0] ? ipt_do_table+0x2b9/0x15d0 [ 742.039514][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 742.039541][ C0] ? iptable_mangle_hook+0x18a/0x4c0 [ 742.039568][ C0] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 742.039594][ C0] nf_hook_slow+0xc5/0x220 [ 742.039615][ C0] NF_HOOK+0x21f/0x3c0 [ 742.039639][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 742.039665][ C0] ? NF_HOOK+0x9e/0x3c0 [ 742.039687][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 742.039712][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 742.039748][ C0] ? ip_local_deliver+0x113/0x190 [ 742.039774][ C0] NF_HOOK+0x336/0x3c0 [ 742.039799][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 742.039825][ C0] ? NF_HOOK+0x9e/0x3c0 [ 742.039853][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 742.039883][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 742.039922][ C0] ? ip_rcv_core+0x88d/0xd50 [ 742.039969][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 742.039997][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 742.040027][ C0] process_backlog+0xa6b/0x18b0 [ 742.040065][ C0] ? process_backlog+0x3de/0x18b0 [ 742.040107][ C0] __napi_poll+0xaa/0x330 [ 742.040140][ C0] net_rx_action+0x61d/0xf50 [ 742.040182][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 742.040236][ C0] handle_softirqs+0x265/0x8d0 [ 742.040273][ C0] ? batadv_dat_purge+0x2d7/0x3c0 [ 742.040305][ C0] do_softirq+0x77/0xd0 [ 742.040333][ C0] [ 742.040341][ C0] [ 742.040348][ C0] __local_bh_enable_ip+0x100/0x140 [ 742.040379][ C0] batadv_dat_purge+0x2d7/0x3c0 [ 742.040414][ C0] ? process_scheduled_works+0x97a/0x1630 [ 742.040452][ C0] process_scheduled_works+0xc3d/0x1630 [ 742.040506][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 742.040544][ C0] ? assign_work+0x3af/0x5d0 [ 742.040579][ C0] rescuer_thread+0x84a/0x12a0 [ 742.040606][ C0] ? rescuer_thread+0xb8/0x12a0 [ 742.040640][ C0] kthread+0x38b/0x480 [ 742.040664][ C0] ? __pfx_rescuer_thread+0x10/0x10 [ 742.040685][ C0] ? __pfx_kthread+0x10/0x10 [ 742.040711][ C0] ret_from_fork+0x514/0xb70 [ 742.040745][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 742.040770][ C0] ? __switch_to+0xc78/0x1410 [ 742.040824][ C0] ? __pfx_kthread+0x10/0x10 [ 742.040851][ C0] ret_from_fork_asm+0x1a/0x30 [ 742.040887][ C0] [ 744.630774][ T33] Kernel panic - not syncing: hung_task: blocked tasks [ 746.933087][ T33] CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 746.942310][ T33] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 746.952402][ T33] Call Trace: [ 746.955720][ T33] [ 746.958676][ T33] vpanic+0x26f/0x710 [ 746.962697][ T33] panic+0xc5/0xd0 [ 746.966445][ T33] ? __pfx_panic+0x10/0x10 [ 746.970892][ T33] ? preempt_schedule_common+0x7f/0xd0 [ 746.976391][ T33] ? preempt_schedule_thunk+0x16/0x40 [ 746.981803][ T33] ? nmi_trigger_cpumask_backtrace+0x31a/0x390 [ 746.988014][ T33] ? nmi_trigger_cpumask_backtrace+0x31f/0x390 [ 746.994212][ T33] watchdog+0x10e7/0x10f0 [ 746.998585][ T33] ? watchdog+0x209/0x10f0 [ 747.003076][ T33] kthread+0x38b/0x480 [ 747.007181][ T33] ? __pfx_watchdog+0x10/0x10 [ 747.011893][ T33] ? __pfx_kthread+0x10/0x10 [ 747.016515][ T33] ret_from_fork+0x514/0xb70 [ 747.021141][ T33] ? __pfx_ret_from_fork+0x10/0x10 [ 747.026292][ T33] ? __switch_to+0xc78/0x1410 [ 747.031061][ T33] ? __pfx_kthread+0x10/0x10 [ 747.035708][ T33] ret_from_fork_asm+0x1a/0x30 [ 747.040548][ T33] [ 747.044199][ T33] Kernel Offset: disabled [ 747.048539][ T33] Rebooting in 86400 seconds..