last executing test programs: 5.096119132s ago: executing program 2 (id=3907): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, 0x0, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x4000002, 0x3032, 0xffffffffffffffff, 0x2a1cf000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000d00)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x60d1}, 0x94) r3 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0xffffffc1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22052, r4, 0x0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB], 0x14}, 0x1, 0xffffffff00000003, 0x0, 0x60040}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) sendmsg$IPSET_CMD_DEL(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e00000000a06010100000000000000000300000908000940800000010900020073797a310000000005000100070000000800094000000005880008800c000780080009"], 0x13a}, 0x1, 0x0, 0x0, 0x4800}, 0x48080) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000891}, 0x0) 3.549853183s ago: executing program 2 (id=3917): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x63, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_INITIAL_QUANTUM={0x8, 0x4, 0xfffffff1}]}}]}, 0x38}}, 0x0) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="05000000010001", 0x7) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f0000000540)={r0, &(0x7f0000000400)='+.\x00', 0x1, &(0x7f0000000480)={@_ha_fsid={[0xdcf, 0x1000]}, {0x6, 0xdc, 0x1, 0x8}}, 0x9, &(0x7f00000004c0), &(0x7f0000000500)=0xffffff2c}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'macsec0\x00'}) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000200)={0x2, 0x6, 0x0, 0xa29, 0x3, 0x426}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x1e, 0x4, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800e9000000000000000000f3ffffff7018320000005059bf3d000000010000"], &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0100000002000000040000000800000000800000", @ANYRES32, @ANYBLOB="00000400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=r4, @ANYBLOB='\x00\x00\x00\x00'], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r7 = socket$nl_generic(0x10, 0x3, 0x10) close(0x3) r8 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r8, 0x89f0, &(0x7f0000000bc0)={'sit0\x00', &(0x7f0000000b40)={'syztnl1\x00', 0x0, 0x700, 0x8, 0x9, 0x9, {{0x5, 0x4, 0x0, 0x39, 0x14, 0x67, 0x0, 0x5, 0x29, 0x0, @empty, @remote}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000007200000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r9}, 0xc) r10 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r10, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbff, 0x2ffffffff}, 0xc) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x1, 0x70bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0xc568}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_TRUST={0xc, 0x9, {0x7, 0x10}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x2000c041}, 0x200088c4) r12 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000600), r10) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r12, @ANYBLOB="010000000000000000000100000014000200776731000000000000000000000000000000088000000080000000800000040002004e21ac1e00010000000000000000000002003dbed76a9068187ccfa42bbabca934ca1c86dbdaf91bf26157e315a039cce06400000a0001000000000004000a00000600000009fe8000000000000000000000000000bb0a000000000005000100000000000500ff7f00000000008000000a00010000000000008000000200d99700262d2b65444e1d8ffc7a1ff799af85970d315bded1f0b7cca3fcada6710000020005db88aac83273a64803b9fb23df4c9d135682cafd92199acc64f006216b6ca300000a0001000000e9be2b0371265c8bc5acee6e828c"], 0xd0}, 0x1, 0x0, 0x0, 0x4084}, 0x200080c0) socket$nl_generic(0x10, 0x3, 0x10) 2.719500712s ago: executing program 4 (id=3923): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@deltaction={0xc4, 0x31, 0x4, 0x70bd27, 0x25dfdbff, {}, [@TCA_ACT_TAB={0x28, 0x1, [{0xc, 0x14, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fff}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x800}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x4}, @TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @TCA_ACT_TAB={0x50, 0x1, [{0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xd}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x40008c5}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000a40)=ANY=[@ANYBLOB="050000000000000061"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000a40)=ANY=[@ANYBLOB="050000000000000061"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&'], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000a000000000200000700000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r2, &(0x7f0000000a40)='&', &(0x7f0000000040)=""/98}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r2, &(0x7f0000000a40)='&', &(0x7f0000000040)=""/98}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/89}, 0x20) sendmsg$nl_xfrm(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000480)=@migrate={0xa8, 0x21, 0x1, 0x70bd26, 0x25dfdbfb, {{@in=@rand_addr=0x64010102, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e24, 0x0, 0x4e21, 0xffff, 0x2, 0xa0, 0xa0, 0x3a}, 0x6e6bb3, 0x1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x3}, @migrate={0x50, 0x11, [{@in=@empty, @in=@local, @in=@remote, @in6=@empty, 0x32, 0x1, 0x0, 0x3502, 0xa, 0x2}]}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x90) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) (async) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4}, &(0x7f00000001c0), &(0x7f0000000300)=r5}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r5}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r6, &(0x7f0000000380)="0099d885", &(0x7f0000000480)=@tcp6=r3, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r5, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) clock_gettime(0x0, &(0x7f0000000000)) (async) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380), 0x8, &(0x7f0000000600)=""/191, 0xbf}, 0x20}], 0x1, 0x2040000, &(0x7f0000003700)={r7, r8+10000000}) 2.710448145s ago: executing program 2 (id=3924): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008091}, 0x20040000) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x2, 0x5, 0x9, 0x7, 0xc, 0x2, 0x5, 0x2, 0xf, 0x6, 0x1, 0xb, 0x2, 0x6, 0x1, 0x4], 0x3, [0x87, 0x101, 0x200, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x3, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x8, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x12) close(r8) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$kcm(r7, 0x0, 0x4005) 2.606966958s ago: executing program 1 (id=3926): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0xe, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000ecd0000000000000000000071106c000000000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r2, &(0x7f0000000480)={0xa, 0x4e1f, 0x4, @mcast2, 0xb90}, 0x1c) bind$inet6(r2, &(0x7f0000001bc0)={0xa, 0x4e21, 0x399, @private0}, 0x1c) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/9, 0x30a000, 0x1800, 0x2, 0x3}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32=r3, @ANYRES32=r1], 0x38}}, 0x0) 2.579743238s ago: executing program 0 (id=3927): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x18, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000079100000000000006300e0ff0000000095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xb9, &(0x7f00000002c0)=""/185, 0x0, 0x1, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa1}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)="aa1953d3", 0x4}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000140)=@rose={'rose', 0x0}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x34, r4, 0x301, 0x70bd26, 0x25dfdbfb, {0x1c}, [@ETHTOOL_A_LINKMODES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x40006) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000001080)=ANY=[@ANYBLOB="140000001000010000000000000000000300000ad0000000140a0103000000000000000007000008080003400000000008000340000000070900010073797a30000000000c000640000000000000000408000340000000030c00064000000000000000037e000800dcf482a437981760b41b15d9aa6437d49beb8e2f278bdcd941427d8f5393d4593c2b3667927d230cfe9a968fa0e9230513c578a9ee444ddffa5ec156a33ecde9614c2b0f1cf73daede055c1f0833be15191b5664df9abdde1885c451297a204c10e034283c8996b6233fda90d70740836f29fb79525b9b618d73000030010000000a0102000000000000000002000009080002000000030900010073797a310000000011000600caa827f5345c98c89c2610f7610000000900010073797a3000000000dc000600f26c231d1754d4a72ae880a0032781e3bcb2c43ce686ee542f03e274b8f02991f78849a57acae29b44214ca81397ee05289b295f9ef36deecf525e6db3d029c8d282b856ed5cf322d26c9f80014b5eb076572e88c4"], 0x29c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) syz_emit_ethernet(0xca, &(0x7f0000001dc0)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xbc, 0x300, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0xe0, {0x28, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x3, 0x89, 0x0, @private, @local, {[@lsrr={0x83, 0x7, 0x0, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x32, 0x0, [{0x0, 0x5, "df6116"}, {0x5, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x6, 0x8, "02a20948fd74"}, {0x7, 0xd, "ccf0294e2a3bdb4aa40b24"}]}, @end, @cipso={0x86, 0x33, 0x0, [{0x2, 0xe, "e16ef60f68c35d463511ccdb"}, {0x6, 0xe, "bc76652e8db847a0677b6199"}, {0x1, 0x11, "504cf7fd22ac597b8b72b483084633"}]}, @ssrr={0x89, 0x1f, 0x1f, [@dev={0xac, 0x14, 0x14, 0x39}, @dev={0xac, 0x14, 0x14, 0x13}, @dev={0xac, 0x14, 0x14, 0x40}, @remote, @private=0xa010102, @multicast2, @private=0xa010102]}]}}}}}}}, 0x0) recvfrom(r2, &(0x7f0000000040)=""/2, 0x2, 0x6667b9fa4a4fda0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010100000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a31000000007c000000060a010400000000000000000100000008000b400000000054000480340001800b000100657874686472000024000280e6ce01400000000c0800034000000000080004400000002205000200070000001c0001800900010068617368000200000c00028008000740000000010900010073797a3000000000140000001100010000000000000000000700000a"], 0xf0}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r7, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRES16=r8, @ANYBLOB="000126bd7000fedbdf251a0000000800010048000000050092000400000005009200070000000600210061000000080001004b000000060021006100000006002100620000000500920001000000"], 0x54}}, 0x20048000) sendmsg$NL80211_CMD_NOTIFY_RADAR(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f0000000900)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="080029bd7000ffdbdf258600000005001901050000000800a100d2d300000800a10039000000080027000300000000009f000200000008002201370000000800a100000000000800a000040000004d7ff7b3d1e64650c3dc2e5599c065b6c744801b3b0e0a35dca41ac56fddffffcd597bb0c97e6d6db8c8229021e177cf924463612429f27e2c31fd289de4ddfce8e35f9cfb9527115bbe0e02542d88dd3d3c2e2e40fd6875f1eb81c826c9776243a0d8d27911e97a"], 0x54}, 0x1, 0x0, 0x0, 0x4001}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fcffffff00000000000000006301230062247ee7cf69596eb7d85300"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r9, 0x84, 0x81, &(0x7f0000000280)="1a0000000212a277", 0x8) sendmsg$SOCK_DESTROY(r2, &(0x7f0000000680)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000dc0)={0x28c, 0x15, 0x20, 0x70bd2b, 0x25dfdbfe, {0x8, 0x3}, [@INET_DIAG_REQ_BYTECODE={0xfffffffffffffeb1, 0x1, "a751275899bc6e9a532d238d37b45f572b37b12c79b03f665daa534233ee424a1d59e7f3ff5d9841a1fb6f8951ed3d57e975848ad16ecfbf0399c18b478f05642c0738fc858fdaae22ed2ae47eb1dfb423151d8675e742e3529a"}, @INET_DIAG_REQ_BYTECODE={0xfffffffffffffef8, 0x1, "2f82ad9bf6d96602349fef94f36bd67b6f460dad62ab07c65ddb63045464b9508116ccc6b2711f0bdd41a689febb99fe4d93708c2c4841a1f3b2fa871f0e4cb5463d61a90c56b5962512e14f7b7608e9a6070b9ca38ee3f07621787107bd50714c304af4296134893feef9da11238923e489a2c0bb22dfe60af7098bb20641801d4e165e0e96a8d58611d3ab68249779a7ed1abb06e128b05aa7fd63df95335a89410ce74c4aaba7ec6b0b20a03d3e9314f5dc50fa32d99819b842066d73cf52f90fa4"}, @INET_DIAG_REQ_BYTECODE={0x89, 0x1, "455d82453bcccd9460ab1d14734b4113e5b737c4f1a2f9099bb50d2c2d7ef4bca2941fa10e56d5b5257891b34c04c4143f89984f003d2df14e1ac92ab4b2c4091edeb6eeba3708e7e5bcda402a35c631db1669c00c72f3084d8a72a7360e2c4544aacd5ec31b91a40ca7f301b9ce5a05231a7fe40c5219c4ec8fc62c0c6067d47d4530f6d9"}, @INET_DIAG_REQ_BYTECODE={0xc3, 0x1, "1c76c1c9dad65063c417d1e95d7708afa7c6bc3e1454d84b80d403efbc5cb2811ccc9016febbc35996850c65b866b7eac9a791bacb28029bd4b3d28a428570abb8274aff8021f06027c11ac83931204a17f5e0f86ddb7833cbb22d166cf4997f94309a28e8bccd7064ec0483b4b4c2deff33b7eeeff3881cae10990b932b4fdd42d73d670f2b587be4a0cc1c90eee4be0407c026bf20516b58521dce2f4f1dd96aaa307d382e74eb67d59025188d69b6c04bf2c2e45fa3a5728b4b0d0b48cc"}]}, 0x28c}, 0x1, 0x0, 0x0, 0x1}, 0xc000054) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r9, 0x84, 0x17, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) sendto$inet6(r9, &(0x7f0000000240)="b1", 0x1, 0x4040044, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback, 0xfffffe01}, 0x1c) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c000000020701020000000000000000050000040900010073797a31000000000900696a380afce822010073797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x800) 2.475849303s ago: executing program 4 (id=3928): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x81, @none, 0x0, 0x1}, 0xe) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x10001) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000002000000040000000000000802000000000000000000000d000000000000000001000085630000000000000001000000000000000000"], 0x0, 0x4a}, 0x28) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="d8000000", @ANYRES16=0x0, @ANYBLOB="080029bd7000fedbdf25070000005000018008000300010000000d0001007564703a73797a300000000008000300ff030000130001006574683a76657468315f766c616e0000080003000100000008000300feffffff08000300020000000c0007800800020009000000200002800400040008000200010000800800010004000000080002009f89000044000180380004001400010002004e23ac1414aa0000000000000000200002000a004e21000005ff02000000000000000000000000000103000000080003000300000004000580"], 0xd8}, 0x1, 0x0, 0x0, 0x40040}, 0x40880) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r3, 0x10e, 0xc, &(0x7f0000000200)=0x5, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="180000003a00290203000001fadbdf250a0000008e37683f86"], 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x8000) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="0100fdffffff000000001d00000008000300", @ANYRES32=r2, @ANYRESHEX=r3], 0x5c}, 0x1, 0x0, 0x0, 0x4815}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$inet6(0xa, 0x2, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r5) getsockname$packet(r5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=@newlink={0x48, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x50483}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0xe}, @IFLA_GRE_LOCAL={0x8, 0x6, @dev={0xac, 0x14, 0x14, 0x26}}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) sendmmsg$inet(r4, &(0x7f0000000880)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @empty, @multicast1}}}], 0x20}}], 0x1, 0x4880) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r7, 0x800452d3, &(0x7f0000000200)) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, &(0x7f0000000140)="6d527cd53870164a3a0d4b64fb0d7bebad2dce076e7768215970e33adf15173c9e665cff10727f6273ef2aace367c13b8e834788d7da2d60077ebc24a796b221a2f39fd294dc01861206b499138d02ebf3cfc3b11f0e18858568476bac483df9c4d0a61da2d2f9b7c4cb601c0141f209fc9e06d9457920a9a749a23ccd52eb91db50189627774719cf91bd6e63a2b8a3b657c0e438ffc3e275b03ef0f384a0c1f20143b7b87f2e34729b000000805e0ad338423d4200f349c545516c46bb9f104a3816b12950faa20fab5827bc62a8d4cc12c4c8954308a933d63aa66cdb3646a37626de7361b5338c197dd3e6844dafcb4338dce0b79ee41da150eca12fbd36b4873ce8e4747b63e8830ee6c32f254d37792053e2b77cc86279ea843600"/297, 0x3accf8d5) vmsplice(r9, &(0x7f0000000440)=[{&(0x7f00000000c0)='7', 0x1}], 0x1, 0x100000000000000) close(r8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2.468924671s ago: executing program 1 (id=3929): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'gre0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x10, 0x700, 0x4416, 0x80, {{0x21, 0x4, 0x1, 0x8, 0x84, 0x64, 0x0, 0x8, 0x2f, 0x0, @broadcast, @private=0xa010102, {[@timestamp={0x44, 0x14, 0x40, 0x0, 0x8, [0x51c8, 0x5, 0x80000000, 0x1]}, @timestamp={0x44, 0x20, 0x79, 0x0, 0x7, [0x1, 0x9, 0x101, 0x23a, 0x64, 0x91c, 0x80000001]}, @timestamp_prespec={0x44, 0x14, 0x28, 0x3, 0xe, [{@rand_addr=0x64010102}, {@loopback, 0xeb}]}, @noop, @rr={0x7, 0x7, 0x97, [@loopback]}, @end, @timestamp_addr={0x44, 0x14, 0x8a, 0x1, 0x4, [{@dev={0xac, 0x14, 0x14, 0xc}, 0x3}, {@broadcast}]}, @generic={0xdf, 0x9, "d9258f4bc2abe6"}]}}}}}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000240)={@rand_addr, @private, 0x0}, &(0x7f0000000280)=0xc) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000380)={'syztnl1\x00', 0x0, 0x10, 0x7800, 0xb2f, 0x9, {{0x19, 0x4, 0x2, 0x3, 0x64, 0x65, 0x0, 0xf, 0x29, 0x0, @rand_addr=0x64010102, @broadcast, {[@ra={0x94, 0x4}, @noop, @ssrr={0x89, 0x1f, 0x85, [@multicast1, @multicast2, @broadcast, @empty, @loopback, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @end, @ssrr={0x89, 0x2b, 0x4, [@empty, @multicast2, @local, @private=0xa010101, @broadcast, @local, @local, @local, @rand_addr=0x64010100, @empty]}]}}}}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000440)=0x14) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x5, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x6, 0x2, 0x101}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x24008010}, 0x20000000) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000540)={'erspan0\x00', &(0x7f0000000480)={'ip_vti0\x00', 0x0, 0x7, 0x8, 0x85b, 0x3, {{0x25, 0x4, 0x0, 0x6, 0x94, 0x65, 0x0, 0x8, 0x0, 0x0, @broadcast, @empty, {[@timestamp_addr={0x44, 0xc, 0x59, 0x1, 0x5, [{@dev={0xac, 0x14, 0x14, 0x9d}, 0x2}]}, @cipso={0x86, 0x67, 0x3, [{0x7, 0x8, "a24ac63b66b0"}, {0x6, 0x7, "2abc4b9a0d"}, {0x6, 0x12, "7aa26b6e9cc77540b54b89d143d5f97e"}, {0x1, 0xe, "92703665c78f05250d444ee3"}, {0x7, 0x11, "f063dfc3019e46d3970610fe71f6da"}, {0x7, 0xa, "41318e48550dc6ea"}, {0x5, 0x5, "b5e57c"}, {0x1, 0x12, "237c1c0c2b4e619c47e7b0d0cab3dde6"}]}, @generic={0x94, 0xa, "2632dc1a18b220e6"}]}}}}}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000580)={0x0, @loopback, @initdev}, &(0x7f00000005c0)=0xc) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={0x1, 0x58, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0x2}, {0xffff, 0xffff}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_blackhole={0xe}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x3, 0x0, 0xfff5, 0xfcf, 0x0, 0x104364ec, 0x1}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000006c0)=0x0, &(0x7f0000000700)=0x4) getpeername$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000980)={&(0x7f00000007c0)=ANY=[@ANYBLOB="a0010000", @ANYRES16=r0, @ANYBLOB="000127bd7000fcdbdf250d000000340001801400020076657468305f746f5f6261746164760008000300020000001400020070696d726567000000000000000000000c0001800800030001000000340001800800030003000000080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="080003000000000008000100", @ANYRES32=r1, @ANYBLOB="08000300030000001400018008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="4000018008000300000000000800030002000000140002006361696630000000000000000000000008000100", @ANYRES32=0x0, @ANYBLOB="080003000100000008000300000000002c0001801400020076657468315f746f5f6873720000000014000200677265300000000000000000000000001800018014000200766c616e3000000000000000000000004000018008000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="140002006970366772657461703000000000000008000100", @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="40000180080003000100000008000100", @ANYRES32=r12, @ANYBLOB="080003000300000008000100", @ANYRES32=r13, @ANYBLOB="08000100", @ANYRES32=r14, @ANYBLOB="140002007465613cb7c8416176655f3000000000"], 0x1a0}, 0x1, 0x0, 0x0, 0x4000000}, 0x4004014) r15 = syz_init_net_socket$ax25(0x3, 0x2, 0x6) ioctl$SIOCAX25OPTRT(r15, 0x89e7, &(0x7f0000000000)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, 0x2, 0x20}) r16 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r16, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="880000000107010200000000000000000200000008000540000000010c0006400000000000004fe40c00064000000000000000091c000780"], 0x88}, 0x1, 0x0, 0x0, 0x44}, 0x20040080) 2.367307858s ago: executing program 0 (id=3931): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000006c0)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0x138, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x338, 0xffffffff, 0xffffffff, 0x338, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [0xffffff00, 0xff000000], [0xffffffff], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {}, 0x88}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@unspec=@statistic={{0x38}, {0x0, 0x0, 0x3096, 0x7fff, 0x56e5, {0x2}}}, @common=@inet=@udplite={{0x30}, {[0x4e23, 0x4e23], [0x4e24, 0x4e21], 0x1}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @dev}, [], [0xff, 0x0, 0x0, 0xff000000], 'erspan0\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x3}, 0x0, 0x1d0, 0x200, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x80000001, 0x3, 0x20, 0x0, 'syz1\x00', 0x4}}, @common=@ah={{0x30}, {[0x4d4, 0x4d4], 0x84, 0x25, 0x3}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0xffffffff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$inet(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000280000002800000005000000030000000100000f97fe0000050104000100000004ffef004d3655070000000000000f01000000b500612e61"], &(0x7f0000001b00)=""/3, 0x45, 0x3, 0x1, 0x5}, 0x28) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = accept4$tipc(r6, &(0x7f00000000c0)=@name, &(0x7f0000000200)=0x10, 0x800) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000400)={'wlan1\x00'}) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/net\x00') syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r7, 0x8990, &(0x7f0000000180)={'veth1_virt_wifi\x00', @ifru_names='bridge_slave_1\x00'}) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840, 0x42c04}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x2}, @IFLA_BR_AGEING_TIME={0x8}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x300}, 0x24) 2.194122148s ago: executing program 2 (id=3933): socket$alg(0x26, 0x5, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x60040, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000300)=""/219, &(0x7f0000000140)=0xdb) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r2, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r3], 0x3c}}, 0x0) 2.163685075s ago: executing program 4 (id=3934): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1a, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r3, 0x58, &(0x7f0000000180)}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x2000000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="0600000004000000be7000005c00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200000000000000e36f07bf4b59ec4608aa458a433a63e9c13af2526b457e16c7d8ace5ffd4ece066cea0b7ef8dcd641cbc5599"], 0x48) bpf$MAP_CREATE(0x2000000000000000, &(0x7f00000007c0)=ANY=[@ANYBLOB="0600000004000000be7000005c000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="aa"], 0x48) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) syz_emit_ethernet(0x3c8, &(0x7f0000000880)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "122d92", 0x392, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1802"}, {0x0, 0x1, "000000050000000026000400"}, {0x18, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x18, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "f5000000000000000007000200000000000000000000000000008879e66485201a0015ca837400"/55}, {0x0, 0x14, "5e14f0e7e72d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fa632dbf04542188b196e213408c"}, {0x1f, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}, {0x1f, 0x2, "6eec22507c120a6fb50ecc30272b073d"}]}}}}}}, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r6, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) ioctl$XFS_IOC_GETVERSION(r6, 0x80087601, &(0x7f0000000280)) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r1, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000c00)="4307ed2e", 0x4}, {&(0x7f0000000780)="427449fe2897ff2d31a79c31468f3474bfba5e8b5248f24721d5da921684ae81df6ce5c2a438bec3512f08b85fd1fe0a36638cadb0c12cce9009c67d079d62b29223e517895c2513990da07a7925460e8f346b311f3b62538b5d7be03c998796199269323122b82035608384cd8a77518e72e5ffa19aeaaa8713e4c03123cf4dc9a69ec06ecd5304fca5e5b120212f2710ce8696af3dec976aea81fb73386033bb7790afc27bdf7e7e067f1745cd6c9e12d72725d1585b3a565db7685bc8a01bc86ff60a25fa1136067ef552c4fb1b", 0xcf}, {&(0x7f0000000c40)="6ad84a0beca61953479d93776519fd63938fbbe27dc1b67e52b110557498f8c223f01d3844f2a636fb51faf3f7c869ca131ed0278bf03e839b57acbac4", 0x3d}], 0x3}, 0x4) 2.047620489s ago: executing program 1 (id=3935): r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0xc004) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="9c010000", @ANYRES16=0x0, @ANYBLOB="000228bd7000fedbdf250b0000003400018014000200697036746e6c300000000000000000001400020076657468315f766972745f776966690008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="60000180080003000000000008000100", @ANYRES32, @ANYBLOB="0800030003000000140002006970766c616e310000000000000000001400020076657468305f746f5f6272696467650008000100", @ANYRES32, @ANYBLOB="1400020076657468305f746f5f6261746164760054000180140002006261746164763000000000000000000008000100", @ANYRES32, @ANYBLOB="080003000100000008000100", @ANYRES32, @ANYBLOB="0800030003000000080003000300000014000200697036677265746170300000000000001c0001800800030000000000080003000300000008000100", @ANYRES32, @ANYBLOB="78000180140002006361696630000000000000000000000008000300040000001400020070696d367265670000000000000000001400020076657468305f746f5f6261746164760014000200626f6e64300000000000000000000000140002006d6163766c616e30000000000000000008000100", @ANYBLOB], 0x19c}, 0x1, 0x0, 0x0, 0x24000800}, 0x4045000) 1.768211594s ago: executing program 1 (id=3938): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000008000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31050000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) unshare(0x22020400) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000180)={'batadv0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000240)={@mcast2}, &(0x7f0000000280)=0x14) (async) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000240)={@mcast2, 0x0}, &(0x7f0000000280)=0x14) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r2, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000400}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x68, r3, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400001a) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r7, 0x0) ioctl(r1, 0x8b29, &(0x7f0000000040)) (async) ioctl(r1, 0x8b29, &(0x7f0000000040)) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a50000000030a0fdb00000000000000000a00000608000b40000000020900010073797a31000000002800048008000240767bd2c3080001"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) 1.668530255s ago: executing program 3 (id=3939): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$INCFS_IOC_CREATE_FILE(r0, 0xc058671e, &(0x7f0000001580)={{'\x00', 0x2}, {0x4e2400}, 0x1, 0x0, 0x0, &(0x7f0000001380)='./file0\x00', &(0x7f00000013c0)='./file0\x00', &(0x7f0000001400)="f831ff8b3fd39738f1a883a97d5d037509cc042c680c17bed48be2e884d11b24d8944276f5c458122308cdbab840aa154c56dc899d2bfe00f0ba35757f0e7b523f00dff625d358936d2ef1e1c471bff147df744cc5d853cfba2a9835d0278af2399394fd89bce9105b98d0f99b6c97623a8b39967af6cec45e5b53b572c999de104fab055c36910cc89caa00f76bffdf8970a00b", 0x94, 0x0, &(0x7f0000001600)=ANY=[@ANYBLOB], 0xa8}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000300)={0x0, 0xa967, 0x8}, &(0x7f00000014c0)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000001500)={r2, 0x7}, &(0x7f0000001540)=0x8) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x1c0, 0x20a, 0x278, 0x1c0, 0x278, 0x3, 0x0, {[{{@ipv6={@local, @loopback, [0x0, 0x0, 0xff000000], [], 'bond_slave_1\x00', 'team_slave_0\x00', {}, {0x101}, 0x3b}, 0x0, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x4}, {0xffffffffffffffff, 0xfe, 0x83ae0c10c44c0425}}}}, {{@uncond, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@ipv6header={{0x28}, {0xe7, 0xd}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtaction={0x18, 0x30, 0x48b, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x980) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in6=@loopback, 0x4e24, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x3, 0x800000, 0x0, 0x4000000000000001, 0xfffffffffffffffb}, {0x0, 0x1, 0x2}, 0x800}}, 0xb8}}, 0x2c000010) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x4004) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f00000045c0)=@ethtool_gstrings={0x1b, 0x3}}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x34, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r9, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000810}, 0x20084084) sendto$phonet(r3, &(0x7f0000000340)="e34662856e06baceccea576bdce8b1b253bf33f84b5d27dd562105a76aa1164a1a821a1569bbba29eb2836fee805c93ce4b837e3910bee5dd1febdee1100e2583af052ff70e2b742f14f95d999237bd21569c85fcc09cdf709eab0016dc2d93e2c3e5a2789c7418c9ade655857744802c479c1e32a9368ce7238033c81fc68736018d16803c981855bded30a83d4611f68678b6a08999b3dffb1a33b321ddac7f040bab45408f7d55e5c4e40db761003bb37091141917596b77ce3afaec1c28e3a4938a4aa8c07884de465234978ba53661e44f1ce84fdec23e490ba800004d97a5960f97384e1bfd88b0d1f43c321ec12a1efb16c70ba02cc78f5388cabf33ab98404a0e3584ea553d01f77ecfc9cdf2510bf09ba63875759740418cf28bc1408e80d1f7820482e1447fb22a65848cab97ef1303548f3944e7db784d777426903b549be6b186189d1a353e3e9a7cea9d7839a1a0f84e1aca9bebb56e1bfc19f6a62b49052ffdf538793746c52d20f50d64dad93cafbc1ef2222f33976559be0ab43bb7782714dc22d2f796f05595ce1890f8d5056a34d9ff9858b412712a9f5e9a6b66295e8cffc6db5e1aa94176463bf5026e3a4f602b4933e4c768640b112567250645090c27a4f1e8b9bfa6a28809245d30cde061f3682e657d7badd3ffb608a50aae3d83b703fcc1908b0810021a901449e230f65bf180b2fad413223b8c835d6172f6d7f5968b6ff56e111400b61fa99e4de77f40cee46dc500991172749681ee44e09612ded13b0f2efe18128189212d8c75dcbdfc0196ac51d349810a8697514d9a97e966175b4713c17fa4123cd216a949d3baed2b05e3fd418bdb1f039080921c953ad96002a973f9271155f9d5affed79dc35748d3bdf0d681c29d3f062174e8424ad175921dc3f3f918099e3264d8371ce1fc0ea1d8b70e7b196d1db0efd330de53eee8f5f2564a3e5be5fb205836b62dfd8e71eb74f6c6d5591a21a78b0abe6839c92f897a3ebce43768b17567af7b85e35b3525a0c9762dd889963add7d65f8c7b1555f1daac1cfda863ecf559447f163a21e2084c268a48f06263b599a71be4c41b674b0b245135dfefd24718a8a50437d54c65ad18a4a07b549a9e4470e6ff42f0546a25c8c3e47d468d5aed694bf584127dcd30f3f3bafc82788b855ca81da36bcd39ae883e20abb1981ae18594ac4a0f57ad401c3052b3c6276e05c3e2428f7ef2284b3b71f8e3c2af43c36ca820ad229b19f9c0fca77afd6cbcd21f35a8f07d70afe1375633d6a7c52198604218722aceddf85381a99536e2a19165e4faa0c314ce06333e9188196cf51d8214b98ffda9e640e426434f21134258834ab6676c5b8a09217bbe2cde4fad42ab6cd5a6be85320df986afeeb9478fd9ec457b8c642dc26065f344669726b3037b23ff8500a19719ed5511e64e1a4e8a41137b83f0038c9c638bee074188475990a9cf770368ddd24bd6638c513f3698a86a1f535560e76018402532c028a67d4a901d8128482b240207bf440796383ec5a4bb34512b867eb1f31564fdc616ae94c26736af9b7b7ae1acf6e9e087af4a4f05ed15010fad8f525d3bb3ad5f0c4d7cb8ee31d55a4331dd5299414ce19491cccdd50dc0d28e08da4124bf0c10448330eb15690ae835cd16d066db3f1cdafa42dfd979e8df401a0f4dc2cc63574d352fa092cd512253a21ff1f081c2217516e6d6c25090274125d3563ba3ec7b1230d25f802bf5a73a97713ea5921c4167fcc7cf1aecffdf61714d8b0749d1df95124aba643b7681b83247178a1641a624e6116162ed1460c6fbbcd2147098539db9ed21ec62a1a752f909b81c9022b938f23f134662709a0cc8a18e4cefa4a8ba2e5107a0d2a6af6d7ec3f6c8be956d007cdcd60b32d71a23d841ffb02231fdef7cbddbdfdd175977ad08fae377c7b360beca7986839efba69fcc178be6bc289f57f0533cc36166bcc534f2d88f4d4ca47c337bfadf853f7f0bf5c1d0dfcfa6cefdddc152e88b8d0381fc953da6389795a12c4e8f81374496be0c377b17735afe608fee2ae9d0951f5d4a610088f4d15c1018712f10c0796d8f1417d4b23105e5e2bf0683e4eca92101217ad03910a94d32667a50fd9ba48971eda5144c573ed9c73edf4244bbddd7b5f3f6203d2b7371faf6455a27504587ec70d99fa38337c3a7fbcbf05f96fba0ab2200223583dbab2003a38959be2bb07375c8e4fae0cffce45f15b905e8a2a8054f517d06373481a673cc930400680fd372075d60e549717ca0dc5b0cd36e33102d52e6fe3c7f873090385fd0e0a4f5da38f70225000f0df0679af08aeb7ccef17630a3dc25f3c047c210a6922448c7d505592598b8f4c9ee0c50fc2327b1648213b406d77508e493a298f6a413110bb57411f93b6d4f462a6394853e1cb2bf776a03215c9e22a54d657d032bf87e2572ba8515aee8001ed8c807a3056b03ab4ae2ad592194c597b1b0951443b77ab2fc42463add49552c7e1d7ce45be5d172a0415381546932381ba618592a23fbf7e702b6c3839479a8a09b8913ac49a4e8a6dd615a61c5f94eaa7dbd1b8187d82073015ea30fb0960b7d8083cf7e00f8c322b21a5a013c47ccc3b37901b8e54a14f690579a4ee5cd46cb61d7070985b89a57eafc1e9f060a3082dd02c9706c9a6aefe341c27f52da3874527c9b0178329dff93548824df39024d03aefc6125f7456f80c3204884e021114e62e24c4191c78acbce17bb06b971a6c41882d43d4a89a582c3d737d46484a16f82760dfd8bbe14af5889c1efcd0d11a3ea17233ac2528c8ff5e9de843e7a96a0a2406592b5435964931562fb8c7d5154c3e62844ea0fa00cb28c28c762c27473027d9fd1bafcae9180ed7274dff659ccacfd1b9f7b8f7ed8bd6bf5af6792c80ad00129c043584249033fb755f18ac112cb9ad425b733fcbdb2148b66aadb0db100a1082aa9d942eed297b3b8fec872f8d0816b238a6ab1c8c666b23f150e0aa3f6bebc96bdff07edb194c6c157c73d11bcff584f0ca40b308aa0a1d6cab12b4dce62606b0d458cf00577465afefb3c18dbd5592d29a612c8784f68f4db1d6162bdb3e503cefc94c0fdc9587c068795dde266e2b550653a92282efd057735118220255642715bb7f768c214b65c9514dacf5257b2f366f70bb17d89d0fdbe75ab9475039f08b3c8bc32d20fd145863da6473464ae598a49b28a2bce57c57b89a150e70edaa96d2355128a0130abf6650d69a690b0dd6f70bf8bbc5ac1bb0959ed52eb19cd5ef3f981f9190a1854b4f8450efbfaa8e5b513c85eb228b873ca53c8b5d005d8d00216a917d3a850fe5c8ba2c5445883dca51c8928afe108e57de6eedd2b663c952bac05491ad0e57831b523fc20e1b78ea401bdb035293f6af763c6256848fc37b3826c8beb659a25742fe9694fe9388c8147ea931528dd667c7bc0e859d652f04c582c23798cb0c09fd1da6476982f18c48dec5b4cae25c3d1e86ce5ebec9b4fa85037b0c7340735f912134c9192f0ac613ef9bae715eeefd1e79176d0ca894ff3fa4b93d65dc2d34ac223a8f59afae477338bdd7b57eff356d5a0899476f676e45617ca453287c86b40a224252559644eefe72d4a5f66b54d66e78377a41c6ff11ec9484dab28ceccac44047525db20ea82ef6ad89e4892ea559b85748db0ec3f1aa6dec1adb535c51e16afdd15f0e7710ec9353f9a0a1372cf8e1f6515137f8a379d769a24c0ff3e4a93ebf8cbe2cc130369703ec93777403c852426e02510d0ed05fd688a1ac92b092e60f98d002f33713480165210753226308b71799312cf6f1a8247cd26a5d8754c41537c61bda1141f93d5b9a1bfcb42c798200c562f1fb23e80210d05ed00e3a56c3d3bf9405bd9dad7529efeb96147e076acfd9f3639514470014214e92ceac367d0fdf43062bb729bfccb39df34ad7fd78df969f77938315535f85d778833b7076c49c75cb1767e46c74aa9bdd9ee60c87b6796b41b4657a94101bbfcca283539da29988366fdd047d21ea8e6447740b907152d8fe9a7b5c179a9e3cfd0919ccfea22e73a35f1a4d2ac187230bf676ffebeb8bf5d0bc721533770460178803934b016f282f04ac259d05ce0c9592b9c7e04c62ad6c695fd837b561eec70854a801fcec6da23984cb72520fde51df3beff65d15e0246dd88082867506c01d5ec74e4f456382e5897ca6350b2a48cc65277a88f118c69a65e3963bb31d374ef3fe87ad89afa30dd6273aa6178fd50c7080db53973acc3c764c53decc373e84bb03060e589207d24e55998dea99164edd21c3e22ee40898fdfeb27ad8cd8b00f11f56fbd112e8566947d035bbb2f60f518a3f307996face827457acf80a3cfed3af15a6c14f7f315013fbf2ff18de45b9e050464798c7db290a7a495f1f3a86720355402faa5c375843118699d3aa4701a3045e199cb904dbcea0434e0de70618b9423171c0d4cf2f46cb29d2694676004b0d9cd85e4a1b9931005f92bac759d3012a4e0e71459b5ffd522c4e909410b0bbf0ecfba05f5c9770d64da55c20333a39c1555b9d0100f13c8a3337ac33b8ff5518af774e16fcbcf32ef2450f1ee1fb14b438a5c258fd3179d039b337110fa1465c9a0e96ae836dacafdc42ba4067f27029bb569a71df7487a174d62f59918d622aaf3f7598f98a72d27bf848106b12f25999fdf8f54a823b5a4c96c571b78a83201c5ec30e0c4e6b58b0948bc12056156deec48f44887c079e37988e2eab063e7eef9a24d4838850282d4191e77a7c36e03f895dc47ef4e8d72dd7525a1283eae2fbdfa74def4caba2976e0256e5b77867a0c3d4a410f938335aef1b9ccd12907fbb9cc3854a49c366d6e99f0bc9d9adfda7150ece17200662eaee06f24b6573828d26fd0bc0f77797f0693b99adddbf6e1f50af0f79a9b2325d70a142972326155d4b3c49832634a39e935f34374c4a5677d7a642c3225a08fcfeda91c8a9eb6116d6022ba8d5792f32287a3f75b7b33348f7b0c0334edffeafbaa4898c57e8dd4fab7af84a60071e168b964cb858dba17002b25b227620a7dda6310485928d7b5aa2c4936b3e28670d69de1465a60220b9bc01d0e42379017030798831b12168f51990bbcac4dfd65a6ec702d9be0c4cc781a20722e921ee12b657e0b49c40191f1381f6b27da753afeb62535b31dae6b40eb7fda7271ce15e5a5401a87fe6b8d137cea3268540e52b652c1a707c284730fb1bf4d55e45b665ffb7e4c5ba39f4453fdcd9e711aa5fb1fa189d744ecab3b2377324541408fe31c40372ab40e21d77ac19b3db385a05805b57b76b507557872e200b68d9e15e85f7e9d5448259e73ed611c1ec0422a99ba7b63464d9d4296f882b9d7ba627956dd2bc8af031a8902ee9570d67a4252d940bead7c3b6294e38dcbc8bf976ea3a55c2bf5f3c0d718b28be29bf1815a512ecdcb5230faa46c6111d0bc1c4e50e622a348addb5abf29c2f406a953e80d355542a70d18ab1daecbf9f8b7030427644ac89c868903bd8ab7c3d2a9b8195bbade65ad6b2f3a6e5da071818dc88edc7f3fa756d19edde51e745771cb43c128fdd85da1b8467cdddd57d608c572f3e13887db983c720beeb17e155df9f8d358672f7f7d72250fc9a697da2f45bcecff8d83704543b116f21b683597562710fb6a05c441ae93a13a892e15c503aad136ba4e4abf824c9fbc020f45ab36a453c30c8482503b3aee27ff10c3da428e1f2671d8792aa0199d85c51406c93ec84e34e180ea", 0x1000, 0x4880, &(0x7f0000001340)={0x23, 0xc, 0x81, 0x2}, 0x10) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r12 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r12, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @broadcast}) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r13, &(0x7f00000001c0)=[{&(0x7f0000000280)="dc", 0x1}], 0x1, 0x3) close(r13) socket$inet_tcp(0x2, 0x1, 0x0) 1.572793916s ago: executing program 2 (id=3940): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x5411, &(0x7f0000000200)) 1.546145681s ago: executing program 0 (id=3941): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000780)=@bpf_lsm={0x18, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000079100000000000006300e0ff0000000095"], &(0x7f0000000040)='syzkaller\x00', 0x5, 0xb9, &(0x7f00000002c0)=""/185, 0x0, 0x1, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa1}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)="aa1953d3", 0x4}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) setsockopt$sock_int(r1, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000140)=@rose={'rose', 0x0}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x34, r4, 0x301, 0x70bd26, 0x25dfdbfb, {0x1c}, [@ETHTOOL_A_LINKMODES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x40006) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000001080)=ANY=[@ANYBLOB="140000001000010000000000000000000300000ad0000000140a0103000000000000000007000008080003400000000008000340000000070900010073797a30000000000c000640000000000000000408000340000000030c00064000000000000000037e000800dcf482a437981760b41b15d9aa6437d49beb8e2f278bdcd941427d8f5393d4593c2b3667927d230cfe9a968fa0e9230513c578a9ee444ddffa5ec156a33ecde9614c2b0f1cf73daede055c1f0833be15191b5664df9abdde1885c451297a204c10e034283c8996b6233fda90d70740836f29fb79525b9b618d73000030010000000a0102000000000000000002000009080002000000030900010073797a310000000011000600caa827f5345c98c89c2610f7610000000900010073797a3000000000dc000600f26c231d1754d4a72ae880a0032781e3bcb2c43ce686ee542f03e274b8f02991f78849a57acae29b44214ca81397ee05289b295f9ef36deecf525e6db3d029c8d282b856ed5cf322d26c9f80014b5eb076572e88c4"], 0x29c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) syz_emit_ethernet(0xca, &(0x7f0000001dc0)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xbc, 0x300, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0xe0, {0x28, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x3, 0x89, 0x0, @private, @local, {[@lsrr={0x83, 0x7, 0x0, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x32, 0x0, [{0x0, 0x5, "df6116"}, {0x5, 0x12, "ffd11634eea26b0faffa0dea2e903528"}, {0x6, 0x8, "02a20948fd74"}, {0x7, 0xd, "ccf0294e2a3bdb4aa40b24"}]}, @end, @cipso={0x86, 0x33, 0x0, [{0x2, 0xe, "e16ef60f68c35d463511ccdb"}, {0x6, 0xe, "bc76652e8db847a0677b6199"}, {0x1, 0x11, "504cf7fd22ac597b8b72b483084633"}]}, @ssrr={0x89, 0x1f, 0x1f, [@dev={0xac, 0x14, 0x14, 0x39}, @dev={0xac, 0x14, 0x14, 0x13}, @dev={0xac, 0x14, 0x14, 0x40}, @remote, @private=0xa010102, @multicast2, @private=0xa010102]}]}}}}}}}, 0x0) recvfrom(r2, &(0x7f0000000040)=""/2, 0x2, 0x6667b9fa4a4fda0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010100000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a31000000007c000000060a010400000000000000000100000008000b400000000054000480340001800b000100657874686472000024000280e6ce01400000000c0800034000000000080004400000002205000200070000001c0001800900010068617368000200000c00028008000740000000010900010073797a3000000000140000001100010000000000000000000700000a"], 0xf0}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r7, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYRESHEX, @ANYRES16=r8, @ANYBLOB="000126bd7000fedbdf251a0000000800010048000000050092000400000005009200070000000600210061000000080001004b000000060021006100000006002100620000000500920001000000"], 0x54}}, 0x20048000) sendmsg$NL80211_CMD_NOTIFY_RADAR(r2, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000600)={&(0x7f0000000900)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="080029bd7000ffdbdf258600000005001901050000000800a100d2d300000800a10039000000080027000300000000009f000200000008002201370000000800a100000000000800a000040000004d7ff7b3d1e64650c3dc2e5599c065b6c744801b3b0e0a35dca41ac56fddffffcd597bb0c97e6d6db8c8229021e177cf924463612429f27e2c31fd289de4ddfce8e35f9cfb9527115bbe0e02542d88dd3d3c2e2e40fd6875f1eb81c826c9776243a0d8d27911e97a"], 0x54}, 0x1, 0x0, 0x0, 0x4001}, 0xc000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000fcffffff00000000000000006301230062247ee7cf69596eb7d85300"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r9, 0x84, 0x81, &(0x7f0000000280)="1a0000000212a277", 0x8) sendmsg$SOCK_DESTROY(r2, &(0x7f0000000680)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000dc0)={0x28c, 0x15, 0x20, 0x70bd2b, 0x25dfdbfe, {0x8, 0x3}, [@INET_DIAG_REQ_BYTECODE={0xfffffffffffffeb1, 0x1, "a751275899bc6e9a532d238d37b45f572b37b12c79b03f665daa534233ee424a1d59e7f3ff5d9841a1fb6f8951ed3d57e975848ad16ecfbf0399c18b478f05642c0738fc858fdaae22ed2ae47eb1dfb423151d8675e742e3529a"}, @INET_DIAG_REQ_BYTECODE={0xfffffffffffffef8, 0x1, "2f82ad9bf6d96602349fef94f36bd67b6f460dad62ab07c65ddb63045464b9508116ccc6b2711f0bdd41a689febb99fe4d93708c2c4841a1f3b2fa871f0e4cb5463d61a90c56b5962512e14f7b7608e9a6070b9ca38ee3f07621787107bd50714c304af4296134893feef9da11238923e489a2c0bb22dfe60af7098bb20641801d4e165e0e96a8d58611d3ab68249779a7ed1abb06e128b05aa7fd63df95335a89410ce74c4aaba7ec6b0b20a03d3e9314f5dc50fa32d99819b842066d73cf52f90fa4"}, @INET_DIAG_REQ_BYTECODE={0x89, 0x1, "455d82453bcccd9460ab1d14734b4113e5b737c4f1a2f9099bb50d2c2d7ef4bca2941fa10e56d5b5257891b34c04c4143f89984f003d2df14e1ac92ab4b2c4091edeb6eeba3708e7e5bcda402a35c631db1669c00c72f3084d8a72a7360e2c4544aacd5ec31b91a40ca7f301b9ce5a05231a7fe40c5219c4ec8fc62c0c6067d47d4530f6d9"}, @INET_DIAG_REQ_BYTECODE={0xc3, 0x1, "1c76c1c9dad65063c417d1e95d7708afa7c6bc3e1454d84b80d403efbc5cb2811ccc9016febbc35996850c65b866b7eac9a791bacb28029bd4b3d28a428570abb8274aff8021f06027c11ac83931204a17f5e0f86ddb7833cbb22d166cf4997f94309a28e8bccd7064ec0483b4b4c2deff33b7eeeff3881cae10990b932b4fdd42d73d670f2b587be4a0cc1c90eee4be0407c026bf20516b58521dce2f4f1dd96aaa307d382e74eb67d59025188d69b6c04bf2c2e45fa3a5728b4b0d0b48cc"}]}, 0x28c}, 0x1, 0x0, 0x0, 0x1}, 0xc000054) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r9, 0x84, 0x17, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="06"], 0x9) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) sendto$inet6(r9, &(0x7f0000000240)="b1", 0x1, 0x4040044, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @loopback, 0xfffffe01}, 0x1c) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c000000020701020000000000000000050000040900010073797a31000000000900696a380afce822010073797a3100000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x800) 1.504137199s ago: executing program 4 (id=3942): socket(0x10, 0x803, 0x0) socket(0x22, 0x2, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000820000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.503922285s ago: executing program 1 (id=3943): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008091}, 0x20040000) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x4}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x2, 0x5, 0x9, 0x7, 0xc, 0x2, 0x5, 0x2, 0xf, 0x6, 0x1, 0xb, 0x2, 0x6, 0x1, 0x4], 0x3, [0x87, 0x101, 0x200, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x3, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x8, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x12) close(r8) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="27030200000314000e00003cddcb00000000001100000000000000000000000000000000000085dc9d9839dc1336", 0x2e}], 0x1}, 0x4005) 1.376829332s ago: executing program 2 (id=3944): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8810}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x58, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xceb, 0x7, 0x6}, {{0x0, 0x0, 0x1, 0x1}, {0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x5dc}], 0x1}, 0x4) 1.293704291s ago: executing program 4 (id=3945): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) syz_emit_ethernet(0x206, &(0x7f0000000640)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x1d0, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "8bb91d", 0x0, 0x11, 0x0, @local, @empty, [@fragment, @hopopts={0x0, 0x32, '\x00', [@ra, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @generic={0x0, 0x9d, "a17e9ab13f6e142b20582c8d220c698a74dbf13dfc0ad1f526dfc43313759300929090dd4792ce67ea9f8769d3246f94412c56e0247939ed4b318e4b6066b72d91d9aff97fcf30977dfd4028dea535a8e9d1682c4794d255d62089716f2f97577f9bef264da3cfd3e5511fb253122f61808a73cc2e760f93ceb68a0db2613cf0956b23235f057c2f980a19266a6bb4a33a17f550a571c5b4211c6fa371"}, @ra, @generic={0x0, 0x86, "65fd1a52737fa1ec91495f4d25a766a5dd36bcffb376f4b35d4a5bc51b0f8fb9a273282a9c8ef192a4de26c8732765dbeb6ce083e81cebf0612d1cc7956b78fb34ce0e4a867c8b4094bab04b23680ba97ad5c624055e8504a7a121cf38a402a7aa80e05dbe56fecab8b014420231c0e997cbfda9bdc7f29e3a8b13dcfc396cf6ff1fcd8a7f43"}, @calipso={0x7, 0x30, {0x3, 0xa, 0xe, 0x9, [0xf, 0x7, 0x4a, 0x9, 0x1b76]}}, @calipso={0x7, 0x28, {0x0, 0x8, 0x0, 0x0, [0x0, 0x2, 0x0, 0x0]}}]}]}}}}}}}, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x112, 0x4, 0x0, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_VERDICT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x14, 0x3, 0x3, 0x101}, 0x14}, 0x1, 0x0, 0x0, 0x94f7cfd7d57de2ec}, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r4, &(0x7f00000000c0)={0x1d, r5}, 0x10) sendmsg$can_bcm(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r3, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r3, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x110}, 0x2}, 0x0) 1.261357222s ago: executing program 0 (id=3946): r0 = syz_init_net_socket$ax25(0x3, 0x3, 0x8) connect$ax25(r0, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x3}, [@default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default]}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000060a010400000000000000000a0000010900010073797a310000000038000480340001800900010068617368000000002400028008001640000000040800024000000014080007400000000108000440000000000900020073797a32"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) ioctl$SIOCAX25ADDFWD(r0, 0x89ea, &(0x7f0000000200)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) 1.045707563s ago: executing program 0 (id=3947): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x30, 0x1410, 0x8b7fbbc5948fecd9, 0x70bd29, 0x25dfd9fc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) unshare(0x20000400) socketpair(0x6, 0x1, 0x80, &(0x7f0000000000)) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000280)={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=@base={0xa, 0x15, 0x363d, 0x2}, 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r1, &(0x7f0000001940), 0x0}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000200)={&(0x7f0000000040)={0x14, r3, 0x20, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x24048015}, 0x4000010) socket$nl_route(0x10, 0x3, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x564, r5, 0x800, 0x70bd2c, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x500, 0x33, @probe_request={{{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x2}, @device_b, @device_b, @initial, {0x6, 0x1}, @value=@ver_80211n={0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}}, @void, @val={0x1, 0x5, [{0x30}, {0x18, 0x1}, {0x36}, {0x4, 0x1}, {0x16, 0x1}]}, @val={0x3, 0x1, 0x5}, @val={0x2d, 0x1a, {0x40, 0x1, 0x1, 0x0, {0x9, 0x2, 0x0, 0xf, 0x0, 0x0, 0x1, 0x3}, 0x400, 0x4, 0x8}}, @void, [{0xdd, 0x2a, "acfd1904f20e5fea431822fe4dbcc1a9add0a584b14f5873ddeb59252bab8eaab71a12bf9c24dbec6b40"}, {0xdd, 0xd0, "18a6e17e9b298a476d6f508988651a05e2c21923191828e95989d623805dbaf7061e3cff82153cc576617a20b757bd5b4c73b426d68a4e9dc4c8c83897bdf99c249b0121529aae14b3f50f242ef2e30e09b977ee0d4ef84b7942a0fc1a4c5ebf5ac8ffef234f4373c10f446920084db25cab53397b128a3431fed1d1867eb442b6757fbcfca82b7643c88c5eb339c3ca52a29eea1683571b528b50cb5ce05126e23b7483e662742599b67bb83cda03968d36e2b2ca8ac78264784a3ff93a082de5b131a0d00a88e319e7f8fb41164d6a"}, {0xdd, 0x6f, "e4479b624460ba1eb3f1e0840b2a6973d38f20bc87bd957b2b2237a15fa5fbaf770038ec60923e2cb9ee6eee29da9f3cbc47f23cd88b8138ed057c8bf565187bb009a360b8b48c147a4877e90b82051c707e376ced10dea854166b08e1445d760be448d562c38a4c7bc706e4725d57"}, {0xdd, 0xbe, "2e71fb519a6f7a38f8048a53a70ee68f8d0ffa04fda8d9155142d66fb67875d8026ba7acd42e9e3f52e427be3b10d5c08fdf365772b7a9c986d3f2b76b4894c40763eca5fffdfe9757c44f6ac584255a39930d11f535bce8bdf122fb25a355f3fdeae1b81c166643238119818fb97042a8d94617767af591260f1d7e77a430239d8f3435fb99ea4ced40c1a47a80559c18594cb1d8fc95d8620047b3eefb96de97a1ac8babc7ede43cddcc086fa4da692d1c3b3c0ee619d6c7334452b5e7"}, {0xdd, 0x3a, "a933da62d7a6f314ffd73dbed00a927cf02e52a62fa52a7e66e0a15937618de2ff24545736fcf1fae57f53c8b1198a832a7a4cfb21c17614b8c4"}, {0xdd, 0x48, "47b168f924bb366738d5ec318f01080e16a8f3cb95d63e05af1b38101d313426a9101ad47d6a5487303e2f57259888da918d01ebc53082f8affbf949ea45fb3b93ebfc555597d193"}, {0xdd, 0xd6, "e220666b921e1f12a527b46e3795bc91f3e9eb6ce6d7bf084e4702201963aeccccfbdc7313b1a3eb496423591930b3a1e3dce1807fdcc0861c9a565bdf9bfdded96cc8d2b12043aed1c03307cd1f680130f73723367dfdc78f9d153e36afce9c2d53e951d8111a35b3f437dc7623ce3663c0077df28b3dde53b6f1b8c723f3d95ec07a3467b227d08b0dab25a2d0e0fb42e4886e5ea0151a600a154aa270bb78e95d04c53d7ffcef2660df730a27dc750610e8c69c4139470ae710c82644f918745ec052650b7f9dc88b62e7f056a6c4160c2f3dc455"}, {0xdd, 0x68, "56170f2b0a2ca72d7535ade52f4d71d288097ecfd0a8273ad92ab4f958c9faeefca4d9d70e1a04da8e47bc061fdbc05f18e0e44d5a76e5f940776202c74d900ef7c224e9708dc01b4790f9537664cf035244abf92eb5f1a23cb254e8ebb30f93f53951f7598397c9"}, {0xdd, 0x78, "553f6c9fbd730c0e05a922d1d190d710667527a69b77c0310564772d509abcbc4890b691d4a0924bfb1f6dbfbf29788da6cc0f04166b114e42ba464f50e450c1ee353316246a2c6cad584903f7dd381f658b4fb705c1094510efbe21bde65e09c3fab96e6712e212df7bd2bcc09c4b005b1b179e9cb20ba6"}, {0xdd, 0x47, "ba410f7f8ca1056e558247f6f7e1fc0c2c5dc713a7f06e1429d1a3ee3a8ee36ba59b54caff4856d2f9141ffd46b455899388cfcf6d0e72124c9527df3f7ac0cb8da78ea2dbce84"}]}}, @NL80211_ATTR_FRAME={0x45, 0x33, @action_no_ack={{{0x0, 0x0, 0xe, 0x0, 0x0, 0x1}, {0x8}, @device_a, @device_b, @random="e535c8d404a8", {0x1, 0x8}}, @sp_mp_confirm={0xf, 0x2, {0x1000, @default, {0x1, 0x5, [{0xb}, {0x2, 0x1}, {0xc, 0x1}, {0xb, 0x1}, {0x36}]}, @void, @val={0x2d, 0x1a, {0x8000, 0x2, 0x2, 0x0, {0xffff, 0x1e5f, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x800, 0x8, 0x5}}}}}}]}, 0x564}, 0x1, 0x0, 0x0, 0x4000040}, 0x24000080) ioctl$FS_IOC_GETFSSYSFSPATH(r2, 0x80811501, &(0x7f0000000800)={0x80}) 1.017361978s ago: executing program 3 (id=3948): r0 = socket$netlink(0x10, 0x3, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0xc004) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="9c010000", @ANYRES16=0x0, @ANYBLOB="000228bd7000fedbdf250b0000003400018014000200697036746e6c300000000000000000001400020076657468315f766972745f776966690008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="60000180080003000000000008000100", @ANYRES32, @ANYBLOB="0800030003000000140002006970766c616e310000000000000000001400020076657468305f746f5f6272696467650008000100", @ANYRES32, @ANYBLOB="1400020076657468305f746f5f6261746164760054000180140002006261746164763000000000000000000008000100", @ANYRES32, @ANYBLOB="080003000100000008000100", @ANYRES32, @ANYBLOB="0800030003000000080003000300000014000200697036677265746170300000000000001c0001800800030000000000080003000300000008000100", @ANYRES32, @ANYBLOB="78000180140002006361696630000000000000000000000008000300040000001400020070696d367265670000000000000000001400020076657468305f746f5f6261746164760014000200626f6e64300000000000000000000000140002006d6163766c616e30000000000000000008000100", @ANYBLOB], 0x19c}, 0x1, 0x0, 0x0, 0x24000800}, 0x4045000) 903.821619ms ago: executing program 4 (id=3949): unshare(0x66020080) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x49}, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x14042180}, 0xc, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELFLOWTABLE={0x128, 0x18, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0xa}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK={0xd8, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8001}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8062}, @NFTA_FLOWTABLE_HOOK_DEVS={0x7c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'nicvf0\x00'}, {0x14, 0x1, 'veth0_to_bridge\x00'}, {0x14, 0x1, 'netdevsim0\x00'}, {0x14, 0x1, 'syzkaller1\x00'}, {0x14, 0x1, 'veth0\x00'}, {0x14, 0x1, 'pimreg\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6gretap0\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_DELOBJ={0x20c, 0x14, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x5}, [@NFTA_OBJ_USERDATA={0x22, 0x8, "cd2652d806a122ac5868efbf7b1daafa2d62023a337aff87c9154654f7b4"}, @NFTA_OBJ_USERDATA={0x95, 0x8, "19bf299fef850bbc24131b91ad406b338d77e82817b0a8813b053eab2b7bd867d84a93b6be75cf108388401ad215de912b5966de596cac201d45dd5cb7a7967450aa45ba76cb97ca057b188bc95da30e47388080ee4c6fa72713243bbdf85227bad3ed54d00373bd429cd6b0705b2d256b311fab8fe18ecf6c8ac270735d9c46bcb9921033aa4adf88a1eaf6c6e8201cea"}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_USERDATA={0x57, 0x8, "5780e84ea0e31f23155d8e990cad0ef903407bcbe5dea97f409928e28cd8999673b6997ef98aa8ea746912962e2123904013f3b0ee355a5704dd403d6d7bd6384043f196503e8ff38f5a7d8beba2c5a88233ba"}, @NFTA_OBJ_USERDATA={0xce, 0x8, "22fbb51c336f6ff8651afbfb6abe4700c080563d5dd9ee72603a1c04de6cbca6e35f391dcdbf33a998bfdf198236191f84d2185d0864d001449279d3a070b4d8b03fcbc75547043fc71fece63cd3fc6d6c7ce562c8a6ad1a33fc749fcb2b7a16473de49968e40fa2fae58d453ece49ae0ada6c761372a8dfd2eb720e29dfea78b3fe4867abe17b667b049e7136afc692ba19fe9ac07d6159433b42e5c40b498a6ba8f7ef632ca480832b2d79555a13596a836f3ae68bd62962d5fa29aa97ecd2da5efbfe8c288d91c149"}, @NFTA_OBJ_TYPE={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x35c}, 0x1, 0x0, 0x0, 0x200080c0}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, 0x0, 0x0) 903.090989ms ago: executing program 0 (id=3950): socket$key(0xf, 0x3, 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x60040, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) getsockname$packet(r1, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000300)=""/219, &(0x7f0000000140)=0xdb) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400000006000000005dcc0300", @ANYRES32=r2, @ANYBLOB="71e79fd800000000140012800c0001006d616376746170001400028008000500", @ANYRES32=r3], 0x3c}}, 0x0) 846.909452ms ago: executing program 3 (id=3951): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="05000000010000", 0x7) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4082, 0xff2}], 0x1}, 0xfffffffc}], 0x1, 0x12, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x61, 0x10, 0x28}, [@ldst={0x4, 0x2, 0x6, 0x0, 0x0, 0x0, 0x10}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000940)=ANY=[@ANYBLOB="3400000040000701feffffff00000000017c0000040042800c00018006000600800a0000100002800900148004"], 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000180)={0x80000020}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=@mpls_getroute={0xa0, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14}, [@RTA_NEWDST={0x84}]}, 0xa0}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, &(0x7f0000000000)=0x10) 696.007563ms ago: executing program 3 (id=3952): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum64={0x3, 0x0, 0x0, 0x13, 0x0, 0x6}]}, {0x0, [0x2e, 0x5f]}}, 0x0, 0x28, 0x0, 0x1}, 0x1f) 677.532554ms ago: executing program 3 (id=3953): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x29, 0x5, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0xffffff6a) sendfile(r1, r2, 0x0, 0xffffffff000) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x4, 0x4, 0x22, 0x0, 0xffffffffffffffff, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000008c0)={'filter\x00', 0x11c, 0x4, 0x3e8, 0x0, 0x110, 0x0, 0x300, 0x300, 0x300, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private=0xa010100, @broadcast, 0x4}}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x5, 'syz1\x00', {0x2}}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x101, 0xfffa}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x438) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000840)={r3, &(0x7f0000000240), &(0x7f0000000080)=@tcp}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)={{0x14, 0x15c}, [@NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x9}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}}, 0x0) 220.665887ms ago: executing program 3 (id=3954): r0 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="d5"], 0x24}}, 0x0) recvmmsg$unix(r0, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000016c0)=""/172, 0xac}, {&(0x7f0000000480)=""/4088, 0xff8}, {&(0x7f0000001480)=""/83, 0x53}, {&(0x7f0000001580)=""/60, 0x3c}, {&(0x7f0000001980)=""/236, 0xec}, {&(0x7f00000018c0)=""/182, 0xb6}], 0x6}}], 0x1, 0x40010122, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000d80)={0x14, 0x4, 0xa, 0x5, 0x0, 0x0, {0x7, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x804) write(r0, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) unshare(0x22020600) r3 = socket(0x2b, 0x80801, 0x1) bind$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x3, {{0x2, 0x2}, 0x3}}, 0x10) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, 0x0, 0xc001) r4 = socket$kcm(0xa, 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000380)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f00000015c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2fddf54c0d86da9c}, 0xc, &(0x7f0000000440)={&(0x7f0000001600)={0x54, 0x0, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r6}]}, 0x54}}, 0x21) r7 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000240)={0x84, @rand_addr=0x64010102, 0x4e20, 0x3, 'lblc\x00', 0x1, 0xa7e, 0x70}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4f21, 0x3, 'lc\x00', 0x5, 0x8, 0x6c}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x10000, 0xcd, 0x1}}, 0x44) sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x4040084) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@TCA_RATE={0x6, 0x5, {0x79, 0x4}}]}, 0x2c}}, 0x20004015) syz_open_procfs$namespace(0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) 0s ago: executing program 1 (id=3955): socket(0x10, 0x803, 0x0) socket(0x22, 0x2, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000820000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) kernel console output (not intermixed with test programs): 484.888540][T16447] ? down_write_killable+0x180/0x240 [ 484.888561][T16447] ? ksys_write+0x1e6/0x270 [ 484.888580][T16447] ? __pfx_down_write_killable+0x10/0x10 [ 484.888600][T16447] ? apparmor_mmap_file+0x23e/0x2b0 [ 484.888635][T16447] vm_mmap_pgoff+0x2c9/0x4f0 [ 484.888667][T16447] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 484.888693][T16447] ? __fget_files+0x2a/0x420 [ 484.888722][T16447] ? __fget_files+0x3a0/0x420 [ 484.888747][T16447] ? __fget_files+0x2a/0x420 [ 484.888777][T16447] ksys_mmap_pgoff+0x51e/0x760 [ 484.888809][T16447] do_syscall_64+0x14d/0xf80 [ 484.888835][T16447] ? trace_irq_disable+0x3b/0x150 [ 484.888859][T16447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.888878][T16447] ? clear_bhb_loop+0x40/0x90 [ 484.888902][T16447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.888921][T16447] RIP: 0033:0x7fc9b939c629 [ 484.888941][T16447] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.888958][T16447] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 484.888981][T16447] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 484.888995][T16447] RDX: 000000000300000b RSI: 0000000000002000 RDI: 0000200000001000 [ 484.889007][T16447] RBP: 00007fc9ba229090 R08: 0000000000000005 R09: 00000000a6d63000 [ 484.889019][T16447] R10: 0000000000000012 R11: 0000000000000246 R12: 0000000000000001 [ 484.889031][T16447] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 484.889062][T16447] [ 485.409252][T16461] netlink: 'syz.1.3063': attribute type 1 has an invalid length. [ 485.493075][T16465] netlink: 'syz.2.3061': attribute type 4 has an invalid length. [ 485.610890][T16461] 8021q: adding VLAN 0 to HW filter on device bond13 [ 486.216433][T16492] vlan3: entered promiscuous mode [ 486.281361][T16494] syzkaller0: entered promiscuous mode [ 486.289724][T16494] syzkaller0: entered allmulticast mode [ 486.302597][T16496] FAULT_INJECTION: forcing a failure. [ 486.302597][T16496] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 486.316389][T16496] CPU: 1 UID: 0 PID: 16496 Comm: syz.3.3076 Not tainted syzkaller #0 PREEMPT(full) [ 486.316418][T16496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 486.316431][T16496] Call Trace: [ 486.316439][T16496] [ 486.316448][T16496] dump_stack_lvl+0xe8/0x150 [ 486.316482][T16496] should_fail_ex+0x412/0x560 [ 486.316512][T16496] prepare_alloc_pages+0x22a/0x650 [ 486.316545][T16496] __alloc_frozen_pages_noprof+0x12f/0x380 [ 486.316573][T16496] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 486.316601][T16496] ? __pfx_policy_nodemask+0x10/0x10 [ 486.316636][T16496] alloc_pages_mpol+0x232/0x4a0 [ 486.316667][T16496] folio_alloc_mpol_noprof+0x39/0x70 [ 486.316694][T16496] shmem_alloc_and_add_folio+0x445/0xf80 [ 486.316732][T16496] ? filemap_get_entry+0xca/0x320 [ 486.316751][T16496] ? filemap_get_entry+0xca/0x320 [ 486.316772][T16496] ? filemap_get_entry+0x2ac/0x320 [ 486.316792][T16496] ? __pfx_filemap_get_entry+0x10/0x10 [ 486.316814][T16496] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 486.316849][T16496] ? shmem_allowable_huge_orders+0x5ec/0x690 [ 486.316886][T16496] shmem_get_folio_gfp+0x5a9/0x1670 [ 486.316936][T16496] shmem_fault+0x179/0x390 [ 486.316966][T16496] __do_fault+0x138/0x390 [ 486.316992][T16496] do_pte_missing+0x228f/0x3750 [ 486.317012][T16496] ? do_pte_missing+0x130a/0x3750 [ 486.317043][T16496] ? handle_mm_fault+0xee/0x3310 [ 486.317074][T16496] handle_mm_fault+0x1bec/0x3310 [ 486.317116][T16496] ? handle_mm_fault+0xee/0x3310 [ 486.317153][T16496] ? __pfx_handle_mm_fault+0x10/0x10 [ 486.317205][T16496] ? lock_mm_and_find_vma+0xa7/0x340 [ 486.317229][T16496] do_user_addr_fault+0x75b/0x1340 [ 486.317274][T16496] exc_page_fault+0x6a/0xc0 [ 486.317303][T16496] asm_exc_page_fault+0x26/0x30 [ 486.317321][T16496] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 486.317345][T16496] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 486.317370][T16496] RSP: 0018:ffffc9000f59f5f8 EFLAGS: 00050206 [ 486.317388][T16496] RAX: 00007ffffffff001 RBX: ffff88804b558000 RCX: 0000000000000140 [ 486.317402][T16496] RDX: 0000000000000001 RSI: 0000200000002000 RDI: ffff88804b558ec0 [ 486.317417][T16496] RBP: ffffc9000f59f760 R08: ffff88804b558fff R09: 1ffff110096ab1ff [ 486.317430][T16496] R10: dffffc0000000000 R11: ffffed10096ab200 R12: ffffc9000f59fdf8 [ 486.317444][T16496] R13: 0000200000001140 R14: 0000000000001000 R15: 1ffff92001eb3fbf [ 486.317478][T16496] _copy_from_iter+0x21b/0x1670 [ 486.317516][T16496] ? __pfx__copy_from_iter+0x10/0x10 [ 486.317537][T16496] ? sock_alloc_send_pskb+0x896/0x990 [ 486.317574][T16496] ? __pfx__copy_from_iter+0x10/0x10 [ 486.317601][T16496] ? page_copy_sane+0x16a/0x270 [ 486.317627][T16496] copy_page_from_iter+0xdd/0x170 [ 486.317657][T16496] skb_copy_datagram_from_iter+0x306/0x710 [ 486.317700][T16496] unix_stream_sendmsg+0x5f3/0xe80 [ 486.317745][T16496] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 486.317775][T16496] ? aa_sock_msg_perm+0xda/0x1b0 [ 486.317801][T16496] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 486.317824][T16496] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 486.317845][T16496] ____sys_sendmsg+0xa68/0xad0 [ 486.317884][T16496] ? __pfx_____sys_sendmsg+0x10/0x10 [ 486.317923][T16496] ? import_iovec+0x73/0xa0 [ 486.317954][T16496] ___sys_sendmsg+0x2a5/0x360 [ 486.317989][T16496] ? __pfx____sys_sendmsg+0x10/0x10 [ 486.318058][T16496] ? __fget_files+0x2a/0x420 [ 486.318085][T16496] ? __fget_files+0x3a0/0x420 [ 486.318124][T16496] __x64_sys_sendmsg+0x1bd/0x2a0 [ 486.318154][T16496] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 486.318192][T16496] ? __pfx_ksys_write+0x10/0x10 [ 486.318226][T16496] do_syscall_64+0x14d/0xf80 [ 486.318255][T16496] ? trace_irq_disable+0x3b/0x150 [ 486.318282][T16496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.318302][T16496] ? clear_bhb_loop+0x40/0x90 [ 486.318327][T16496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 486.318347][T16496] RIP: 0033:0x7fc9b939c629 [ 486.318374][T16496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 486.318390][T16496] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 486.318410][T16496] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 486.318424][T16496] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 000000000000000a [ 486.318436][T16496] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 486.318449][T16496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 486.318461][T16496] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 486.318495][T16496] [ 487.010536][T16502] netlink: 'syz.0.3077': attribute type 1 has an invalid length. [ 487.108686][T16502] 8021q: adding VLAN 0 to HW filter on device bond18 [ 487.374705][T16516] __nla_validate_parse: 10 callbacks suppressed [ 487.374730][T16516] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3083'. [ 487.447006][T16518] siw: device registration error -23 [ 487.590482][T16515] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3083'. [ 487.747463][T16529] pimreg: entered allmulticast mode [ 487.754522][T16529] pimreg: left allmulticast mode [ 487.798410][T16524] debugfs: 'netdev:nicvf0' already exists in 'phy5' [ 487.902237][T16535] syzkaller0: entered promiscuous mode [ 487.936733][T16535] syzkaller0: entered allmulticast mode [ 488.093748][T16542] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3091'. [ 488.209154][T16549] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3095'. [ 488.243153][T16541] debugfs: 'netdev:nicvf0' already exists in 'phy7' [ 488.706345][T16558] veth0_virt_wifi: entered promiscuous mode [ 488.741406][T16558] veth0_virt_wifi: left promiscuous mode [ 488.952078][T16572] netlink: 'syz.4.3100': attribute type 1 has an invalid length. [ 489.273057][T16563] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3101'. [ 489.284056][T16564] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3101'. [ 489.293183][T16564] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3101'. [ 489.366794][T16572] 8021q: adding VLAN 0 to HW filter on device bond26 [ 489.605412][T16585] siw: device registration error -23 [ 489.891975][T16604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3112'. [ 489.967511][T16604] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3112'. [ 490.029782][T16604] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 490.393969][T16625] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3116'. [ 490.429811][T16627] netlink: 'syz.4.3117': attribute type 4 has an invalid length. [ 491.169068][T16651] bridge0: Device is already in use. [ 491.573469][T16668] siw: device registration error -23 [ 492.448167][T16695] __nla_validate_parse: 11 callbacks suppressed [ 492.448191][T16695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3136'. [ 492.508103][T16695] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3136'. [ 492.545244][T16695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3136'. [ 493.197761][T16716] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3140'. [ 493.247057][T16716] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3140'. [ 493.282660][T16716] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3140'. [ 494.585769][T16752] netlink: 'syz.2.3150': attribute type 13 has an invalid length. [ 494.635652][T16755] netlink: 'syz.0.3151': attribute type 1 has an invalid length. [ 494.827310][T16755] 8021q: adding VLAN 0 to HW filter on device bond19 [ 494.865551][T16760] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3152'. [ 494.906180][T16757] 8021q: adding VLAN 0 to HW filter on device batadv8 [ 494.996926][T16757] bond19: (slave batadv8): making interface the new active one [ 495.036813][T16757] bond19: (slave batadv8): Enslaving as an active interface with an up link [ 495.683269][T16782] openvswitch: netlink: IPv4 tun info is not correct [ 496.490892][T16788] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3159'. [ 496.973502][T16800] netlink: 'syz.2.3164': attribute type 2 has an invalid length. [ 497.727061][T16820] x_tables: ip_tables: ah match: only valid for protocol 51 [ 497.741070][T16820] pimreg3: entered allmulticast mode [ 497.881436][T16824] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3173'. [ 497.890689][T16824] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3173'. [ 498.031782][T16827] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3174'. [ 498.410246][T16832] syzkaller0: entered promiscuous mode [ 498.416660][T16832] syzkaller0: entered allmulticast mode [ 498.424789][T16832] FAULT_INJECTION: forcing a failure. [ 498.424789][T16832] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 498.438333][T16832] CPU: 1 UID: 0 PID: 16832 Comm: syz.4.3176 Not tainted syzkaller #0 PREEMPT(full) [ 498.438361][T16832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 498.438374][T16832] Call Trace: [ 498.438382][T16832] [ 498.438390][T16832] dump_stack_lvl+0xe8/0x150 [ 498.438433][T16832] should_fail_ex+0x412/0x560 [ 498.438462][T16832] _copy_to_user+0x31/0xb0 [ 498.438492][T16832] simple_read_from_buffer+0xe1/0x170 [ 498.438525][T16832] proc_fail_nth_read+0x1bb/0x230 [ 498.438554][T16832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 498.438585][T16832] ? rw_verify_area+0x2a6/0x4d0 [ 498.438605][T16832] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 498.438633][T16832] vfs_read+0x20c/0xa70 [ 498.438650][T16832] ? fdget_pos+0x246/0x320 [ 498.438683][T16832] ? __pfx___mutex_lock+0x10/0x10 [ 498.438713][T16832] ? __pfx_vfs_read+0x10/0x10 [ 498.438735][T16832] ? __fget_files+0x2a/0x420 [ 498.438767][T16832] ? __fget_files+0x3a0/0x420 [ 498.438793][T16832] ? __fget_files+0x2a/0x420 [ 498.438829][T16832] ksys_read+0x150/0x270 [ 498.438852][T16832] ? __pfx_ksys_read+0x10/0x10 [ 498.438886][T16832] do_syscall_64+0x14d/0xf80 [ 498.438915][T16832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.438936][T16832] ? clear_bhb_loop+0x40/0x90 [ 498.438961][T16832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 498.438980][T16832] RIP: 0033:0x7f73e795cece [ 498.439000][T16832] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 498.439017][T16832] RSP: 002b:00007f73e8915fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 498.439040][T16832] RAX: ffffffffffffffda RBX: 00007f73e89166c0 RCX: 00007f73e795cece [ 498.439054][T16832] RDX: 000000000000000f RSI: 00007f73e89160a0 RDI: 0000000000000009 [ 498.439067][T16832] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 498.439079][T16832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 498.439091][T16832] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 498.439124][T16832] [ 498.648681][T16773] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 499.003470][T16843] netlink: 'syz.1.3180': attribute type 1 has an invalid length. [ 499.088335][T16846] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3181'. [ 499.686826][T16843] 8021q: adding VLAN 0 to HW filter on device bond14 [ 499.697121][T16855] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3182'. [ 499.814908][T16858] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3183'. [ 499.840648][T16860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3184'. [ 499.856780][T16860] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3184'. [ 499.881189][T16862] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3185'. [ 500.068937][T16869] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3188'. [ 501.728233][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 501.737693][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.745918][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.025016][T16869] bridge0: port 3(batadv4) entered blocking state [ 502.031785][T16869] bridge0: port 3(batadv4) entered disabled state [ 502.039031][T16869] batadv4: entered allmulticast mode [ 502.045873][T16869] batadv4: entered promiscuous mode [ 502.400550][T16884] debugfs: 'netdev:nicvf0' already exists in 'phy6' [ 502.524881][ T85] batman_adv: batadv4: No IGMP Querier present - multicast optimizations disabled [ 502.537292][ T85] batman_adv: batadv4: No MLD Querier present - multicast optimizations disabled [ 502.775904][T16895] netlink: 'syz.0.3197': attribute type 5 has an invalid length. [ 502.798408][T16898] openvswitch: netlink: IPv4 tun info is not correct [ 502.820556][T16900] FAULT_INJECTION: forcing a failure. [ 502.820556][T16900] name failslab, interval 1, probability 0, space 0, times 0 [ 502.836298][T16900] CPU: 0 UID: 0 PID: 16900 Comm: syz.3.3198 Not tainted syzkaller #0 PREEMPT(full) [ 502.836327][T16900] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 502.836340][T16900] Call Trace: [ 502.836349][T16900] [ 502.836358][T16900] dump_stack_lvl+0xe8/0x150 [ 502.836391][T16900] should_fail_ex+0x412/0x560 [ 502.836418][T16900] should_failslab+0xa8/0x100 [ 502.836442][T16900] ? skb_clone+0x212/0x3a0 [ 502.836469][T16900] kmem_cache_alloc_noprof+0x87/0x650 [ 502.836499][T16900] ? __netlink_lookup+0xc6/0x8b0 [ 502.836532][T16900] skb_clone+0x212/0x3a0 [ 502.836565][T16900] __netlink_deliver_tap+0x404/0x850 [ 502.836603][T16900] ? netlink_deliver_tap+0x2e/0x1b0 [ 502.836628][T16900] netlink_deliver_tap+0x19c/0x1b0 [ 502.836653][T16900] netlink_unicast+0x7e3/0x9b0 [ 502.836684][T16900] ? __pfx_netlink_unicast+0x10/0x10 [ 502.836708][T16900] ? netlink_sendmsg+0x650/0xb40 [ 502.836728][T16900] ? skb_put+0x11b/0x210 [ 502.836758][T16900] netlink_sendmsg+0x813/0xb40 [ 502.836793][T16900] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.836821][T16900] ? aa_sock_msg_perm+0xf1/0x1b0 [ 502.836847][T16900] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 502.836871][T16900] ? __pfx_netlink_sendmsg+0x10/0x10 [ 502.836894][T16900] ____sys_sendmsg+0xa68/0xad0 [ 502.836933][T16900] ? __pfx_____sys_sendmsg+0x10/0x10 [ 502.836972][T16900] ? import_iovec+0x73/0xa0 [ 502.837004][T16900] ___sys_sendmsg+0x2a5/0x360 [ 502.837039][T16900] ? __pfx____sys_sendmsg+0x10/0x10 [ 502.837109][T16900] ? __fget_files+0x2a/0x420 [ 502.837137][T16900] ? __fget_files+0x3a0/0x420 [ 502.837184][T16900] __x64_sys_sendmsg+0x1bd/0x2a0 [ 502.837216][T16900] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 502.837255][T16900] ? __pfx_ksys_write+0x10/0x10 [ 502.837289][T16900] do_syscall_64+0x14d/0xf80 [ 502.837321][T16900] ? trace_irq_disable+0x3b/0x150 [ 502.837346][T16900] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.837366][T16900] ? clear_bhb_loop+0x40/0x90 [ 502.837391][T16900] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.837411][T16900] RIP: 0033:0x7fc9b939c629 [ 502.837430][T16900] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.837448][T16900] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 502.837470][T16900] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 502.837485][T16900] RDX: 000000000000c000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 502.837498][T16900] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 502.837511][T16900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.837522][T16900] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 502.837557][T16900] [ 503.318141][T16908] __nla_validate_parse: 2 callbacks suppressed [ 503.318163][T16908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3203'. [ 503.464060][T16916] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3204'. [ 503.609529][T16905] debugfs: 'netdev:nicvf0' already exists in 'phy11' [ 503.806702][T16926] netlink: 'syz.0.3207': attribute type 10 has an invalid length. [ 503.864583][T16926] team0: Failed to send options change via netlink (err -105) [ 503.872378][T16926] team0: Port device dummy0 added [ 503.874081][T16929] netlink: 'syz.0.3207': attribute type 10 has an invalid length. [ 503.954768][T16929] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 503.968943][T16930] delete_channel: no stack [ 504.094223][T16929] team0: Failed to send options change via netlink (err -105) [ 504.102324][T16929] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 504.125281][T16929] team0: Port device dummy0 removed [ 504.150877][T16926] team_slave_0: entered promiscuous mode [ 504.157015][T16926] team_slave_1: entered promiscuous mode [ 504.179581][T16926] vlan3: entered promiscuous mode [ 504.184902][T16926] team0: entered promiscuous mode [ 506.733708][ T5189] udevd[5189]: worker [6634] /devices/virtual/block/nbd0 timeout; kill it [ 506.745251][ T5189] udevd[5189]: seq 14976 '/devices/virtual/block/nbd0' killed [ 506.846624][T16952] netlink: 'syz.2.3213': attribute type 4 has an invalid length. [ 507.050604][T16958] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 507.474204][T16972] syzkaller0: entered promiscuous mode [ 507.501006][T16972] syzkaller0: entered allmulticast mode [ 507.585322][T16972] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3221'. [ 507.849846][T16978] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3223'. [ 507.869187][T16978] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3223'. [ 507.904520][T16980] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3224'. [ 511.039639][T17017] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 511.081411][T17021] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3235'. [ 511.096711][T17021] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3235'. [ 511.663294][T17037] FAULT_INJECTION: forcing a failure. [ 511.663294][T17037] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 511.717777][T17037] CPU: 1 UID: 0 PID: 17037 Comm: syz.4.3240 Not tainted syzkaller #0 PREEMPT(full) [ 511.717805][T17037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.717817][T17037] Call Trace: [ 511.717825][T17037] [ 511.717834][T17037] dump_stack_lvl+0xe8/0x150 [ 511.717866][T17037] should_fail_ex+0x412/0x560 [ 511.717894][T17037] _copy_to_user+0x31/0xb0 [ 511.717922][T17037] simple_read_from_buffer+0xe1/0x170 [ 511.717951][T17037] proc_fail_nth_read+0x1bb/0x230 [ 511.717980][T17037] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 511.718006][T17037] ? rw_verify_area+0x2a6/0x4d0 [ 511.718024][T17037] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 511.718050][T17037] vfs_read+0x20c/0xa70 [ 511.718066][T17037] ? fdget_pos+0x246/0x320 [ 511.718096][T17037] ? __pfx___mutex_lock+0x10/0x10 [ 511.718124][T17037] ? __pfx_vfs_read+0x10/0x10 [ 511.718144][T17037] ? __fget_files+0x2a/0x420 [ 511.718173][T17037] ? __fget_files+0x3a0/0x420 [ 511.718195][T17037] ? __fget_files+0x2a/0x420 [ 511.718228][T17037] ksys_read+0x150/0x270 [ 511.718258][T17037] ? __pfx_ksys_read+0x10/0x10 [ 511.718289][T17037] do_syscall_64+0x14d/0xf80 [ 511.718314][T17037] ? trace_irq_disable+0x3b/0x150 [ 511.718338][T17037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.718358][T17037] ? clear_bhb_loop+0x40/0x90 [ 511.718382][T17037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.718401][T17037] RIP: 0033:0x7f73e795cece [ 511.718419][T17037] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 511.718435][T17037] RSP: 002b:00007f73e8915fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 511.718457][T17037] RAX: ffffffffffffffda RBX: 00007f73e89166c0 RCX: 00007f73e795cece [ 511.718472][T17037] RDX: 000000000000000f RSI: 00007f73e89160a0 RDI: 0000000000000003 [ 511.718484][T17037] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 511.718496][T17037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.718508][T17037] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 511.718540][T17037] [ 511.954138][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 512.645883][T17064] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3249'. [ 512.670585][T17062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3247'. [ 513.307690][T17079] netlink: 'syz.3.3254': attribute type 10 has an invalid length. [ 513.348313][T17079] team0: Failed to send options change via netlink (err -105) [ 513.369078][T17079] team0: Port device dummy0 added [ 513.382364][T17082] netlink: 'syz.3.3254': attribute type 10 has an invalid length. [ 513.408686][T17082] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 513.479775][T17082] team0: Failed to send options change via netlink (err -105) [ 513.494369][T17082] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 513.518012][T17082] team0: Port device dummy0 removed [ 513.530558][T17082] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 513.869338][T17091] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3260'. [ 513.965118][T17094] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3261'. [ 514.393922][T17115] netlink: 'syz.0.3270': attribute type 10 has an invalid length. [ 514.401787][T17115] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3270'. [ 515.138289][T17134] netlink: 'syz.2.3273': attribute type 13 has an invalid length. [ 517.104962][T17115] smc: removing net device wlan0 with user defined pnetid SYZ0 [ 517.214988][T17117] syzkaller1: entered promiscuous mode [ 517.233296][T17117] syzkaller1: entered allmulticast mode [ 517.460165][T17154] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3275'. [ 518.037828][T17176] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3282'. [ 518.281899][T17188] syzkaller1: entered promiscuous mode [ 518.302604][T17188] syzkaller1: entered allmulticast mode [ 518.405087][T17161] FAULT_INJECTION: forcing a failure. [ 518.405087][T17161] name failslab, interval 1, probability 0, space 0, times 0 [ 518.444655][T17161] CPU: 1 UID: 0 PID: 17161 Comm: syz.2.3278 Not tainted syzkaller #0 PREEMPT(full) [ 518.444685][T17161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 518.444698][T17161] Call Trace: [ 518.444706][T17161] [ 518.444715][T17161] dump_stack_lvl+0xe8/0x150 [ 518.444750][T17161] should_fail_ex+0x412/0x560 [ 518.444780][T17161] should_failslab+0xa8/0x100 [ 518.444806][T17161] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 518.444838][T17161] ? __alloc_skb+0x186/0x7d0 [ 518.444862][T17161] ? __alloc_skb+0x1d0/0x7d0 [ 518.444883][T17161] ? __local_bh_enable_ip+0xd0/0x130 [ 518.444915][T17161] __alloc_skb+0x1d0/0x7d0 [ 518.444945][T17161] netlink_sendmsg+0x5d4/0xb40 [ 518.444981][T17161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.445009][T17161] ? aa_sock_msg_perm+0xf1/0x1b0 [ 518.445034][T17161] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 518.445058][T17161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 518.445080][T17161] ____sys_sendmsg+0xa68/0xad0 [ 518.445128][T17161] ? __pfx_____sys_sendmsg+0x10/0x10 [ 518.445166][T17161] ? import_iovec+0x73/0xa0 [ 518.445197][T17161] ___sys_sendmsg+0x2a5/0x360 [ 518.445232][T17161] ? __pfx____sys_sendmsg+0x10/0x10 [ 518.445300][T17161] ? __fget_files+0x2a/0x420 [ 518.445326][T17161] ? __fget_files+0x3a0/0x420 [ 518.445365][T17161] __x64_sys_sendmsg+0x1bd/0x2a0 [ 518.445396][T17161] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 518.445435][T17161] ? __pfx_ksys_write+0x10/0x10 [ 518.445469][T17161] do_syscall_64+0x14d/0xf80 [ 518.445497][T17161] ? trace_irq_disable+0x3b/0x150 [ 518.445524][T17161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.445546][T17161] ? clear_bhb_loop+0x40/0x90 [ 518.445571][T17161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 518.445591][T17161] RIP: 0033:0x7f224e79c629 [ 518.445611][T17161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 518.445633][T17161] RSP: 002b:00007f224f5d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 518.445654][T17161] RAX: ffffffffffffffda RBX: 00007f224ea15fa0 RCX: 00007f224e79c629 [ 518.445669][T17161] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000009 [ 518.445682][T17161] RBP: 00007f224f5d2090 R08: 0000000000000000 R09: 0000000000000000 [ 518.445695][T17161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 518.445707][T17161] R13: 00007f224ea16038 R14: 00007f224ea15fa0 R15: 00007ffe75afd758 [ 518.445741][T17161] [ 518.954457][T17200] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3290'. [ 518.984090][T17200] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3290'. [ 519.279287][T17213] bridge0: entered allmulticast mode [ 519.515994][T17221] siw: device registration error -23 [ 519.553212][T17215] debugfs: 'netdev:nicvf0' already exists in 'phy5' [ 519.676048][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3301'. [ 519.700939][T17225] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3301'. [ 519.737662][T17228] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3302'. [ 519.742695][T17225] syz1: rxe_newlink: already configured on ipvlan0 [ 519.750367][T17228] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3302'. [ 519.960826][T17237] netlink: 'syz.4.3308': attribute type 13 has an invalid length. [ 519.973154][T17239] bridge_slave_1: left allmulticast mode [ 519.980278][T17239] bridge_slave_1: left promiscuous mode [ 519.992785][T17241] FAULT_INJECTION: forcing a failure. [ 519.992785][T17241] name failslab, interval 1, probability 0, space 0, times 0 [ 520.007638][T17239] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.050938][T17241] CPU: 0 UID: 0 PID: 17241 Comm: syz.2.3309 Not tainted syzkaller #0 PREEMPT(full) [ 520.050970][T17241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 520.050983][T17241] Call Trace: [ 520.050991][T17241] [ 520.051001][T17241] dump_stack_lvl+0xe8/0x150 [ 520.051036][T17241] should_fail_ex+0x412/0x560 [ 520.051065][T17241] should_failslab+0xa8/0x100 [ 520.051091][T17241] __kmalloc_noprof+0xe8/0x760 [ 520.051112][T17241] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 520.051145][T17241] tomoyo_realpath_from_path+0xe3/0x5d0 [ 520.051181][T17241] ? tomoyo_path_number_perm+0x219/0x630 [ 520.051202][T17241] tomoyo_path_number_perm+0x246/0x630 [ 520.051227][T17241] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 520.051252][T17241] ? __lock_acquire+0x6b5/0x2cf0 [ 520.051289][T17241] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 520.051342][T17241] ? __fget_files+0x2a/0x420 [ 520.051373][T17241] ? __fget_files+0x2a/0x420 [ 520.051398][T17241] ? __fget_files+0x3a0/0x420 [ 520.051424][T17241] ? __fget_files+0x2a/0x420 [ 520.051455][T17241] security_file_ioctl+0xc3/0x2a0 [ 520.051487][T17241] __se_sys_ioctl+0x47/0x170 [ 520.051513][T17241] do_syscall_64+0x14d/0xf80 [ 520.051541][T17241] ? trace_irq_disable+0x3b/0x150 [ 520.051567][T17241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.051588][T17241] ? clear_bhb_loop+0x40/0x90 [ 520.051612][T17241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.051633][T17241] RIP: 0033:0x7f224e79c629 [ 520.051652][T17241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.051669][T17241] RSP: 002b:00007f224f5d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 520.051691][T17241] RAX: ffffffffffffffda RBX: 00007f224ea15fa0 RCX: 00007f224e79c629 [ 520.051706][T17241] RDX: 0000200000000200 RSI: 00000000800452d3 RDI: 0000000000000004 [ 520.051719][T17241] RBP: 00007f224f5d2090 R08: 0000000000000000 R09: 0000000000000000 [ 520.051732][T17241] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.051744][T17241] R13: 00007f224ea16038 R14: 00007f224ea15fa0 R15: 00007ffe75afd758 [ 520.051777][T17241] [ 520.051786][T17241] ERROR: Out of memory at tomoyo_realpath_from_path. [ 520.126987][T17239] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.549888][T17263] FAULT_INJECTION: forcing a failure. [ 520.549888][T17263] name failslab, interval 1, probability 0, space 0, times 0 [ 520.606336][T17263] CPU: 1 UID: 0 PID: 17263 Comm: syz.4.3316 Not tainted syzkaller #0 PREEMPT(full) [ 520.606365][T17263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 520.606377][T17263] Call Trace: [ 520.606385][T17263] [ 520.606394][T17263] dump_stack_lvl+0xe8/0x150 [ 520.606428][T17263] should_fail_ex+0x412/0x560 [ 520.606457][T17263] should_failslab+0xa8/0x100 [ 520.606482][T17263] __kmalloc_noprof+0xe8/0x760 [ 520.606503][T17263] ? bpf_test_init+0x9f/0x150 [ 520.606524][T17263] ? kstrtouint+0x6e/0xe0 [ 520.606549][T17263] bpf_test_init+0x9f/0x150 [ 520.606576][T17263] bpf_prog_test_run_xdp+0x529/0x1160 [ 520.606616][T17263] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 520.606645][T17263] ? __fget_files+0x2a/0x420 [ 520.606679][T17263] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 520.606702][T17263] bpf_prog_test_run+0x2c7/0x340 [ 520.606727][T17263] __sys_bpf+0x643/0x950 [ 520.606758][T17263] ? __pfx___sys_bpf+0x10/0x10 [ 520.606802][T17263] ? ksys_write+0x242/0x270 [ 520.606825][T17263] ? __pfx_ksys_write+0x10/0x10 [ 520.606853][T17263] __x64_sys_bpf+0x7c/0x90 [ 520.606880][T17263] do_syscall_64+0x14d/0xf80 [ 520.606908][T17263] ? trace_irq_disable+0x3b/0x150 [ 520.606934][T17263] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.606955][T17263] ? clear_bhb_loop+0x40/0x90 [ 520.606980][T17263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 520.606999][T17263] RIP: 0033:0x7f73e799c629 [ 520.607018][T17263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 520.607035][T17263] RSP: 002b:00007f73e8916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 520.607057][T17263] RAX: ffffffffffffffda RBX: 00007f73e7c15fa0 RCX: 00007f73e799c629 [ 520.607072][T17263] RDX: 0000000000000050 RSI: 0000200000000640 RDI: 000000000000000a [ 520.607093][T17263] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 520.607105][T17263] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.607117][T17263] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 520.607150][T17263] [ 521.037084][T17282] FAULT_INJECTION: forcing a failure. [ 521.037084][T17282] name failslab, interval 1, probability 0, space 0, times 0 [ 521.051741][T17279] syzkaller0: entered promiscuous mode [ 521.075351][T17279] syzkaller0: entered allmulticast mode [ 521.081275][T17282] CPU: 1 UID: 0 PID: 17282 Comm: syz.4.3324 Not tainted syzkaller #0 PREEMPT(full) [ 521.081304][T17282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 521.081317][T17282] Call Trace: [ 521.081327][T17282] [ 521.081336][T17282] dump_stack_lvl+0xe8/0x150 [ 521.081370][T17282] should_fail_ex+0x412/0x560 [ 521.081399][T17282] should_failslab+0xa8/0x100 [ 521.081426][T17282] __kmalloc_noprof+0xe8/0x760 [ 521.081445][T17282] ? ktime_get_coarse_real_ts64_mg+0x1c5/0x1e0 [ 521.081471][T17282] ? iter_file_splice_write+0x1d4/0x1100 [ 521.081505][T17282] iter_file_splice_write+0x1d4/0x1100 [ 521.081547][T17282] ? atime_needs_update+0x3ac/0x6d0 [ 521.081577][T17282] ? __pfx_iter_file_splice_write+0x10/0x10 [ 521.081626][T17282] ? __pfx_iter_file_splice_write+0x10/0x10 [ 521.081655][T17282] direct_splice_actor+0x101/0x160 [ 521.081687][T17282] splice_direct_to_actor+0x53a/0xc70 [ 521.081727][T17282] ? __pfx_direct_splice_actor+0x10/0x10 [ 521.081763][T17282] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 521.081790][T17282] ? get_pid_task+0x20/0x1f0 [ 521.081818][T17282] do_splice_direct+0x195/0x290 [ 521.081849][T17282] ? __pfx_do_splice_direct+0x10/0x10 [ 521.081877][T17282] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 521.081922][T17282] ? rw_verify_area+0x255/0x4d0 [ 521.081947][T17282] do_sendfile+0x535/0x7d0 [ 521.081983][T17282] ? __pfx_do_sendfile+0x10/0x10 [ 521.082008][T17282] ? __fget_files+0x3a0/0x420 [ 521.082048][T17282] __se_sys_sendfile64+0x144/0x1a0 [ 521.082076][T17282] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 521.082120][T17282] do_syscall_64+0x14d/0xf80 [ 521.082148][T17282] ? trace_irq_disable+0x3b/0x150 [ 521.082173][T17282] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.082193][T17282] ? clear_bhb_loop+0x40/0x90 [ 521.082217][T17282] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 521.082237][T17282] RIP: 0033:0x7f73e799c629 [ 521.082257][T17282] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 521.082275][T17282] RSP: 002b:00007f73e8916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 521.082298][T17282] RAX: ffffffffffffffda RBX: 00007f73e7c15fa0 RCX: 00007f73e799c629 [ 521.082312][T17282] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 521.082325][T17282] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 521.082338][T17282] R10: 00000000f03a0005 R11: 0000000000000246 R12: 0000000000000002 [ 521.082351][T17282] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 521.082384][T17282] [ 521.583770][T17289] netlink: 'syz.1.3327': attribute type 13 has an invalid length. [ 522.197690][T17318] syzkaller0: entered promiscuous mode [ 522.203232][T17318] syzkaller0: entered allmulticast mode [ 522.337567][T17322] netlink: 'syz.2.3340': attribute type 13 has an invalid length. [ 522.554293][T17331] netlink: zone id is out of range [ 522.561506][T17331] netlink: zone id is out of range [ 522.571116][T17331] netlink: zone id is out of range [ 522.580908][T17331] netlink: zone id is out of range [ 522.586754][T17331] netlink: zone id is out of range [ 522.592285][T17331] netlink: zone id is out of range [ 522.598315][T17331] netlink: zone id is out of range [ 522.604105][T17331] netlink: zone id is out of range [ 522.609737][T17331] netlink: zone id is out of range [ 522.615766][T17331] netlink: zone id is out of range [ 522.958331][T17344] syzkaller1: entered promiscuous mode [ 522.964091][T17344] syzkaller1: entered allmulticast mode [ 523.075131][ T5897] page_pool_release_retry() stalled pool shutdown: id 85, 1 inflight 60 sec [ 523.101796][T17351] Cannot find del_set index 1536 as target [ 523.326804][T17358] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3356'. [ 523.337888][T17359] tipc: Enabled bearer , priority 0 [ 523.357465][T17358] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3356'. [ 523.378749][T17356] tipc: Disabling bearer [ 523.621707][T17376] debugfs: 'netdev:nicvf0' already exists in 'phy7' [ 523.688951][T17382] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3364'. [ 523.814958][T17390] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3365'. [ 523.854033][T17390] FAULT_INJECTION: forcing a failure. [ 523.854033][T17390] name failslab, interval 1, probability 0, space 0, times 0 [ 523.909504][T17390] CPU: 1 UID: 0 PID: 17390 Comm: syz.3.3365 Not tainted syzkaller #0 PREEMPT(full) [ 523.909534][T17390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 523.909546][T17390] Call Trace: [ 523.909554][T17390] [ 523.909563][T17390] dump_stack_lvl+0xe8/0x150 [ 523.909602][T17390] should_fail_ex+0x412/0x560 [ 523.909631][T17390] should_failslab+0xa8/0x100 [ 523.909657][T17390] __kvmalloc_node_noprof+0x178/0x8a0 [ 523.909679][T17390] ? alloc_netdev_mqs+0x8a6/0x11b0 [ 523.909710][T17390] alloc_netdev_mqs+0x8a6/0x11b0 [ 523.909736][T17390] rtnl_create_link+0x31f/0xd70 [ 523.909765][T17390] rtnl_newlink_create+0x277/0xb70 [ 523.909793][T17390] ? __pfx___nla_validate_parse+0x10/0x10 [ 523.909828][T17390] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 523.909860][T17390] ? __pfx___mutex_lock+0x10/0x10 [ 523.909901][T17390] ? ns_capable+0x89/0xe0 [ 523.909930][T17390] rtnl_newlink+0x1666/0x1be0 [ 523.909972][T17390] ? __pfx_rtnl_newlink+0x10/0x10 [ 523.909994][T17390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.910052][T17390] ? kasan_quarantine_put+0xbb/0x1f0 [ 523.910072][T17390] ? lockdep_hardirqs_on+0x7a/0x110 [ 523.910105][T17390] ? kmem_cache_free+0x187/0x630 [ 523.910134][T17390] ? nlmon_xmit+0xb0/0x100 [ 523.910174][T17390] ? __lock_acquire+0x6b5/0x2cf0 [ 523.910204][T17390] ? __local_bh_enable_ip+0xd0/0x130 [ 523.910230][T17390] ? lockdep_hardirqs_on+0x7a/0x110 [ 523.910257][T17390] ? __dev_queue_xmit+0x274/0x38a0 [ 523.910284][T17390] ? __local_bh_enable_ip+0xd0/0x130 [ 523.910308][T17390] ? __dev_queue_xmit+0x274/0x38a0 [ 523.910364][T17390] ? __pfx_rtnl_newlink+0x10/0x10 [ 523.910388][T17390] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 523.910415][T17390] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 523.910438][T17390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 523.910459][T17390] ? ref_tracker_free+0x693/0x840 [ 523.910480][T17390] ? __copy_skb_header+0xa3/0x4a0 [ 523.910510][T17390] ? __pfx_ref_tracker_free+0x10/0x10 [ 523.910532][T17390] ? __skb_clone+0x63/0x7a0 [ 523.910569][T17390] netlink_rcv_skb+0x232/0x4b0 [ 523.910595][T17390] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 523.910620][T17390] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 523.910656][T17390] ? netlink_deliver_tap+0x2e/0x1b0 [ 523.910689][T17390] netlink_unicast+0x80f/0x9b0 [ 523.910720][T17390] ? __pfx_netlink_unicast+0x10/0x10 [ 523.910743][T17390] ? netlink_sendmsg+0x650/0xb40 [ 523.910765][T17390] ? skb_put+0x11b/0x210 [ 523.910794][T17390] netlink_sendmsg+0x813/0xb40 [ 523.910826][T17390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 523.910852][T17390] ? aa_sock_msg_perm+0xf1/0x1b0 [ 523.910877][T17390] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 523.910900][T17390] ? __pfx_netlink_sendmsg+0x10/0x10 [ 523.910921][T17390] ____sys_sendmsg+0xa68/0xad0 [ 523.910960][T17390] ? __pfx_____sys_sendmsg+0x10/0x10 [ 523.910997][T17390] ? import_iovec+0x73/0xa0 [ 523.911027][T17390] ___sys_sendmsg+0x2a5/0x360 [ 523.911062][T17390] ? __pfx____sys_sendmsg+0x10/0x10 [ 523.911133][T17390] ? __fget_files+0x2a/0x420 [ 523.911159][T17390] ? __fget_files+0x3a0/0x420 [ 523.911197][T17390] __x64_sys_sendmsg+0x1bd/0x2a0 [ 523.911227][T17390] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 523.911265][T17390] ? __pfx_ksys_write+0x10/0x10 [ 523.911298][T17390] do_syscall_64+0x14d/0xf80 [ 523.911324][T17390] ? trace_irq_disable+0x3b/0x150 [ 523.911349][T17390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.911370][T17390] ? clear_bhb_loop+0x40/0x90 [ 523.911391][T17390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 523.911411][T17390] RIP: 0033:0x7fc9b939c629 [ 523.911430][T17390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 523.911446][T17390] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 523.911468][T17390] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 523.911482][T17390] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 523.911494][T17390] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 523.911507][T17390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 523.911518][T17390] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 523.911550][T17390] [ 524.359122][T17395] syzkaller1: entered promiscuous mode [ 524.364882][T17395] syzkaller1: entered allmulticast mode [ 524.392409][T17401] FAULT_INJECTION: forcing a failure. [ 524.392409][T17401] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 524.408458][T17401] CPU: 0 UID: 0 PID: 17401 Comm: syz.3.3369 Not tainted syzkaller #0 PREEMPT(full) [ 524.408489][T17401] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 524.408501][T17401] Call Trace: [ 524.408509][T17401] [ 524.408517][T17401] dump_stack_lvl+0xe8/0x150 [ 524.408551][T17401] should_fail_ex+0x412/0x560 [ 524.408579][T17401] _copy_from_user+0x2d/0xb0 [ 524.408607][T17401] sock_do_ioctl+0x195/0x320 [ 524.408633][T17401] ? __pfx_sock_do_ioctl+0x10/0x10 [ 524.408652][T17401] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 524.408699][T17401] sock_ioctl+0x5c6/0x7f0 [ 524.408719][T17401] ? __pfx_sock_ioctl+0x10/0x10 [ 524.408739][T17401] ? __fget_files+0x2a/0x420 [ 524.408765][T17401] ? __fget_files+0x3a0/0x420 [ 524.408788][T17401] ? __fget_files+0x2a/0x420 [ 524.408815][T17401] ? bpf_lsm_file_ioctl+0x9/0x20 [ 524.408847][T17401] ? __pfx_sock_ioctl+0x10/0x10 [ 524.408865][T17401] __se_sys_ioctl+0xfc/0x170 [ 524.408888][T17401] do_syscall_64+0x14d/0xf80 [ 524.408911][T17401] ? trace_irq_disable+0x3b/0x150 [ 524.408937][T17401] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.408956][T17401] ? clear_bhb_loop+0x40/0x90 [ 524.408980][T17401] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 524.409000][T17401] RIP: 0033:0x7fc9b939c629 [ 524.409019][T17401] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 524.409034][T17401] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 524.409055][T17401] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 524.409069][T17401] RDX: 0000200000000f80 RSI: 0000000000008946 RDI: 0000000000000003 [ 524.409081][T17401] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 524.409092][T17401] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 524.409104][T17401] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 524.409137][T17401] [ 524.795603][T17410] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3374'. [ 524.805255][T17410] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3374'. [ 524.936587][T17414] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3371'. [ 524.947523][T17414] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3371'. [ 525.012524][T17417] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3375'. [ 525.411998][T17434] netlink: 'syz.2.3383': attribute type 1 has an invalid length. [ 525.458561][T17434] 8021q: adding VLAN 0 to HW filter on device bond15 [ 525.607939][T17437] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3383'. [ 525.629898][T17437] bond15: entered promiscuous mode [ 525.653887][T17437] bond15: entered allmulticast mode [ 525.665880][T17443] tipc: New replicast peer: 255.255.177.255 [ 525.687361][T17443] tipc: Enabled bearer , priority 10 [ 526.050372][T17462] FAULT_INJECTION: forcing a failure. [ 526.050372][T17462] name failslab, interval 1, probability 0, space 0, times 0 [ 526.063640][T17462] CPU: 0 UID: 0 PID: 17462 Comm: syz.3.3389 Not tainted syzkaller #0 PREEMPT(full) [ 526.063668][T17462] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.063680][T17462] Call Trace: [ 526.063689][T17462] [ 526.063698][T17462] dump_stack_lvl+0xe8/0x150 [ 526.063732][T17462] should_fail_ex+0x412/0x560 [ 526.063761][T17462] should_failslab+0xa8/0x100 [ 526.063796][T17462] __kmalloc_noprof+0xe8/0x760 [ 526.063818][T17462] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 526.063854][T17462] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 526.063890][T17462] genl_family_rcv_msg_doit+0xd9/0x330 [ 526.063925][T17462] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 526.063962][T17462] ? apparmor_capable+0x137/0x1a0 [ 526.063992][T17462] ? bpf_lsm_capable+0x9/0x20 [ 526.064016][T17462] ? security_capable+0x7e/0x2c0 [ 526.064045][T17462] genl_rcv_msg+0x61c/0x7a0 [ 526.064080][T17462] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.064107][T17462] ? __pfx_ovs_ct_limit_cmd_del+0x10/0x10 [ 526.064129][T17462] ? __lock_acquire+0x6b5/0x2cf0 [ 526.064166][T17462] netlink_rcv_skb+0x232/0x4b0 [ 526.064190][T17462] ? __pfx_genl_rcv_msg+0x10/0x10 [ 526.064219][T17462] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 526.064261][T17462] ? down_read+0x272/0x2e0 [ 526.064280][T17462] ? genl_rcv+0xd/0x40 [ 526.064307][T17462] genl_rcv+0x28/0x40 [ 526.064332][T17462] netlink_unicast+0x80f/0x9b0 [ 526.064362][T17462] ? __pfx_netlink_unicast+0x10/0x10 [ 526.064385][T17462] ? netlink_sendmsg+0x650/0xb40 [ 526.064406][T17462] ? skb_put+0x11b/0x210 [ 526.064441][T17462] netlink_sendmsg+0x813/0xb40 [ 526.064474][T17462] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.064502][T17462] ? aa_sock_msg_perm+0xf1/0x1b0 [ 526.064528][T17462] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 526.064551][T17462] ? __pfx_netlink_sendmsg+0x10/0x10 [ 526.064572][T17462] ____sys_sendmsg+0xa68/0xad0 [ 526.064609][T17462] ? __pfx_____sys_sendmsg+0x10/0x10 [ 526.064648][T17462] ? import_iovec+0x73/0xa0 [ 526.064679][T17462] ___sys_sendmsg+0x2a5/0x360 [ 526.064711][T17462] ? __pfx____sys_sendmsg+0x10/0x10 [ 526.064789][T17462] ? __fget_files+0x2a/0x420 [ 526.064815][T17462] ? __fget_files+0x3a0/0x420 [ 526.064846][T17462] __x64_sys_sendmsg+0x1bd/0x2a0 [ 526.064870][T17462] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 526.064900][T17462] ? __pfx_ksys_write+0x10/0x10 [ 526.064926][T17462] do_syscall_64+0x14d/0xf80 [ 526.064947][T17462] ? trace_irq_disable+0x3b/0x150 [ 526.064968][T17462] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.064984][T17462] ? clear_bhb_loop+0x40/0x90 [ 526.065002][T17462] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.065018][T17462] RIP: 0033:0x7fc9b939c629 [ 526.065034][T17462] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.065047][T17462] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 526.065066][T17462] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 526.065077][T17462] RDX: 000000000000c000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 526.065087][T17462] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 526.065097][T17462] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.065106][T17462] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 526.065132][T17462] [ 526.528046][T17467] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 526.543321][T17466] netlink: 'syz.3.3391': attribute type 3 has an invalid length. [ 526.597995][T17427] ipvlan2: entered promiscuous mode [ 526.617678][T17427] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 526.640177][T17427] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 526.861478][T17476] netlink: 'syz.0.3395': attribute type 2 has an invalid length. [ 527.137265][T17488] netlink: 'syz.0.3398': attribute type 1 has an invalid length. [ 527.174639][T17488] 8021q: adding VLAN 0 to HW filter on device bond20 [ 527.262988][T17493] bond20: entered promiscuous mode [ 527.268673][T17493] bond20: entered allmulticast mode [ 528.748011][T17448] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 529.354195][T17513] __nla_validate_parse: 12 callbacks suppressed [ 529.354219][T17513] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3410'. [ 529.372075][T17521] siw: device registration error -23 [ 529.408217][T17513] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3410'. [ 529.420318][T17523] netlink: 'syz.1.3409': attribute type 1 has an invalid length. [ 529.425564][T17524] netlink: 'syz.2.3413': attribute type 1 has an invalid length. [ 529.540587][T17523] 8021q: adding VLAN 0 to HW filter on device bond15 [ 529.620276][T17535] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3413'. [ 529.899332][T17524] 8021q: adding VLAN 0 to HW filter on device bond16 [ 529.962695][T17529] 8021q: adding VLAN 0 to HW filter on device batadv10 [ 529.979352][T17543] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3416'. [ 529.995004][T17529] bond15: (slave batadv10): making interface the new active one [ 530.005529][T17529] bond15: (slave batadv10): Enslaving as an active interface with an up link [ 530.019698][T17535] bond16: entered promiscuous mode [ 530.025806][T17535] bond16: entered allmulticast mode [ 530.045404][T17532] debugfs: 'netdev:nicvf0' already exists in 'phy5' [ 531.072247][T17569] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3426'. [ 531.095185][T17569] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3426'. [ 531.223502][T17578] veth0_virt_wifi: entered promiscuous mode [ 531.240790][T17578] veth0_virt_wifi: left promiscuous mode [ 531.531840][T17586] netlink: 'syz.1.3432': attribute type 16 has an invalid length. [ 531.554634][T17589] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3434'. [ 531.571474][T17586] netlink: 'syz.1.3432': attribute type 17 has an invalid length. [ 531.581460][T17587] xt_limit: Overflow, try lower: 268435456/134217728 [ 531.649464][T17593] netlink: 'syz.0.3431': attribute type 1 has an invalid length. [ 531.737512][T17586] net_ratelimit: 125 callbacks suppressed [ 531.737525][T17586] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 531.824013][T17593] 8021q: adding VLAN 0 to HW filter on device bond21 [ 531.841832][ T5838] lo speed is unknown, defaulting to 1000 [ 531.848255][T17605] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3436'. [ 531.851195][ T5838] syz2: Port: 1 Link ACTIVE [ 531.866396][T17593] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3431'. [ 531.932505][T17593] bond21: entered promiscuous mode [ 531.940808][T17593] bond21: entered allmulticast mode [ 531.949798][T17609] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3436'. [ 532.052022][T17605] 8021q: adding VLAN 0 to HW filter on device bond27 [ 533.262843][T17650] netlink: 'syz.0.3453': attribute type 1 has an invalid length. [ 533.339042][T17650] 8021q: adding VLAN 0 to HW filter on device bond22 [ 533.500222][T17658] bond22: entered promiscuous mode [ 533.520309][T17658] bond22: entered allmulticast mode [ 533.665984][T17661] syzkaller0: entered promiscuous mode [ 533.671670][T17661] syzkaller0: entered allmulticast mode [ 533.674906][T17677] netlink: 'syz.4.3456': attribute type 1 has an invalid length. [ 533.815482][T17677] 8021q: adding VLAN 0 to HW filter on device bond28 [ 534.239626][T17692] FAULT_INJECTION: forcing a failure. [ 534.239626][T17692] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 534.260754][T17692] CPU: 1 UID: 0 PID: 17692 Comm: syz.0.3463 Not tainted syzkaller #0 PREEMPT(full) [ 534.260783][T17692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 534.260795][T17692] Call Trace: [ 534.260803][T17692] [ 534.260812][T17692] dump_stack_lvl+0xe8/0x150 [ 534.260845][T17692] should_fail_ex+0x412/0x560 [ 534.260874][T17692] _copy_from_user+0x2d/0xb0 [ 534.260911][T17692] __sys_bpf+0x229/0x950 [ 534.260942][T17692] ? __pfx___sys_bpf+0x10/0x10 [ 534.260988][T17692] ? ksys_write+0x242/0x270 [ 534.261011][T17692] ? __pfx_ksys_write+0x10/0x10 [ 534.261038][T17692] __x64_sys_bpf+0x7c/0x90 [ 534.261064][T17692] do_syscall_64+0x14d/0xf80 [ 534.261090][T17692] ? trace_irq_disable+0x3b/0x150 [ 534.261115][T17692] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.261134][T17692] ? clear_bhb_loop+0x40/0x90 [ 534.261157][T17692] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.261175][T17692] RIP: 0033:0x7fadd379c629 [ 534.261194][T17692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 534.261211][T17692] RSP: 002b:00007fadd45de028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 534.261232][T17692] RAX: ffffffffffffffda RBX: 00007fadd3a15fa0 RCX: 00007fadd379c629 [ 534.261247][T17692] RDX: 0000000000000070 RSI: 0000200000000440 RDI: 0000000000000005 [ 534.261258][T17692] RBP: 00007fadd45de090 R08: 0000000000000000 R09: 0000000000000000 [ 534.261270][T17692] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.261283][T17692] R13: 00007fadd3a16038 R14: 00007fadd3a15fa0 R15: 00007ffd3c906568 [ 534.261315][T17692] [ 534.741560][T17699] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 534.967840][T17706] netlink: 'syz.2.3467': attribute type 1 has an invalid length. [ 534.991132][T17708] netlink: 'syz.4.3469': attribute type 1 has an invalid length. [ 535.321122][T17717] __nla_validate_parse: 7 callbacks suppressed [ 535.321143][T17717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3470'. [ 535.369096][T17717] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3470'. [ 535.507529][T17724] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3471'. [ 536.787223][T17706] workqueue: Failed to create a rescuer kthread for wq "bond17": -EINTR [ 536.788991][T17708] workqueue: Failed to create a rescuer kthread for wq "bond29": -EINTR [ 536.954375][T17732] netlink: 'syz.1.3473': attribute type 1 has an invalid length. [ 536.962402][T17728] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 537.127430][T17732] 8021q: adding VLAN 0 to HW filter on device bond16 [ 537.218783][T17732] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3473'. [ 537.258366][T17732] bond16: entered promiscuous mode [ 537.280129][T17732] bond16: entered allmulticast mode [ 537.371547][T17749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3476'. [ 537.465512][T17754] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3476'. [ 537.468329][T17753] --map-set only usable from mangle table [ 537.621351][T17758] netlink: 'syz.2.3479': attribute type 10 has an invalid length. [ 537.640203][T17758] team0: Port device dummy0 added [ 537.665749][T17758] netlink: 'syz.2.3479': attribute type 10 has an invalid length. [ 537.710224][T17758] team0: Port device dummy0 removed [ 537.825789][T17766] syzkaller0: entered promiscuous mode [ 537.831366][T17766] syzkaller0: entered allmulticast mode [ 537.946300][T17772] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3485'. [ 538.108398][T17774] netlink: 'syz.3.3486': attribute type 13 has an invalid length. [ 538.132371][T17777] netlink: 'syz.2.3484': attribute type 1 has an invalid length. [ 538.146355][T17779] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3488'. [ 538.561791][T17801] netlink: 'syz.3.3492': attribute type 1 has an invalid length. [ 538.763077][T17777] 8021q: adding VLAN 0 to HW filter on device bond17 [ 538.776060][T17808] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3492'. [ 538.796213][T17786] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.882430][T17801] 8021q: adding VLAN 0 to HW filter on device bond19 [ 538.949405][T17786] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.039489][T17786] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.067524][T17818] netlink: 'syz.2.3495': attribute type 10 has an invalid length. [ 539.087505][T17818] team0: Port device dummy0 added [ 539.094187][T17818] netlink: 'syz.2.3495': attribute type 10 has an invalid length. [ 539.150125][T17818] team0: Port device dummy0 removed [ 539.180126][T17786] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.208062][T17822] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3497'. [ 539.365238][ T49] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.426118][ T148] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.490962][T17832] netlink: 'syz.3.3501': attribute type 1 has an invalid length. [ 539.530546][T17837] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 539.546269][ T49] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.567294][ T49] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.086291][T17833] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 540.309619][T17850] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 540.537685][T17854] netlink: 'syz.4.3508': attribute type 1 has an invalid length. [ 540.595616][T17854] 8021q: adding VLAN 0 to HW filter on device bond29 [ 540.731198][T17857] __nla_validate_parse: 3 callbacks suppressed [ 540.731221][T17857] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3508'. [ 540.773007][T17857] bond29: entered promiscuous mode [ 540.788242][T17857] bond29: entered allmulticast mode [ 540.853203][T17866] 8021q: adding VLAN 0 to HW filter on device bond20 [ 540.870122][T17869] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3512'. [ 541.367905][T17879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3517'. [ 541.406432][T17879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3517'. [ 541.439976][T17883] tipc: Enabling of bearer rejected, failed to enable media [ 541.453303][T17890] ip6t_REJECT: ECHOREPLY is not supported [ 541.454664][T17892] ip6t_REJECT: ECHOREPLY is not supported [ 542.129474][T17878] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 542.135052][T17919] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3526'. [ 542.428584][T17927] validate_nla: 1 callbacks suppressed [ 542.428599][T17927] netlink: 'syz.0.3529': attribute type 1 has an invalid length. [ 542.489329][T17927] 8021q: adding VLAN 0 to HW filter on device bond23 [ 542.570212][T17930] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3529'. [ 542.579543][T17930] bond23: entered promiscuous mode [ 542.584839][T17930] bond23: entered allmulticast mode [ 544.293929][T17879] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 544.321240][T17938] netlink: 'syz.1.3532': attribute type 1 has an invalid length. [ 544.472419][T17941] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3533'. [ 544.512774][T17941] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3533'. [ 544.596798][T17945] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3534'. [ 545.487564][T17972] team_slave_0: entered promiscuous mode [ 545.493384][T17972] team_slave_1: entered promiscuous mode [ 545.576441][T17972] macsec4: entered promiscuous mode [ 545.602628][T17970] atomic_op ffff888021f6e198 conn xmit_atomic 0000000000000000 [ 545.628774][T17972] team0: entered promiscuous mode [ 545.662085][T17972] team0: Device macsec4 is already an upper device of the team interface [ 545.730223][T17972] team0: left promiscuous mode [ 545.745225][T17972] team_slave_0: left promiscuous mode [ 545.750744][T17972] team_slave_1: left promiscuous mode [ 545.874472][T17977] netlink: 'syz.2.3544': attribute type 1 has an invalid length. [ 546.050312][T17982] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3544'. [ 546.140192][T17986] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3548'. [ 546.159953][T17986] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3548'. [ 546.230357][T17986] IPVS: stopping backup sync thread 17850 ... [ 546.345892][T17991] ip6erspan0: entered allmulticast mode [ 546.376828][T17993] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 546.881152][T18019] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3557'. [ 547.269952][T18039] netlink: 'syz.4.3562': attribute type 1 has an invalid length. [ 547.382822][T18019] gtp0: entered promiscuous mode [ 547.389416][T18019] gtp0: entered allmulticast mode [ 547.465353][T18037] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3562'. [ 547.505811][T18045] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3564'. [ 547.570340][T18028] syzkaller0: entered promiscuous mode [ 547.576826][T18028] syzkaller0: entered allmulticast mode [ 550.003346][T18092] netlink: 'syz.2.3576': attribute type 10 has an invalid length. [ 550.036772][T18090] netlink: 'syz.1.3579': attribute type 10 has an invalid length. [ 550.043943][T18092] veth1_macvtap: left promiscuous mode [ 550.089339][T18096] netlink: 'syz.1.3579': attribute type 10 has an invalid length. [ 550.098017][T18092] team0: Device veth1_macvtap failed to register rx_handler [ 550.179145][T18090] team0: Port device dummy0 added [ 550.232953][T18096] team0: Port device dummy0 removed [ 550.242201][T18101] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3582'. [ 550.267121][T18101] nbd: must specify a device to reconfigure [ 550.647739][T18111] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3586'. [ 550.714066][T18111] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3586'. [ 550.832966][T18117] netlink: 'syz.4.3588': attribute type 1 has an invalid length. [ 550.922203][T18119] geneve3: entered promiscuous mode [ 550.971969][ T148] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 550.982957][ T148] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 550.990723][T18122] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3588'. [ 551.022257][ T148] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 551.031765][ T148] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 551.230697][T18129] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3593'. [ 551.244932][T18131] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3596'. [ 551.598835][T18146] syzkaller1: entered promiscuous mode [ 551.617256][T18146] syzkaller1: entered allmulticast mode [ 551.773371][T18150] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3598'. [ 552.080222][T18137] lo speed is unknown, defaulting to 1000 [ 552.095564][T18137] wg1 speed is unknown, defaulting to 1000 [ 552.329819][T18166] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3602'. [ 552.340436][T18166] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3602'. [ 552.702155][T18175] netlink: 'syz.2.3606': attribute type 1 has an invalid length. [ 552.860529][T18176] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3606'. [ 552.911884][T18180] FAULT_INJECTION: forcing a failure. [ 552.911884][T18180] name failslab, interval 1, probability 0, space 0, times 0 [ 552.956825][T18180] CPU: 0 UID: 0 PID: 18180 Comm: syz.1.3608 Not tainted syzkaller #0 PREEMPT(full) [ 552.956855][T18180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 552.956868][T18180] Call Trace: [ 552.956877][T18180] [ 552.956887][T18180] dump_stack_lvl+0xe8/0x150 [ 552.956922][T18180] should_fail_ex+0x412/0x560 [ 552.956951][T18180] should_failslab+0xa8/0x100 [ 552.956978][T18180] __kvmalloc_node_noprof+0x178/0x8a0 [ 552.956999][T18180] ? is_bpf_text_address+0x26/0x2b0 [ 552.957020][T18180] ? bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 552.957054][T18180] bpf_test_run_xdp_live+0x1f2/0x1cf0 [ 552.957076][T18180] ? arch_stack_walk+0xfb/0x150 [ 552.957121][T18180] ? __pfx_stack_trace_save+0x10/0x10 [ 552.957145][T18180] ? stack_depot_save_flags+0x33/0x810 [ 552.957176][T18180] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 552.957198][T18180] ? bpf_test_init+0x9f/0x150 [ 552.957217][T18180] ? bpf_prog_test_run_xdp+0x529/0x1160 [ 552.957237][T18180] ? bpf_prog_test_run+0x2c7/0x340 [ 552.957254][T18180] ? __sys_bpf+0x643/0x950 [ 552.957279][T18180] ? __x64_sys_bpf+0x7c/0x90 [ 552.957354][T18180] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 552.957389][T18180] ? _copy_from_user+0x94/0xb0 [ 552.957416][T18180] ? bpf_test_init+0x113/0x150 [ 552.957436][T18180] ? xdp_convert_md_to_buff+0x5b/0x330 [ 552.957462][T18180] bpf_prog_test_run_xdp+0x81c/0x1160 [ 552.957500][T18180] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 552.957529][T18180] ? __fget_files+0x2a/0x420 [ 552.957562][T18180] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 552.957592][T18180] bpf_prog_test_run+0x2c7/0x340 [ 552.957616][T18180] __sys_bpf+0x643/0x950 [ 552.957647][T18180] ? __pfx___sys_bpf+0x10/0x10 [ 552.957693][T18180] ? ksys_write+0x242/0x270 [ 552.957715][T18180] ? __pfx_ksys_write+0x10/0x10 [ 552.957752][T18180] __x64_sys_bpf+0x7c/0x90 [ 552.957779][T18180] do_syscall_64+0x14d/0xf80 [ 552.957807][T18180] ? trace_irq_disable+0x3b/0x150 [ 552.957832][T18180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.957853][T18180] ? clear_bhb_loop+0x40/0x90 [ 552.957878][T18180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.957897][T18180] RIP: 0033:0x7f578b39c629 [ 552.957916][T18180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 552.957933][T18180] RSP: 002b:00007f578c17b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 552.957954][T18180] RAX: ffffffffffffffda RBX: 00007f578b615fa0 RCX: 00007f578b39c629 [ 552.957968][T18180] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 552.957981][T18180] RBP: 00007f578c17b090 R08: 0000000000000000 R09: 0000000000000000 [ 552.957994][T18180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 552.958006][T18180] R13: 00007f578b616038 R14: 00007f578b615fa0 R15: 00007ffc2a8ae6d8 [ 552.958037][T18180] [ 553.073073][T18183] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3609'. [ 553.331158][T18189] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 553.472714][T18194] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3615'. [ 553.510896][T18200] FAULT_INJECTION: forcing a failure. [ 553.510896][T18200] name failslab, interval 1, probability 0, space 0, times 0 [ 553.533068][T18198] tipc: Enabled bearer , priority 0 [ 553.568673][T18198] syzkaller0: entered promiscuous mode [ 553.574622][T18198] syzkaller0: entered allmulticast mode [ 553.580739][T18200] CPU: 0 UID: 0 PID: 18200 Comm: syz.1.3614 Not tainted syzkaller #0 PREEMPT(full) [ 553.580775][T18200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 553.580787][T18200] Call Trace: [ 553.580795][T18200] [ 553.580803][T18200] dump_stack_lvl+0xe8/0x150 [ 553.580836][T18200] should_fail_ex+0x412/0x560 [ 553.580865][T18200] should_failslab+0xa8/0x100 [ 553.580891][T18200] __kmalloc_noprof+0xe8/0x760 [ 553.580912][T18200] ? tomoyo_encode+0x28b/0x550 [ 553.580942][T18200] tomoyo_encode+0x28b/0x550 [ 553.580972][T18200] tomoyo_realpath_from_path+0x58d/0x5d0 [ 553.581007][T18200] ? tomoyo_path_number_perm+0x219/0x630 [ 553.581028][T18200] tomoyo_path_number_perm+0x246/0x630 [ 553.581076][T18200] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 553.581100][T18200] ? __lock_acquire+0x6b5/0x2cf0 [ 553.581138][T18200] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 553.581190][T18200] ? __fget_files+0x2a/0x420 [ 553.581221][T18200] ? __fget_files+0x2a/0x420 [ 553.581245][T18200] ? __fget_files+0x3a0/0x420 [ 553.581269][T18200] ? __fget_files+0x2a/0x420 [ 553.581299][T18200] security_file_ioctl+0xc3/0x2a0 [ 553.581332][T18200] __se_sys_ioctl+0x47/0x170 [ 553.581358][T18200] do_syscall_64+0x14d/0xf80 [ 553.581385][T18200] ? trace_irq_disable+0x3b/0x150 [ 553.581412][T18200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.581446][T18200] ? clear_bhb_loop+0x40/0x90 [ 553.581469][T18200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 553.581489][T18200] RIP: 0033:0x7f578b39c629 [ 553.581508][T18200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 553.581523][T18200] RSP: 002b:00007f578c17b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 553.581546][T18200] RAX: ffffffffffffffda RBX: 00007f578b615fa0 RCX: 00007f578b39c629 [ 553.581560][T18200] RDX: 0000200000000340 RSI: 00000000000089f1 RDI: 0000000000000003 [ 553.581573][T18200] RBP: 00007f578c17b090 R08: 0000000000000000 R09: 0000000000000000 [ 553.581585][T18200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 553.581596][T18200] R13: 00007f578b616038 R14: 00007f578b615fa0 R15: 00007ffc2a8ae6d8 [ 553.581626][T18200] [ 553.581647][T18200] ERROR: Out of memory at tomoyo_realpath_from_path. [ 553.837568][T18198] syzkaller0: mtu greater than device maximum [ 553.846974][T18197] tipc: Resetting bearer [ 553.916742][T18197] tipc: Disabling bearer [ 554.008460][T18207] syzkaller0: entered promiscuous mode [ 554.022853][T18207] syzkaller0: entered allmulticast mode [ 554.857735][T18232] netlink: 'syz.0.3622': attribute type 1 has an invalid length. [ 555.038580][T18237] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3622'. [ 556.143464][T18223] workqueue: Failed to create a rescuer kthread for wq "bond18": -EINTR [ 556.237889][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3626'. [ 556.305348][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3626'. [ 556.362539][T18247] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3626'. [ 556.427155][T18258] netlink: 'syz.4.3630': attribute type 10 has an invalid length. [ 556.444711][T18258] bond0: (slave dummy0): Releasing backup interface [ 556.460050][T18258] team0: Port device dummy0 added [ 556.472176][T18258] netlink: 'syz.4.3630': attribute type 10 has an invalid length. [ 556.519991][T18258] team0: Port device dummy0 removed [ 556.543340][T18258] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 556.694545][T18266] FAULT_INJECTION: forcing a failure. [ 556.694545][T18266] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 556.709655][T18266] CPU: 1 UID: 0 PID: 18266 Comm: syz.0.3633 Not tainted syzkaller #0 PREEMPT(full) [ 556.709682][T18266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 556.709694][T18266] Call Trace: [ 556.709702][T18266] [ 556.709710][T18266] dump_stack_lvl+0xe8/0x150 [ 556.709745][T18266] should_fail_ex+0x412/0x560 [ 556.709774][T18266] prepare_alloc_pages+0x22a/0x650 [ 556.709807][T18266] __alloc_frozen_pages_noprof+0x12f/0x380 [ 556.709836][T18266] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 556.709864][T18266] ? __pfx_policy_nodemask+0x10/0x10 [ 556.709898][T18266] alloc_pages_mpol+0x232/0x4a0 [ 556.709928][T18266] folio_alloc_mpol_noprof+0x39/0x70 [ 556.709955][T18266] shmem_alloc_and_add_folio+0x445/0xf80 [ 556.709992][T18266] ? filemap_get_entry+0xca/0x320 [ 556.710010][T18266] ? filemap_get_entry+0xca/0x320 [ 556.710030][T18266] ? filemap_get_entry+0x2ac/0x320 [ 556.710050][T18266] ? __pfx_filemap_get_entry+0x10/0x10 [ 556.710071][T18266] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 556.710104][T18266] ? shmem_allowable_huge_orders+0x5ec/0x690 [ 556.710140][T18266] shmem_get_folio_gfp+0x5a9/0x1670 [ 556.710191][T18266] shmem_fault+0x179/0x390 [ 556.710219][T18266] __do_fault+0x138/0x390 [ 556.710243][T18266] do_pte_missing+0x228f/0x3750 [ 556.710264][T18266] ? do_pte_missing+0x130a/0x3750 [ 556.710295][T18266] ? handle_mm_fault+0xee/0x3310 [ 556.710327][T18266] handle_mm_fault+0x1bec/0x3310 [ 556.710369][T18266] ? handle_mm_fault+0xee/0x3310 [ 556.710403][T18266] ? __pfx_handle_mm_fault+0x10/0x10 [ 556.710455][T18266] ? lock_mm_and_find_vma+0xa7/0x340 [ 556.710479][T18266] do_user_addr_fault+0x75b/0x1340 [ 556.710522][T18266] exc_page_fault+0x6a/0xc0 [ 556.710552][T18266] asm_exc_page_fault+0x26/0x30 [ 556.710572][T18266] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 556.710595][T18266] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 556.710612][T18266] RSP: 0018:ffffc900055bf5f8 EFLAGS: 00050206 [ 556.710640][T18266] RAX: 00007ffffffff001 RBX: ffff88807987b000 RCX: 0000000000000140 [ 556.710654][T18266] RDX: 0000000000000001 RSI: 0000200000005000 RDI: ffff88807987bec0 [ 556.710668][T18266] RBP: ffffc900055bf760 R08: ffff88807987bfff R09: 1ffff1100f30f7ff [ 556.710682][T18266] R10: dffffc0000000000 R11: ffffed100f30f800 R12: ffffc900055bfdf8 [ 556.710696][T18266] R13: 0000200000004140 R14: 0000000000001000 R15: 1ffff92000ab7fbf [ 556.710729][T18266] _copy_from_iter+0x21b/0x1670 [ 556.710767][T18266] ? __pfx__copy_from_iter+0x10/0x10 [ 556.710788][T18266] ? sock_alloc_send_pskb+0x896/0x990 [ 556.710822][T18266] ? __pfx__copy_from_iter+0x10/0x10 [ 556.710849][T18266] ? page_copy_sane+0x16a/0x270 [ 556.710876][T18266] copy_page_from_iter+0xdd/0x170 [ 556.710906][T18266] skb_copy_datagram_from_iter+0x306/0x710 [ 556.710951][T18266] unix_stream_sendmsg+0x5f3/0xe80 [ 556.710995][T18266] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 556.711025][T18266] ? aa_sock_msg_perm+0xda/0x1b0 [ 556.711051][T18266] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 556.711075][T18266] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 556.711095][T18266] ____sys_sendmsg+0xa68/0xad0 [ 556.711134][T18266] ? __pfx_____sys_sendmsg+0x10/0x10 [ 556.711172][T18266] ? import_iovec+0x73/0xa0 [ 556.711204][T18266] ___sys_sendmsg+0x2a5/0x360 [ 556.711238][T18266] ? __pfx____sys_sendmsg+0x10/0x10 [ 556.711303][T18266] ? __fget_files+0x2a/0x420 [ 556.711330][T18266] ? __fget_files+0x3a0/0x420 [ 556.711367][T18266] __x64_sys_sendmsg+0x1bd/0x2a0 [ 556.711397][T18266] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 556.711435][T18266] ? __pfx_ksys_write+0x10/0x10 [ 556.711469][T18266] do_syscall_64+0x14d/0xf80 [ 556.711495][T18266] ? trace_irq_disable+0x3b/0x150 [ 556.711522][T18266] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.711542][T18266] ? clear_bhb_loop+0x40/0x90 [ 556.711565][T18266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 556.711586][T18266] RIP: 0033:0x7fadd379c629 [ 556.711605][T18266] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 556.711631][T18266] RSP: 002b:00007fadd45de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 556.711651][T18266] RAX: ffffffffffffffda RBX: 00007fadd3a15fa0 RCX: 00007fadd379c629 [ 556.711664][T18266] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 000000000000000a [ 556.711677][T18266] RBP: 00007fadd45de090 R08: 0000000000000000 R09: 0000000000000000 [ 556.711688][T18266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 556.711700][T18266] R13: 00007fadd3a16038 R14: 00007fadd3a15fa0 R15: 00007ffd3c906568 [ 556.711735][T18266] [ 556.719191][T18273] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3635'. [ 557.199703][T18290] netlink: 'syz.1.3639': attribute type 1 has an invalid length. [ 557.272715][T18287] syzkaller0: entered promiscuous mode [ 557.279184][T18287] syzkaller0: entered allmulticast mode [ 557.334967][T18295] xt_nat: multiple ranges no longer supported [ 557.438086][T18300] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3639'. [ 557.467225][T18302] ieee802154 phy0 wpan0: encryption failed: -90 [ 559.150219][T18320] FAULT_INJECTION: forcing a failure. [ 559.150219][T18320] name failslab, interval 1, probability 0, space 0, times 0 [ 559.163382][T18320] CPU: 1 UID: 0 PID: 18320 Comm: syz.2.3651 Not tainted syzkaller #0 PREEMPT(full) [ 559.163411][T18320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 559.163424][T18320] Call Trace: [ 559.163433][T18320] [ 559.163441][T18320] dump_stack_lvl+0xe8/0x150 [ 559.163475][T18320] should_fail_ex+0x412/0x560 [ 559.163509][T18320] should_failslab+0xa8/0x100 [ 559.163534][T18320] __kmalloc_noprof+0xe8/0x760 [ 559.163554][T18320] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 559.163595][T18320] tomoyo_realpath_from_path+0xe3/0x5d0 [ 559.163632][T18320] ? tomoyo_path_number_perm+0x219/0x630 [ 559.163653][T18320] tomoyo_path_number_perm+0x246/0x630 [ 559.163676][T18320] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 559.163701][T18320] ? __lock_acquire+0x6b5/0x2cf0 [ 559.163736][T18320] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 559.163788][T18320] ? __fget_files+0x2a/0x420 [ 559.163817][T18320] ? __fget_files+0x2a/0x420 [ 559.163838][T18320] ? __fget_files+0x3a0/0x420 [ 559.163861][T18320] ? __fget_files+0x2a/0x420 [ 559.163889][T18320] security_file_ioctl+0xc3/0x2a0 [ 559.163923][T18320] __se_sys_ioctl+0x47/0x170 [ 559.163948][T18320] do_syscall_64+0x14d/0xf80 [ 559.163975][T18320] ? trace_irq_disable+0x3b/0x150 [ 559.164002][T18320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.164022][T18320] ? clear_bhb_loop+0x40/0x90 [ 559.164047][T18320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.164067][T18320] RIP: 0033:0x7f224e79c629 [ 559.164087][T18320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.164104][T18320] RSP: 002b:00007f224f5d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 559.164126][T18320] RAX: ffffffffffffffda RBX: 00007f224ea15fa0 RCX: 00007f224e79c629 [ 559.164140][T18320] RDX: 00000000ffffffff RSI: 00000000400454ce RDI: 0000000000000004 [ 559.164154][T18320] RBP: 00007f224f5d2090 R08: 0000000000000000 R09: 0000000000000000 [ 559.164167][T18320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.164179][T18320] R13: 00007f224ea16038 R14: 00007f224ea15fa0 R15: 00007ffe75afd758 [ 559.164212][T18320] [ 559.412466][T18320] ERROR: Out of memory at tomoyo_realpath_from_path. [ 559.509286][T18325] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3654'. [ 559.532662][T18325] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3654'. [ 559.579445][T18325] FAULT_INJECTION: forcing a failure. [ 559.579445][T18325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.593383][T18325] CPU: 1 UID: 0 PID: 18325 Comm: syz.1.3654 Not tainted syzkaller #0 PREEMPT(full) [ 559.593411][T18325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 559.593423][T18325] Call Trace: [ 559.593430][T18325] [ 559.593438][T18325] dump_stack_lvl+0xe8/0x150 [ 559.593471][T18325] should_fail_ex+0x412/0x560 [ 559.593503][T18325] _copy_from_iter+0x1d3/0x1670 [ 559.593532][T18325] ? rcu_is_watching+0x15/0xb0 [ 559.593563][T18325] ? __pfx__copy_from_iter+0x10/0x10 [ 559.593595][T18325] ? netlink_sendmsg+0x650/0xb40 [ 559.593618][T18325] ? skb_put+0x11b/0x210 [ 559.593656][T18325] netlink_sendmsg+0x6c0/0xb40 [ 559.593689][T18325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.593716][T18325] ? aa_sock_msg_perm+0xf1/0x1b0 [ 559.593741][T18325] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 559.593763][T18325] ? __pfx_netlink_sendmsg+0x10/0x10 [ 559.593785][T18325] ____sys_sendmsg+0xa68/0xad0 [ 559.593823][T18325] ? __pfx_____sys_sendmsg+0x10/0x10 [ 559.593858][T18325] ? import_iovec+0x73/0xa0 [ 559.593888][T18325] ___sys_sendmsg+0x2a5/0x360 [ 559.593923][T18325] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.593985][T18325] ? __fget_files+0x2a/0x420 [ 559.594010][T18325] ? __fget_files+0x3a0/0x420 [ 559.594047][T18325] __x64_sys_sendmsg+0x1bd/0x2a0 [ 559.594076][T18325] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 559.594113][T18325] ? __pfx_ksys_write+0x10/0x10 [ 559.594146][T18325] do_syscall_64+0x14d/0xf80 [ 559.594173][T18325] ? trace_irq_disable+0x3b/0x150 [ 559.594200][T18325] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.594220][T18325] ? clear_bhb_loop+0x40/0x90 [ 559.594245][T18325] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.594264][T18325] RIP: 0033:0x7f578b39c629 [ 559.594283][T18325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.594299][T18325] RSP: 002b:00007f578c17b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.594321][T18325] RAX: ffffffffffffffda RBX: 00007f578b615fa0 RCX: 00007f578b39c629 [ 559.594335][T18325] RDX: 0000000000000844 RSI: 0000200000000040 RDI: 0000000000000004 [ 559.594348][T18325] RBP: 00007f578c17b090 R08: 0000000000000000 R09: 0000000000000000 [ 559.594360][T18325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.594372][T18325] R13: 00007f578b616038 R14: 00007f578b615fa0 R15: 00007ffc2a8ae6d8 [ 559.594403][T18325] [ 560.028892][T18341] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3659'. [ 560.096058][T18342] syzkaller0: entered promiscuous mode [ 560.101670][T18342] syzkaller0: entered allmulticast mode [ 562.120803][T18373] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3669'. [ 562.166895][T18373] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3669'. [ 562.378604][T18378] delete_channel: no stack [ 562.419435][T18381] vlan4: entered promiscuous mode [ 562.716519][T18356] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 562.744037][T18356] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 562.946350][T18395] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3674'. [ 562.978781][T18380] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3665'. [ 563.003772][T18380] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3665'. [ 563.161307][T18399] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3676'. [ 563.171571][ T1298] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 563.180864][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.188164][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.416488][T18407] syzkaller0: entered promiscuous mode [ 563.422285][T18407] syzkaller0: entered allmulticast mode [ 563.567758][T18418] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3681'. [ 563.638759][T18415] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3681'. [ 564.101082][T18424] siw: device registration error -23 [ 564.318697][T18429] netlink: 'syz.2.3685': attribute type 1 has an invalid length. [ 565.558427][T18429] workqueue: Failed to create a rescuer kthread for wq "bond18": -EINTR [ 565.738246][T18450] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3689'. [ 565.782772][T18450] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3689'. [ 566.046922][T18464] netlink: 'syz.0.3692': attribute type 13 has an invalid length. [ 566.061455][T18461] netlink: 'syz.4.3693': attribute type 1 has an invalid length. [ 566.124685][T18461] 8021q: adding VLAN 0 to HW filter on device bond30 [ 566.172470][T18470] bridge0: left allmulticast mode [ 566.578617][T18490] netlink: 'syz.3.3699': attribute type 1 has an invalid length. [ 566.820780][T18490] 8021q: adding VLAN 0 to HW filter on device bond21 [ 566.963392][T18497] netlink: 'syz.0.3702': attribute type 298 has an invalid length. [ 567.001892][T18502] netlink: 'syz.4.3703': attribute type 1 has an invalid length. [ 567.094058][T18502] 8021q: adding VLAN 0 to HW filter on device bond31 [ 567.101236][T18508] siw: device registration error -23 [ 567.147602][T18507] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 567.159057][T18507] bond31: (slave batadv0): making interface the new active one [ 567.168924][T18507] bond31: (slave batadv0): Enslaving as an active interface with an up link [ 567.513912][T18517] syzkaller1: entered promiscuous mode [ 567.519452][T18517] syzkaller1: entered allmulticast mode [ 567.680780][T18524] syzkaller1: entered promiscuous mode [ 567.699861][T18524] syzkaller1: entered allmulticast mode [ 567.910653][T18531] netlink: 'syz.4.3713': attribute type 1 has an invalid length. [ 567.941653][T18540] netlink: 'syz.3.3715': attribute type 1 has an invalid length. [ 567.949906][T18531] 8021q: adding VLAN 0 to HW filter on device bond32 [ 567.958638][T18538] syzkaller0: entered promiscuous mode [ 567.964826][T18538] syzkaller0: entered allmulticast mode [ 568.449445][T18540] 8021q: adding VLAN 0 to HW filter on device bond22 [ 568.472841][T18548] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 568.646541][T18550] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 568.707064][T18559] __nla_validate_parse: 7 callbacks suppressed [ 568.707086][T18559] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3721'. [ 568.780184][T18559] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3721'. [ 568.847343][T18564] netlink: 'syz.4.3723': attribute type 10 has an invalid length. [ 568.927955][T18565] netlink: 'syz.4.3723': attribute type 10 has an invalid length. [ 568.952493][T18564] bond0: (slave dummy0): Releasing backup interface [ 569.458551][T18564] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 569.492047][T18564] team0: Failed to send options change via netlink (err -105) [ 569.513668][T18564] team0: Port device dummy0 added [ 569.652680][T18565] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 569.675519][T18565] team0: Port device dummy0 removed [ 569.697389][T18565] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 569.780325][T18584] pimreg: entered allmulticast mode [ 569.795690][T18584] pimreg: left allmulticast mode [ 570.094272][T18589] syzkaller0: entered promiscuous mode [ 570.126840][T18589] syzkaller0: entered allmulticast mode [ 570.297635][T18591] smc: adding net device wlan0 with user defined pnetid SYZ0 [ 570.337153][T18594] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3729'. [ 570.536653][T18608] netlink: 11562 bytes leftover after parsing attributes in process `syz.4.3729'. [ 570.589917][T18603] netlink: 'syz.1.3733': attribute type 1 has an invalid length. [ 570.603379][T18610] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3735'. [ 570.660149][T18603] 8021q: adding VLAN 0 to HW filter on device bond17 [ 570.829298][T18590] smc: removing net device wlan0 with user defined pnetid SYZ0 [ 571.090756][T18620] sch_tbf: peakrate 11 is lower than or equals to rate 996173156578218475 ! [ 571.697216][T18645] syzkaller0: entered promiscuous mode [ 571.736726][T18645] syzkaller0: entered allmulticast mode [ 571.829222][T18656] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3747'. [ 572.293936][T18671] netlink: 'syz.1.3748': attribute type 1 has an invalid length. [ 572.404918][T18671] 8021q: adding VLAN 0 to HW filter on device bond18 [ 572.569757][T18676] syzkaller0: entered promiscuous mode [ 572.583932][T18676] syzkaller0: entered allmulticast mode [ 572.908326][T18697] syzkaller0: entered promiscuous mode [ 572.934085][T18697] syzkaller0: entered allmulticast mode [ 573.209699][T18711] pimreg: entered allmulticast mode [ 573.248733][T18714] pimreg: left allmulticast mode [ 573.387579][T18728] netlink: 'syz.4.3767': attribute type 13 has an invalid length. [ 573.482643][T18733] syzkaller0: entered promiscuous mode [ 573.513303][T18733] syzkaller0: entered allmulticast mode [ 573.713094][T18746] FAULT_INJECTION: forcing a failure. [ 573.713094][T18746] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 573.727304][T18741] syzkaller1: entered promiscuous mode [ 573.736150][T18741] syzkaller1: entered allmulticast mode [ 573.746035][T18746] CPU: 0 UID: 0 PID: 18746 Comm: syz.3.3769 Not tainted syzkaller #0 PREEMPT(full) [ 573.746062][T18746] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 573.746074][T18746] Call Trace: [ 573.746082][T18746] [ 573.746091][T18746] dump_stack_lvl+0xe8/0x150 [ 573.746136][T18746] should_fail_ex+0x412/0x560 [ 573.746165][T18746] _copy_from_iter+0x1d3/0x1670 [ 573.746191][T18746] ? unwind_next_frame+0xa5/0x23c0 [ 573.746225][T18746] ? __lock_acquire+0x6b5/0x2cf0 [ 573.746250][T18746] ? __pfx__copy_from_iter+0x10/0x10 [ 573.746290][T18746] tun_get_user+0x516/0x3dd0 [ 573.746326][T18746] ? aa_file_perm+0x12d/0x1630 [ 573.746354][T18746] ? aa_file_perm+0x440/0x1630 [ 573.746376][T18746] ? __pfx_tun_get_user+0x10/0x10 [ 573.746407][T18746] ? __lock_acquire+0x6b5/0x2cf0 [ 573.746438][T18746] ? ref_tracker_alloc+0x363/0x4d0 [ 573.746463][T18746] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 573.746492][T18746] ? tun_get+0x1c/0x2f0 [ 573.746520][T18746] ? tun_get+0x1c/0x2f0 [ 573.746543][T18746] ? tun_get+0x1c/0x2f0 [ 573.746570][T18746] tun_chr_write_iter+0x113/0x200 [ 573.746597][T18746] vfs_write+0x61d/0xb90 [ 573.746626][T18746] ? __pfx_vfs_write+0x10/0x10 [ 573.746655][T18746] ? __fget_files+0x2a/0x420 [ 573.746694][T18746] ksys_write+0x150/0x270 [ 573.746717][T18746] ? __pfx_ksys_write+0x10/0x10 [ 573.746747][T18746] do_syscall_64+0x14d/0xf80 [ 573.746772][T18746] ? trace_irq_disable+0x3b/0x150 [ 573.746797][T18746] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.746817][T18746] ? clear_bhb_loop+0x40/0x90 [ 573.746838][T18746] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.746857][T18746] RIP: 0033:0x7fc9b939c629 [ 573.746875][T18746] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.746891][T18746] RSP: 002b:00007fc9ba208028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 573.746913][T18746] RAX: ffffffffffffffda RBX: 00007fc9b9616090 RCX: 00007fc9b939c629 [ 573.746926][T18746] RDX: 000000000000fdef RSI: 0000200000000240 RDI: 0000000000000004 [ 573.746939][T18746] RBP: 00007fc9ba208090 R08: 0000000000000000 R09: 0000000000000000 [ 573.746951][T18746] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 573.746963][T18746] R13: 00007fc9b9616128 R14: 00007fc9b9616090 R15: 00007ffe15117918 [ 573.746995][T18746] [ 574.068671][T18751] netlink: 'syz.4.3770': attribute type 1 has an invalid length. [ 574.169874][T18751] 8021q: adding VLAN 0 to HW filter on device bond33 [ 574.184753][T18752] syzkaller0: entered promiscuous mode [ 574.190432][T18752] syzkaller0: entered allmulticast mode [ 575.220194][T18808] pimreg: entered allmulticast mode [ 575.227342][T18808] pimreg: left allmulticast mode [ 576.228334][T18732] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 576.443876][T18813] netlink: 'syz.2.3780': attribute type 13 has an invalid length. [ 576.470203][T18821] FAULT_INJECTION: forcing a failure. [ 576.470203][T18821] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 576.484234][T18821] CPU: 0 UID: 0 PID: 18821 Comm: syz.0.3784 Not tainted syzkaller #0 PREEMPT(full) [ 576.484261][T18821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 576.484274][T18821] Call Trace: [ 576.484282][T18821] [ 576.484290][T18821] dump_stack_lvl+0xe8/0x150 [ 576.484323][T18821] should_fail_ex+0x412/0x560 [ 576.484349][T18821] _copy_from_iter+0x1d3/0x1670 [ 576.484387][T18821] ? rcu_is_watching+0x15/0xb0 [ 576.484419][T18821] ? __pfx__copy_from_iter+0x10/0x10 [ 576.484452][T18821] ? netlink_sendmsg+0x650/0xb40 [ 576.484474][T18821] ? skb_put+0x11b/0x210 [ 576.484503][T18821] netlink_sendmsg+0x6c0/0xb40 [ 576.484535][T18821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 576.484562][T18821] ? aa_sock_msg_perm+0xf1/0x1b0 [ 576.484587][T18821] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 576.484609][T18821] ? __pfx_netlink_sendmsg+0x10/0x10 [ 576.484631][T18821] ____sys_sendmsg+0xa68/0xad0 [ 576.484668][T18821] ? __pfx_____sys_sendmsg+0x10/0x10 [ 576.484705][T18821] ? import_iovec+0x73/0xa0 [ 576.484734][T18821] ___sys_sendmsg+0x2a5/0x360 [ 576.484767][T18821] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.484829][T18821] ? __fget_files+0x2a/0x420 [ 576.484856][T18821] ? __fget_files+0x3a0/0x420 [ 576.484893][T18821] __x64_sys_sendmsg+0x1bd/0x2a0 [ 576.484923][T18821] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 576.484960][T18821] ? __pfx_ksys_write+0x10/0x10 [ 576.484992][T18821] do_syscall_64+0x14d/0xf80 [ 576.485019][T18821] ? trace_irq_disable+0x3b/0x150 [ 576.485046][T18821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.485065][T18821] ? clear_bhb_loop+0x40/0x90 [ 576.485090][T18821] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.485108][T18821] RIP: 0033:0x7fadd379c629 [ 576.485127][T18821] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.485143][T18821] RSP: 002b:00007fadd45de028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 576.485165][T18821] RAX: ffffffffffffffda RBX: 00007fadd3a15fa0 RCX: 00007fadd379c629 [ 576.485179][T18821] RDX: 0000000004008000 RSI: 0000200000000080 RDI: 0000000000000003 [ 576.485192][T18821] RBP: 00007fadd45de090 R08: 0000000000000000 R09: 0000000000000000 [ 576.485204][T18821] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 576.485217][T18821] R13: 00007fadd3a16038 R14: 00007fadd3a15fa0 R15: 00007ffd3c906568 [ 576.485249][T18821] [ 576.549036][T18823] FAULT_INJECTION: forcing a failure. [ 576.549036][T18823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 576.626763][T18825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3786'. [ 576.684391][T18823] CPU: 1 UID: 0 PID: 18823 Comm: syz.3.3781 Not tainted syzkaller #0 PREEMPT(full) [ 576.684421][T18823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 576.684434][T18823] Call Trace: [ 576.684443][T18823] [ 576.684452][T18823] dump_stack_lvl+0xe8/0x150 [ 576.684482][T18823] should_fail_ex+0x412/0x560 [ 576.684508][T18823] _copy_from_user+0x2d/0xb0 [ 576.684534][T18823] ___sys_sendmsg+0x1c6/0x360 [ 576.684565][T18823] ? __pfx____sys_sendmsg+0x10/0x10 [ 576.684623][T18823] ? __fget_files+0x2a/0x420 [ 576.684646][T18823] ? __fget_files+0x3a0/0x420 [ 576.684678][T18823] __x64_sys_sendmsg+0x1bd/0x2a0 [ 576.684705][T18823] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 576.684738][T18823] ? __pfx_ksys_write+0x10/0x10 [ 576.684773][T18823] do_syscall_64+0x14d/0xf80 [ 576.684798][T18823] ? trace_irq_disable+0x3b/0x150 [ 576.684822][T18823] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.684840][T18823] ? clear_bhb_loop+0x40/0x90 [ 576.684861][T18823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.684879][T18823] RIP: 0033:0x7fc9b939c629 [ 576.684897][T18823] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.684912][T18823] RSP: 002b:00007fc9ba1e7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 576.684932][T18823] RAX: ffffffffffffffda RBX: 00007fc9b9616180 RCX: 00007fc9b939c629 [ 576.684946][T18823] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000b [ 576.684957][T18823] RBP: 00007fc9ba1e7090 R08: 0000000000000000 R09: 0000000000000000 [ 576.684968][T18823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 576.684979][T18823] R13: 00007fc9b9616218 R14: 00007fc9b9616180 R15: 00007ffe15117918 [ 576.685008][T18823] [ 576.943287][T18825] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3786'. [ 577.042254][T18825] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for erspan1 [ 577.054231][T18825] erspan1: entered allmulticast mode [ 577.099731][T18834] veth0_virt_wifi: entered promiscuous mode [ 577.110701][T18834] veth0_virt_wifi: left promiscuous mode [ 577.455625][T18846] netlink: 'syz.3.3794': attribute type 11 has an invalid length. [ 577.482196][T18846] netlink: 'syz.3.3794': attribute type 11 has an invalid length. [ 577.498659][T18845] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 577.739658][T18858] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3798'. [ 577.768388][T18863] netlink: 'syz.1.3800': attribute type 2 has an invalid length. [ 577.900044][T18867] FAULT_INJECTION: forcing a failure. [ 577.900044][T18867] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 577.924081][T18867] CPU: 1 UID: 0 PID: 18867 Comm: syz.3.3801 Not tainted syzkaller #0 PREEMPT(full) [ 577.924111][T18867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 577.924123][T18867] Call Trace: [ 577.924131][T18867] [ 577.924140][T18867] dump_stack_lvl+0xe8/0x150 [ 577.924175][T18867] should_fail_ex+0x412/0x560 [ 577.924204][T18867] _copy_from_iter+0x1d3/0x1670 [ 577.924232][T18867] ? rcu_is_watching+0x15/0xb0 [ 577.924266][T18867] ? __pfx__copy_from_iter+0x10/0x10 [ 577.924300][T18867] ? netlink_sendmsg+0x650/0xb40 [ 577.924321][T18867] ? skb_put+0x11b/0x210 [ 577.924350][T18867] netlink_sendmsg+0x6c0/0xb40 [ 577.924383][T18867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 577.924411][T18867] ? aa_sock_msg_perm+0xf1/0x1b0 [ 577.924436][T18867] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 577.924459][T18867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 577.924481][T18867] ____sys_sendmsg+0xa68/0xad0 [ 577.924517][T18867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 577.924554][T18867] ? import_iovec+0x73/0xa0 [ 577.924581][T18867] ___sys_sendmsg+0x2a5/0x360 [ 577.924613][T18867] ? __pfx____sys_sendmsg+0x10/0x10 [ 577.924677][T18867] ? __fget_files+0x2a/0x420 [ 577.924704][T18867] ? __fget_files+0x3a0/0x420 [ 577.924742][T18867] __x64_sys_sendmsg+0x1bd/0x2a0 [ 577.924772][T18867] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 577.924810][T18867] ? __pfx_ksys_write+0x10/0x10 [ 577.924843][T18867] do_syscall_64+0x14d/0xf80 [ 577.924871][T18867] ? trace_irq_disable+0x3b/0x150 [ 577.924897][T18867] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.924917][T18867] ? clear_bhb_loop+0x40/0x90 [ 577.924942][T18867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.924960][T18867] RIP: 0033:0x7fc9b939c629 [ 577.924979][T18867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.924996][T18867] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 577.925019][T18867] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 577.925033][T18867] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 577.925046][T18867] RBP: 00007fc9ba229090 R08: 0000000000000000 R09: 0000000000000000 [ 577.925068][T18867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 577.925080][T18867] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 577.925112][T18867] [ 578.186238][T18847] ipvlan2: entered promiscuous mode [ 578.192767][T18847] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 578.201123][T18847] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 578.305337][T18873] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3804'. [ 578.346821][T18873] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 578.419746][T18879] netlink: 'syz.2.3807': attribute type 10 has an invalid length. [ 578.449855][T18873] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3804'. [ 578.477539][T18879] team0: Failed to send options change via netlink (err -105) [ 578.488034][T18879] team0: Port device dummy0 added [ 578.488764][T18882] netlink: 'syz.2.3807': attribute type 10 has an invalid length. [ 578.511458][T18882] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 578.574051][T18882] team0: Failed to send options change via netlink (err -105) [ 578.612316][T18882] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 578.646597][T18882] team0: Port device dummy0 removed [ 578.694848][T18881] syzkaller0: entered promiscuous mode [ 578.725561][T18881] syzkaller0: entered allmulticast mode [ 578.743027][T18894] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3809'. [ 579.261852][T18899] debugfs: 'netdev:nicvf0' already exists in 'phy6' [ 579.587546][T18921] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3819'. [ 580.174312][T18938] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3825'. [ 580.341342][T18945] netlink: 'syz.4.3827': attribute type 11 has an invalid length. [ 580.361691][T18945] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3827'. [ 580.620629][T18934] ipvlan2: entered promiscuous mode [ 580.661885][T18934] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 580.684084][T18934] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 580.914627][T18956] FAULT_INJECTION: forcing a failure. [ 580.914627][T18956] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 580.929078][T18956] CPU: 1 UID: 0 PID: 18956 Comm: syz.2.3830 Not tainted syzkaller #0 PREEMPT(full) [ 580.929106][T18956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 580.929118][T18956] Call Trace: [ 580.929126][T18956] [ 580.929136][T18956] dump_stack_lvl+0xe8/0x150 [ 580.929169][T18956] should_fail_ex+0x412/0x560 [ 580.929198][T18956] _copy_from_iter+0x1d3/0x1670 [ 580.929236][T18956] ? __pfx__copy_from_iter+0x10/0x10 [ 580.929258][T18956] ? sock_alloc_send_pskb+0x896/0x990 [ 580.929294][T18956] ? __pfx__copy_from_iter+0x10/0x10 [ 580.929330][T18956] ? page_copy_sane+0x16a/0x270 [ 580.929356][T18956] copy_page_from_iter+0xdd/0x170 [ 580.929386][T18956] skb_copy_datagram_from_iter+0x306/0x710 [ 580.929428][T18956] unix_stream_sendmsg+0x5f3/0xe80 [ 580.929470][T18956] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 580.929498][T18956] ? aa_sock_msg_perm+0xda/0x1b0 [ 580.929524][T18956] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 580.929547][T18956] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 580.929567][T18956] ____sys_sendmsg+0xa68/0xad0 [ 580.929605][T18956] ? __pfx_____sys_sendmsg+0x10/0x10 [ 580.929641][T18956] ? import_iovec+0x73/0xa0 [ 580.929671][T18956] ___sys_sendmsg+0x2a5/0x360 [ 580.929704][T18956] ? __pfx____sys_sendmsg+0x10/0x10 [ 580.929770][T18956] ? __fget_files+0x2a/0x420 [ 580.929797][T18956] ? __fget_files+0x3a0/0x420 [ 580.929835][T18956] __x64_sys_sendmsg+0x1bd/0x2a0 [ 580.929866][T18956] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 580.929905][T18956] ? __pfx_ksys_write+0x10/0x10 [ 580.929939][T18956] do_syscall_64+0x14d/0xf80 [ 580.929967][T18956] ? trace_irq_disable+0x3b/0x150 [ 580.929994][T18956] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.930014][T18956] ? clear_bhb_loop+0x40/0x90 [ 580.930038][T18956] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 580.930058][T18956] RIP: 0033:0x7f224e79c629 [ 580.930083][T18956] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 580.930101][T18956] RSP: 002b:00007f224f5d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 580.930124][T18956] RAX: ffffffffffffffda RBX: 00007f224ea15fa0 RCX: 00007f224e79c629 [ 580.930138][T18956] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 000000000000000a [ 580.930150][T18956] RBP: 00007f224f5d2090 R08: 0000000000000000 R09: 0000000000000000 [ 580.930162][T18956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 580.930174][T18956] R13: 00007f224ea16038 R14: 00007f224ea15fa0 R15: 00007ffe75afd758 [ 580.930207][T18956] [ 581.957383][T18970] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3837'. [ 581.987231][T18972] netlink: 'syz.2.3838': attribute type 8 has an invalid length. [ 581.997109][T18970] netlink: 'syz.1.3837': attribute type 298 has an invalid length. [ 582.017065][T18972] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3838'. [ 582.075130][T18972] macvtap1: entered promiscuous mode [ 582.094599][T18972] veth1_to_hsr: entered promiscuous mode [ 582.100534][T18972] macvtap1: entered allmulticast mode [ 582.140371][T18972] veth1_to_hsr: entered allmulticast mode [ 582.568485][T18977] lo speed is unknown, defaulting to 1000 [ 582.604692][T18977] wg1 speed is unknown, defaulting to 1000 [ 582.859158][T18992] veth0_virt_wifi: entered promiscuous mode [ 582.902730][T18992] veth0_virt_wifi: left promiscuous mode [ 583.340433][T19005] FAULT_INJECTION: forcing a failure. [ 583.340433][T19005] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 583.402760][T19005] CPU: 1 UID: 0 PID: 19005 Comm: syz.2.3848 Not tainted syzkaller #0 PREEMPT(full) [ 583.402790][T19005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 583.402802][T19005] Call Trace: [ 583.402811][T19005] [ 583.402821][T19005] dump_stack_lvl+0xe8/0x150 [ 583.402853][T19005] should_fail_ex+0x412/0x560 [ 583.402880][T19005] _copy_from_user+0x2d/0xb0 [ 583.402906][T19005] ___sys_sendmsg+0x1c6/0x360 [ 583.402941][T19005] ? __pfx____sys_sendmsg+0x10/0x10 [ 583.403003][T19005] ? __fget_files+0x2a/0x420 [ 583.403030][T19005] ? __fget_files+0x3a0/0x420 [ 583.403065][T19005] __x64_sys_sendmsg+0x1bd/0x2a0 [ 583.403096][T19005] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 583.403132][T19005] ? __pfx_ksys_write+0x10/0x10 [ 583.403164][T19005] do_syscall_64+0x14d/0xf80 [ 583.403189][T19005] ? trace_irq_disable+0x3b/0x150 [ 583.403213][T19005] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.403232][T19005] ? clear_bhb_loop+0x40/0x90 [ 583.403254][T19005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.403273][T19005] RIP: 0033:0x7f224e79c629 [ 583.403292][T19005] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 583.403308][T19005] RSP: 002b:00007f224f5b1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 583.403338][T19005] RAX: ffffffffffffffda RBX: 00007f224ea16090 RCX: 00007f224e79c629 [ 583.403351][T19005] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000007 [ 583.403363][T19005] RBP: 00007f224f5b1090 R08: 0000000000000000 R09: 0000000000000000 [ 583.403374][T19005] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 583.403385][T19005] R13: 00007f224ea16128 R14: 00007f224ea16090 R15: 00007ffe75afd758 [ 583.403416][T19005] [ 583.689095][T18981] lo speed is unknown, defaulting to 1000 [ 583.696877][T18981] wg1 speed is unknown, defaulting to 1000 [ 583.793701][T19007] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3849'. [ 583.852560][T19007] netlink: 'syz.0.3849': attribute type 298 has an invalid length. [ 584.306913][T19013] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3851'. [ 584.719045][T19025] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3855'. [ 584.746327][T19025] FAULT_INJECTION: forcing a failure. [ 584.746327][T19025] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 584.832100][T19025] CPU: 1 UID: 0 PID: 19025 Comm: syz.4.3855 Not tainted syzkaller #0 PREEMPT(full) [ 584.832129][T19025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 584.832142][T19025] Call Trace: [ 584.832150][T19025] [ 584.832160][T19025] dump_stack_lvl+0xe8/0x150 [ 584.832195][T19025] should_fail_ex+0x412/0x560 [ 584.832225][T19025] _copy_to_user+0x31/0xb0 [ 584.832266][T19025] simple_read_from_buffer+0xe1/0x170 [ 584.832299][T19025] proc_fail_nth_read+0x1bb/0x230 [ 584.832329][T19025] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 584.832360][T19025] ? rw_verify_area+0x2a6/0x4d0 [ 584.832379][T19025] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 584.832408][T19025] vfs_read+0x20c/0xa70 [ 584.832426][T19025] ? fdget_pos+0x246/0x320 [ 584.832460][T19025] ? __pfx___mutex_lock+0x10/0x10 [ 584.832489][T19025] ? __pfx_vfs_read+0x10/0x10 [ 584.832510][T19025] ? __fget_files+0x2a/0x420 [ 584.832541][T19025] ? __fget_files+0x3a0/0x420 [ 584.832565][T19025] ? __fget_files+0x2a/0x420 [ 584.832601][T19025] ksys_read+0x150/0x270 [ 584.832623][T19025] ? __pfx_ksys_read+0x10/0x10 [ 584.832656][T19025] do_syscall_64+0x14d/0xf80 [ 584.832684][T19025] ? trace_irq_disable+0x3b/0x150 [ 584.832712][T19025] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.832733][T19025] ? clear_bhb_loop+0x40/0x90 [ 584.832758][T19025] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 584.832778][T19025] RIP: 0033:0x7f73e795cece [ 584.832798][T19025] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 584.832815][T19025] RSP: 002b:00007f73e8915fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 584.832839][T19025] RAX: ffffffffffffffda RBX: 00007f73e89166c0 RCX: 00007f73e795cece [ 584.832853][T19025] RDX: 000000000000000f RSI: 00007f73e89160a0 RDI: 0000000000000005 [ 584.832866][T19025] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 584.832878][T19025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 584.832891][T19025] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 584.832925][T19025] [ 585.368311][T19037] syzkaller0: entered promiscuous mode [ 585.374973][T19037] syzkaller0: entered allmulticast mode [ 585.385679][T19037] netlink: 'syz.2.3859': attribute type 4 has an invalid length. [ 585.393471][T19037] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3859'. [ 585.417317][T19039] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3860'. [ 585.457093][T19039] netlink: 'syz.0.3860': attribute type 298 has an invalid length. [ 586.003370][T19058] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3868'. [ 586.046102][T19059] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3868'. [ 586.072310][T19057] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3866'. [ 586.164515][T19032] ipvlan2: entered promiscuous mode [ 586.175733][T19032] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 586.183302][T19032] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 586.388362][T19070] syz1: rxe_newlink: already configured on ipvlan0 [ 586.582789][T19081] pimreg: entered allmulticast mode [ 586.592861][T19081] pimreg: left allmulticast mode [ 586.761226][T19089] netlink: 'syz.4.3880': attribute type 3 has an invalid length. [ 587.238853][T19108] __nla_validate_parse: 6 callbacks suppressed [ 587.238874][T19108] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3887'. [ 587.692789][T19129] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.760689][T19095] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3884'. [ 587.764607][T19132] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.794251][T19095] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3884'. [ 587.857254][T19134] vlan1: entered allmulticast mode [ 587.889992][T19087] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3878'. [ 587.913986][T19087] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3878'. [ 587.942564][T19109] ipvlan2: entered promiscuous mode [ 587.955018][T19109] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 587.962394][T19109] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 587.996720][T19087] ipvlan2: entered promiscuous mode [ 588.002589][T19087] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 588.010312][T19087] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 588.078716][T19140] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3896'. [ 588.112780][T19140] netlink: 'syz.3.3896': attribute type 298 has an invalid length. [ 588.408188][T19155] SET target dimension over the limit! [ 588.419666][T19157] SET target dimension over the limit! [ 588.450557][T19152] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.555201][T19160] netlink: 'syz.3.3903': attribute type 10 has an invalid length. [ 588.591810][T19160] bond0: (slave dummy0): Releasing backup interface [ 588.618004][T19164] netlink: 'syz.3.3903': attribute type 10 has an invalid length. [ 588.652818][T19160] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 588.705026][T19160] team0: Failed to send options change via netlink (err -105) [ 588.712560][T19160] team0: Port device dummy0 added [ 588.731625][T19152] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.763233][T19164] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 588.811651][T19164] team0: Failed to send options change via netlink (err -105) [ 588.839810][T19164] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 588.866498][T19164] team0: Port device dummy0 removed [ 588.897494][T19164] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 588.946075][T19152] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.076456][T19152] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.195606][T19179] FAULT_INJECTION: forcing a failure. [ 589.195606][T19179] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 589.228971][T19179] CPU: 0 UID: 0 PID: 19179 Comm: syz.3.3910 Not tainted syzkaller #0 PREEMPT(full) [ 589.229000][T19179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 589.229013][T19179] Call Trace: [ 589.229022][T19179] [ 589.229031][T19179] dump_stack_lvl+0xe8/0x150 [ 589.229064][T19179] should_fail_ex+0x412/0x560 [ 589.229093][T19179] prepare_alloc_pages+0x22a/0x650 [ 589.229125][T19179] __alloc_frozen_pages_noprof+0x12f/0x380 [ 589.229153][T19179] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 589.229181][T19179] ? __pfx_policy_nodemask+0x10/0x10 [ 589.229218][T19179] ? __lock_acquire+0x6b5/0x2cf0 [ 589.229246][T19179] alloc_pages_mpol+0x232/0x4a0 [ 589.229277][T19179] vma_alloc_folio_noprof+0xea/0x210 [ 589.229304][T19179] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 589.229340][T19179] do_pte_missing+0x1656/0x3750 [ 589.229383][T19179] handle_mm_fault+0x1bec/0x3310 [ 589.229426][T19179] ? handle_mm_fault+0xee/0x3310 [ 589.229461][T19179] ? __pfx_handle_mm_fault+0x10/0x10 [ 589.229489][T19179] ? follow_page_pte+0x841/0x1450 [ 589.229527][T19179] ? __pfx_follow_page_pte+0x10/0x10 [ 589.229567][T19179] __get_user_pages+0x165b/0x29d0 [ 589.229627][T19179] __gup_longterm_locked+0xdcf/0x1630 [ 589.229668][T19179] ? sanity_check_pinned_pages+0x1212/0x12d0 [ 589.229703][T19179] gup_fast_fallback+0x1d82/0x22e0 [ 589.229765][T19179] ? __pfx_gup_fast_fallback+0x10/0x10 [ 589.229794][T19179] ? is_valid_gup_args+0x11f/0x200 [ 589.229823][T19179] ? pin_user_pages_fast+0x4d/0xb0 [ 589.229852][T19179] rds_info_getsockopt+0x20e/0x4a0 [ 589.229882][T19179] ? __pfx_rds_info_getsockopt+0x10/0x10 [ 589.229908][T19179] ? __might_fault+0xaf/0x130 [ 589.229940][T19179] ? rds_getsockopt+0x2e6/0x500 [ 589.229972][T19179] ? __pfx_rds_getsockopt+0x10/0x10 [ 589.230001][T19179] do_sock_getsockopt+0x2d3/0x3f0 [ 589.230033][T19179] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 589.230061][T19179] ? __fget_files+0x3a0/0x420 [ 589.230088][T19179] ? __fget_files+0x2a/0x420 [ 589.230122][T19179] __x64_sys_getsockopt+0x1a4/0x240 [ 589.230159][T19179] do_syscall_64+0x14d/0xf80 [ 589.230186][T19179] ? trace_irq_disable+0x3b/0x150 [ 589.230221][T19179] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.230241][T19179] ? clear_bhb_loop+0x40/0x90 [ 589.230266][T19179] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.230285][T19179] RIP: 0033:0x7fc9b939c629 [ 589.230305][T19179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.230321][T19179] RSP: 002b:00007fc9ba229028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 589.230343][T19179] RAX: ffffffffffffffda RBX: 00007fc9b9615fa0 RCX: 00007fc9b939c629 [ 589.230357][T19179] RDX: 0000000000002715 RSI: 0000200000000114 RDI: 000000000000000b [ 589.230370][T19179] RBP: 00007fc9ba229090 R08: 0000200000000000 R09: 0000000000000000 [ 589.230382][T19179] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000001 [ 589.230394][T19179] R13: 00007fc9b9616038 R14: 00007fc9b9615fa0 R15: 00007ffe15117918 [ 589.230427][T19179] [ 589.704447][T12087] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.724528][T12095] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.737261][T19168] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3907'. [ 589.759677][T12095] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.840557][T19168] ipvlan2: entered promiscuous mode [ 589.846528][T19168] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 589.855517][T19168] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 590.068852][T12095] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.094350][T19188] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3914'. [ 590.103457][T19188] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3914'. [ 590.332863][T19200] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3918'. [ 590.406920][T19200] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 590.606989][T19214] FAULT_INJECTION: forcing a failure. [ 590.606989][T19214] name failslab, interval 1, probability 0, space 0, times 0 [ 590.632035][T19214] CPU: 0 UID: 0 PID: 19214 Comm: syz.4.3920 Not tainted syzkaller #0 PREEMPT(full) [ 590.632067][T19214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 590.632080][T19214] Call Trace: [ 590.632089][T19214] [ 590.632098][T19214] dump_stack_lvl+0xe8/0x150 [ 590.632132][T19214] should_fail_ex+0x412/0x560 [ 590.632161][T19214] should_failslab+0xa8/0x100 [ 590.632188][T19214] __kmalloc_noprof+0xe8/0x760 [ 590.632207][T19214] ? ktime_get_coarse_real_ts64_mg+0x1c5/0x1e0 [ 590.632231][T19214] ? iter_file_splice_write+0x1d4/0x1100 [ 590.632265][T19214] iter_file_splice_write+0x1d4/0x1100 [ 590.632307][T19214] ? atime_needs_update+0x3ac/0x6d0 [ 590.632338][T19214] ? __pfx_iter_file_splice_write+0x10/0x10 [ 590.632387][T19214] ? __pfx_iter_file_splice_write+0x10/0x10 [ 590.632416][T19214] direct_splice_actor+0x101/0x160 [ 590.632448][T19214] splice_direct_to_actor+0x53a/0xc70 [ 590.632487][T19214] ? __pfx_direct_splice_actor+0x10/0x10 [ 590.632522][T19214] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 590.632549][T19214] ? get_pid_task+0x20/0x1f0 [ 590.632577][T19214] do_splice_direct+0x195/0x290 [ 590.632605][T19214] ? __pfx_do_splice_direct+0x10/0x10 [ 590.632632][T19214] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 590.632665][T19214] ? rw_verify_area+0x255/0x4d0 [ 590.632688][T19214] do_sendfile+0x535/0x7d0 [ 590.632721][T19214] ? __pfx_do_sendfile+0x10/0x10 [ 590.632745][T19214] ? __fget_files+0x3a0/0x420 [ 590.632781][T19214] __se_sys_sendfile64+0x144/0x1a0 [ 590.632809][T19214] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 590.632843][T19214] do_syscall_64+0x14d/0xf80 [ 590.632877][T19214] ? trace_irq_disable+0x3b/0x150 [ 590.632901][T19214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.632919][T19214] ? clear_bhb_loop+0x40/0x90 [ 590.632942][T19214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.632961][T19214] RIP: 0033:0x7f73e799c629 [ 590.632981][T19214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 590.632998][T19214] RSP: 002b:00007f73e8916028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 590.633020][T19214] RAX: ffffffffffffffda RBX: 00007f73e7c15fa0 RCX: 00007f73e799c629 [ 590.633034][T19214] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004 [ 590.633046][T19214] RBP: 00007f73e8916090 R08: 0000000000000000 R09: 0000000000000000 [ 590.633059][T19214] R10: 00000000f03a0005 R11: 0000000000000246 R12: 0000000000000002 [ 590.633071][T19214] R13: 00007f73e7c16038 R14: 00007f73e7c15fa0 R15: 00007fffc8b4efb8 [ 590.633110][T19214] [ 590.977795][T19213] macvtap1: entered promiscuous mode [ 590.983426][T19213] macvtap1: entered allmulticast mode [ 590.989442][T19213] team0: entered allmulticast mode [ 590.996875][T19213] team_slave_0: entered allmulticast mode [ 591.002646][T19213] team_slave_1: entered allmulticast mode [ 591.009853][T19213] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 591.219026][T19220] syzkaller0: entered promiscuous mode [ 591.236638][T19220] syzkaller0: entered allmulticast mode [ 591.700994][T19252] macvtap2: entered promiscuous mode [ 591.723583][T19252] team0: entered promiscuous mode [ 591.728683][T19252] team_slave_0: entered promiscuous mode [ 591.881617][T19252] team_slave_1: entered promiscuous mode [ 591.890801][T19252] macvtap2: entered allmulticast mode [ 591.926610][T19252] team0: entered allmulticast mode [ 591.973779][T19252] team_slave_0: entered allmulticast mode [ 591.979582][T19252] team_slave_1: entered allmulticast mode [ 592.037569][T19252] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 592.194139][T19270] SET target dimension over the limit! [ 592.310890][T19278] __nla_validate_parse: 8 callbacks suppressed [ 592.310914][T19278] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3941'. [ 592.332548][T19280] syzkaller1: entered promiscuous mode [ 592.338551][T19280] syzkaller1: entered allmulticast mode [ 592.407972][T19279] syzkaller0: entered promiscuous mode [ 592.428779][T19279] syzkaller0: entered allmulticast mode [ 592.437852][ T5835] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 592.787054][T19284] syzkaller0: entered promiscuous mode [ 592.792604][T19284] syzkaller0: entered allmulticast mode [ 592.898828][T19304] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3950'. [ 592.950345][T19307] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 593.162035][T19312] x_tables: unsorted underflow at hook 3 [ 594.516153][ T30] INFO: task kworker/1:1H:1744 blocked for more than 143 seconds. [ 594.524171][ T30] Not tainted syzkaller #0 [ 594.529228][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 594.538812][ T30] task:kworker/1:1H state:D stack:26520 pid:1744 tgid:1744 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 594.551169][ T30] Workqueue: kblockd blk_mq_requeue_work [ 594.557163][ T30] Call Trace: [ 594.560538][ T30] [ 594.563886][ T30] __schedule+0x1585/0x5340 [ 594.568929][ T30] ? do_raw_spin_lock+0x12b/0x2f0 [ 594.574412][ T30] ? __pfx___schedule+0x10/0x10 [ 594.579471][ T30] ? schedule+0x90/0x360 [ 594.583965][ T30] schedule+0x164/0x360 [ 594.588176][ T30] schedule_timeout+0x158/0x2c0 [ 594.593224][ T30] ? __pfx_schedule_timeout+0x10/0x10 [ 594.599188][ T30] ? __pfx_process_timeout+0x10/0x10 [ 594.604552][ T30] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 594.610363][ T30] ? prepare_to_wait_event+0x436/0x480 [ 594.616441][ T30] nbd_queue_rq+0x857/0x1100 [ 594.621070][ T30] ? __pfx_nbd_queue_rq+0x10/0x10 [ 594.626275][ T30] ? __pfx_autoremove_wake_function+0x10/0x10 [ 594.632396][ T30] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 594.638392][ T30] ? sbitmap_get+0x229/0x390 [ 594.644545][ T30] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 594.650575][ T30] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 594.656699][ T30] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 594.663150][ T30] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 594.670038][ T30] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 594.676293][ T30] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 594.681597][ T30] blk_mq_run_hw_queue+0x348/0x4f0 [ 594.687275][ T30] blk_mq_run_hw_queues+0x26c/0x3f0 [ 594.692529][ T30] blk_mq_requeue_work+0x71c/0x780 [ 594.698024][ T30] ? __pfx_blk_mq_requeue_work+0x10/0x10 [ 594.703814][ T30] ? process_scheduled_works+0xa25/0x1830 [ 594.709579][ T30] ? process_scheduled_works+0xa25/0x1830 [ 594.715960][ T30] process_scheduled_works+0xb02/0x1830 [ 594.721736][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 594.727802][ T30] ? assign_work+0x3d5/0x5e0 [ 594.732436][ T30] worker_thread+0xa50/0xfc0 [ 594.737408][ T30] kthread+0x388/0x470 [ 594.741483][ T30] ? __pfx_worker_thread+0x10/0x10 [ 594.746637][ T30] ? __pfx_kthread+0x10/0x10 [ 594.751328][ T30] ret_from_fork+0x51e/0xb90 [ 594.756537][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 594.761698][ T30] ? __switch_to+0xc7d/0x1450 [ 594.766439][ T30] ? __pfx_kthread+0x10/0x10 [ 594.771059][ T30] ret_from_fork_asm+0x1a/0x30 [ 594.776300][ T30] [ 594.782259][ T30] [ 594.782259][ T30] Showing all locks held in the system: [ 594.790767][ T30] 1 lock held by khungtaskd/30: [ 594.796887][ T30] #0: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 594.807454][ T30] 4 locks held by kworker/1:1H/1744: [ 594.812746][ T30] #0: ffff88801e2b2148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 594.826955][ T30] #1: ffffc900058afc40 ((work_completion)(&(&q->requeue_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 594.840251][ T30] #2: ffff88802672a218 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 594.850071][ T30] #3: ffff8880270d0780 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc6/0x1100 [ 594.859224][ T30] 2 locks held by getty/5579: [ 594.864347][ T30] #0: ffff8880370a00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 594.874370][ T30] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 594.885236][ T30] 1 lock held by udevd/6634: [ 594.889917][ T30] #0: ffff888026be3358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 594.899254][ T30] 3 locks held by kworker/u8:10/12086: [ 594.905458][ T30] #0: ffff888031e1a148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 594.918567][ T30] #1: ffffc9000545fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 594.931666][ T30] #2: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 [ 594.942980][ T30] 3 locks held by kworker/u8:19/12095: [ 594.948750][ T30] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 594.960963][ T30] #1: ffffc90004f9fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 594.972502][ T30] #2: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 594.981561][ T30] 2 locks held by syz.2.3944/19283: [ 594.987986][ T30] #0: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 594.997168][ T30] #1: ffffffff8e766578 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 [ 595.008350][ T30] 2 locks held by syz.4.3949/19302: [ 595.013642][ T30] #0: ffffffff8fbbcff0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 [ 595.023089][ T30] #1: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 [ 595.034995][ T30] 1 lock held by syz.0.3950/19303: [ 595.040145][ T30] #0: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 595.052378][ T30] 2 locks held by syz.0.3950/19304: [ 595.057763][ T30] #0: ffffffff9011b3c8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 595.067443][ T30] #1: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 595.077217][ T30] 2 locks held by syz.3.3954/19315: [ 595.082528][ T30] #0: ffff88808290f6f0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 [ 595.092968][ T30] #1: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 595.102029][ T30] 1 lock held by syz.1.3955/19316: [ 595.107232][ T30] #0: ffffffff8fbcb808 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 595.116459][ T30] [ 595.118834][ T30] ============================================= [ 595.118834][ T30] [ 595.136000][ T30] NMI backtrace for cpu 0 [ 595.136024][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 595.136047][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 595.136058][ T30] Call Trace: [ 595.136066][ T30] [ 595.136075][ T30] dump_stack_lvl+0xe8/0x150 [ 595.136109][ T30] nmi_cpu_backtrace+0x274/0x2d0 [ 595.136133][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 595.136160][ T30] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 595.136187][ T30] sys_info+0x135/0x170 [ 595.136206][ T30] watchdog+0xfd9/0x1030 [ 595.136240][ T30] ? watchdog+0x21a/0x1030 [ 595.136276][ T30] kthread+0x388/0x470 [ 595.136296][ T30] ? __pfx_watchdog+0x10/0x10 [ 595.136322][ T30] ? __pfx_kthread+0x10/0x10 [ 595.136340][ T30] ret_from_fork+0x51e/0xb90 [ 595.136368][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 595.136390][ T30] ? __switch_to+0xc7d/0x1450 [ 595.136411][ T30] ? __pfx_kthread+0x10/0x10 [ 595.136429][ T30] ret_from_fork_asm+0x1a/0x30 [ 595.136472][ T30] [ 595.136479][ T30] Sending NMI from CPU 0 to CPUs 1: [ 595.248153][ C1] NMI backtrace for cpu 1 [ 595.248173][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 595.248192][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 595.248202][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 595.248229][ C1] Code: 8e 6d 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 4d 1c 00 fb f4 7c ea 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 595.248244][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242 [ 595.248259][ C1] RAX: 000000000012ecd3 RBX: ffffffff819a80dd RCX: 0000000080000001 [ 595.248272][ C1] RDX: 0000000000000001 RSI: ffffffff8def18d2 RDI: ffffffff8c27a480 [ 595.248283][ C1] RBP: ffffc90000197f10 R08: ffff8880b873395b R09: 1ffff110170e672b [ 595.248294][ C1] R10: dffffc0000000000 R11: ffffed10170e672c R12: ffffffff901172b0 [ 595.248305][ C1] R13: 1ffff11003b5b000 R14: 0000000000000001 R15: 0000000000000001 [ 595.248316][ C1] FS: 0000000000000000(0000) GS:ffff888125566000(0000) knlGS:0000000000000000 [ 595.248329][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 595.248340][ C1] CR2: 000000110c331590 CR3: 000000007d71a000 CR4: 00000000003526f0 [ 595.248357][ C1] Call Trace: [ 595.248365][ C1] [ 595.248371][ C1] default_idle+0x9/0x20 [ 595.248387][ C1] default_idle_call+0x72/0xb0 [ 595.248404][ C1] do_idle+0x1bd/0x500 [ 595.248423][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 595.248443][ C1] ? __pfx_do_idle+0x10/0x10 [ 595.248467][ C1] cpu_startup_entry+0x43/0x60 [ 595.248486][ C1] start_secondary+0x101/0x110 [ 595.248504][ C1] common_startup_64+0x13e/0x147 [ 595.248527][ C1] [ 595.416302][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 595.423191][ T30] CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 595.432329][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 595.442391][ T30] Call Trace: [ 595.445673][ T30] [ 595.448611][ T30] vpanic+0x56c/0xa60 [ 595.452616][ T30] ? __pfx___schedule+0x10/0x10 [ 595.457486][ T30] ? __pfx_vpanic+0x10/0x10 [ 595.462038][ T30] ? __pfx_console_unlock+0x10/0x10 [ 595.467253][ T30] panic+0xc5/0xd0 [ 595.470991][ T30] ? __pfx_panic+0x10/0x10 [ 595.475434][ T30] ? preempt_schedule_thunk+0x16/0x30 [ 595.480863][ T30] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 595.487067][ T30] watchdog+0x1023/0x1030 [ 595.491528][ T30] ? watchdog+0x21a/0x1030 [ 595.495967][ T30] kthread+0x388/0x470 [ 595.500043][ T30] ? __pfx_watchdog+0x10/0x10 [ 595.504727][ T30] ? __pfx_kthread+0x10/0x10 [ 595.509320][ T30] ret_from_fork+0x51e/0xb90 [ 595.513927][ T30] ? __pfx_ret_from_fork+0x10/0x10 [ 595.519045][ T30] ? __switch_to+0xc7d/0x1450 [ 595.523740][ T30] ? __pfx_kthread+0x10/0x10 [ 595.528347][ T30] ret_from_fork_asm+0x1a/0x30 [ 595.533227][ T30] [ 595.536778][ T30] Kernel Offset: disabled [ 595.541193][ T30] Rebooting in 86400 seconds..