last executing test programs: 4.167467952s ago: executing program 2 (id=11169): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000040), &(0x7f00000004c0)=@tcp6=r0}, 0x20) sendmmsg$inet6(r0, &(0x7f0000002000)=[{{0x0, 0x0, 0x0}}], 0x5e, 0x40) (fail_nth: 83) 3.859034047s ago: executing program 2 (id=11173): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5000940e, &(0x7f0000000bc0)={{r1}, "34badba1240bf3a0ca733fd6b81a6bedace04fff1c0f23204a69e2394815522f23472cb7017b2d47806da4b58d2f9f24371781de556ba6107bab17b6e02ec519463e315bb17cb53febebdedeede694cfc4d8d4f853f69a952478ce4ac3be2ec6edd5f35d86b8ded4c10e1900b0f75f16559bef46003bc301fc9ed40b05a2b3d6467b71d690785be162b0368ca7badd5adde81a04584207ca907ea0bb45bc5718a720ee52b6e0a4d8ad2cb130c0d72a4c09a8350c34c5cf93259b9bc48ea8f4fe573ed15412d116dbb10df746f30f41fe64cb26ae6c301fb432375910d45bae0ea69933e4c04898e695d1e41a6968d3fedfa2f9b77dee3ae381e76531aa72307e28d8383d8b59836163695d54337edf6d1dcd6383a3157c1805e530dee6c82f0a933476a593fdfc97ae15b9acc4f82ab4500337f19bb5450f3809eb968f6271d91b409a6fbce48bf85b41ae94ad0f96e938ce7a83745ea3e3ac4bf851beb5f138030217658a3392901ee0d534b9161f37bc94ac098fd0dc662b737be3bbd87f8ea6b10ac3ef69ccaf62e7bd810d5fbc74027d7cce54ab4741b2fec26a70b5bb21f25128378f82fdb5a0038bc4626a6a6e41bda90f6c2911b6d2ff5fb10a7c1f6548ee88ce5c19f8deb1c92404d7a5b052439a0564214bf4172e13f3aafbda8cea2b18fc18f4ea1b0c92289401e79542912637169050ef99fc89c7b04213df10a64ef81022d32692351f88fca900fc768eb79876d5e13b2e49b17f3330dcc3279dd88cf14b44c34f1ec548f9bd0084e6d7528ab3c26a2a0931ebc4320120a81420e86013cb034d0e1f19ab10a9a4dd6336e9578ca1e727e9d8b73a0b52e17494cba413709f8f68ff6d57ec22b16c29a29e1953023475ae54dcf900191d4a0b45427fe94bae84bd185cd3d02808135afdb7a6278f5f2e9679475b7a9d9eafd37902b334d82e4b0aeb322c90dcaf50058480fac7497b2e2a17212e6e4e4f8290315743351a30c74afed2c5ebff10a869937500373589091f1af57d85d52aa68b7cf7ceb57195dc7d2c56c7659f9a64d8346ad3451c555bfbb4ac8a33e3dabe3faee9b11489cd70f5c846283bf8701a3d2c194e840545e7a2bab7d1bb4d8a51f4fbcecc89ed89a7f717e057a9c6273f1ec18c68fe3b5d7c637881561f58ce18af928c71856f740a03109e02cfdf9b6af4a7f3c2e21890ba3d3190077edcbb1bd55c8c0f229517fb6b894c42158e3ed1c1e1b198079713b40b80045388cb087a9b3435d38ff89531714502f2b2addd1575bf9646b7dae763cacd5066be66b86a843418f740974b43b98ed4890a0e4bad46bcb2d12eb74d8ceeee987e25e29a64423d8782112cd4aec0bb360103a30865a2c8edecf03eaa00a3b1294640cebbe827f739260bfb24f2d6ce7cdc3a06e38a63007f744a83c64124bede5589cf0f4f1ffa27bbfb7dacd758b155b016f7454528adefa75a23f5f682ab9a4688ec02ec39a37408d753615edf816b81f6bf253002463e68d1ed0ed49b0e46f34a53c201cc08eda464172f47976f0aaaea2140635a40b9c48716c063a3ff9a66b212f37b7a9af5ebd304ebb74c7351190328dcb79263132486f776532ab53acc76456b01f85eba3e8953dbd70329464d4c45cb8d617386c0865163bf3ba331c724b4ce862a95a8f65a82de3572e9e6fc77680b95ceba1d7083e27f732d92460f945cf0c0411160c642cd47b58c5c4685a0d74ec407e056da8446a282039db4371b21ee13abe548d7389ec368190084fa6f48e215e5df9e61b56a2aba6c1e2af779d8b6b60466b4b34d78cfd02d56ea6f31392014d4a0f4ee0577abd6ef79e0c3fe6579d6767ff124c28aeb40f45570864599946b7faea4ac3d605d8079d4fef1562166b0adf914f3d967ca8b01f2d5ac92e5b79b3637dc32c0b9722bfc44fa3d8dc5df7f1144f2cd4d5487b52bea28d55e232c30a794e87af119eb8d7104450c668e7ad1b260309c120f9e6d6b0a0ce3929d8589c385c6b879e7cf3e4f857f66a61b5e7b1feee40c30fb5b66d0d9a501a7c01ec22d1d578a0eeb3d1c6702f164d83383e0f25aca3f059bddeafc7ad45b9dd22db2a2f2aa685d5581533690afce50a952eaf83db4e5d31a7814c8059067e4f83763d3412bffb220018e356967436127b36649fed6def900ade34841a73405c586fc73b638e26b9a05bebec5d41051cc9d62525b22061bd9266c92267ae36706ca1c9f646be2636c8b8ff11e9bb0540082bc63b9d4afa76253334ff6b039f839abcab12c6e5f779fa9ee49e0475f7ca234d6955ef2d7af6d91cadd51f41035d30a082c01eb4cf1434b0961c630b1c1611066d41b9dc0cd5278cb0fdd853bcb8bbf7c18f1c9018a20e4397cb2fd5736549f5292b0292bd0a92f67ad5a2f6a88e67eb8bcd8b26b22f05fff666a4058139a3b995c23092b8efaa2898fb81bf48db5eb1644057f50377bee079f36464aa109d426105c3134bb382d857c7ddefc141c36b35d7efe3b3736d9b3b7f9cdb51cb37f61f87c388682905574781b65dfab6cbd8121676f5ac17873db768f503c91f685c70ed47c7aafb250911a044a75e7a090a543a936a74dbd5b290a465d9505551a7501e83ba48026d4a58f76180af93616689b021b8919d21dbf527aed2a12aef0af3165dfbbd84670d644344f79989cb609778a4cf84e5b448143bd14f376aeaa81871e26aed7dc83405ed14c764a56cd901578c8db202bd3f29f0dcedc5d323c6c762ce4a36954abe52c515e903ceeefd6896ee3eae542d52baba898bc2f676590fdaea6ffc0a9a68bea8e409f7b40cbe32e459dfa447a88138dd4c4828307879d7774a29160d5e95a12ac1ad9e8269298abd715aa1b8a767d0afce38417729756a1418a2f36939da98d5cfa74753a75ac7e50064771bfacbc7669803e122f4dafdceba674f59e626f554aeaee0fbfa827bab83cd9d031058622cad39a1f398a89e3f78f09c1c5d2232f9aae418e3cb9eeb72de7eec482b40a0ef7b97a32ad9d606672e01489c7b66600f9aef3ef98ab636669474a56dd042f9c1944a14536ff0965999168d274c8d6a7bea17cfa40cb49e5f300891a636b755efa82a177cc123149ea27703e735f23e85046c61608fded98e48c5c431342f5c573b1db3271c585347c459357760db27ca0b9cd8f3a6f9292e8fb98420cb207511b3f01008ba79ffecb056b4dbc4597f01310900d42839f8f40762cb1440f650c0f03512e88792449d502e5534af224d739676c6b962b532e53adad2095920314cdb40e0fb1d4d2cf887c954113493c75925d0df4fd4592b55b3bddf0e4a602a69c958bf7e4e5b883ebecf811fdb6820300c6e7b655ede708e132c63f9b78891dfc4fcbf40d9db16aefb36a7f1af62c2574d664e6ef2ebec7d6cca18cfda22cf5513640e9755fb938e2e3f7fda66f1f34e68f2c41d6db43b29b41de262e9ed31d0454a6d115b6cc32219880b0ef08fbeb77057cd88d34ae33647341425b33b19dd67b587506b82e5378a064a2b3ea872915ec4978e97a3c10817594ef9cf8516f91932f7c39bbf7b1b897d275c64c11d99e918a57ce1bbc17c7a7269620aee5a4bfef6dc24aaef9cc74e4e0815d2a3bb76b9f3f3f1e5e03932cc0e72828759dcc70f697d3d1272801d5536e56c6207d92546c304fda9402186c83c00fc927d7113915e0147b9bbc0757ec9bb3da3eb8aec0757db28a7c919099960782877bc17fe785de5a4eab8e2893106859dc4405e61771c5056aba1c027136242a2cd76d96a6b3e893349e0aaa6e4bc140ef6cf877df3f45ff929c1a7174bcb429022c91e90781ae66cb60bf3a41a403a4f852cd6dcc46e3e28a036df9190f5c0365f917f3a4f1382975ee9b201479fd08f8c134ab4bca6af0206a1f989bc2f642a7e386a16eb6327f77f2dfd6a2e94709b7729f0f110d8e704783a1ebb141b136e13bab0c5c3f08566aff64a73f37e599f5439736eb850576c03847de58d027f3c353efaf6846d1b105a49280d8bf185e35dbf13e853d86d14364b911fd6e957a09ce7298d2566dbbf67993ce1ed8d07d556118ea21c92223981a2afd7d849ee0c2404bc8b212a3052baec566927eea5275ac52fae653f17485a2dae2d54030feece059d39b258077d93c89a47e06783873684c00f3b3a7e6d9c65366e54c3ba5e7f212950c6a3729e54b20055e6cceb1df853092b0ef380453b268a06d08e49e1d816fcabd973bf0803c6e5dad848e76fa921f8cc908d8275834b571ecb605fbab24b685e18cb4df50d9a2027b93bf9cb2c7176d319bf7085bbba47a17810f75a78a8fa364b7dfa32614b6c28332f2a13fdd262311d817968b1832c91a807941cca6e06eb143fb0c2fee8bbf7ebd72dbdd4a7c059cb2beba2b41b413f56daeb456874b83d1b4bac08d3b1571a8cfe35bc71ba710295cae3bd6b3915a75446ef02c3b05d7da8f8b6dd192e69ee15e05fb0afef7b668f252c2642f41f2267aa712c81278c3f17e27c39bada4b0354397f71f6972ae40cb745a0bdc55f6273f16415f4b798515d4c8228196cdab52810016e4a0a1d30b8a1dc1a676dbb99b65ef562ca00518188e4a87b0e2dbfbb1d661c1e22267863c839ca5aa9c3fdf94d1aeba4d6728c53fb29c0cc663de24bcaef6f567a49b96c5268b467c6a4b17be2fbcc2c943b01feee001c3691af5e61f1a2507c775f85bea479a69a6940ed0d1df35579b56d0cb1549028d84263847421889720300512c381c341b764e86278274001abe64ecebbbce3236ad0a1757fd3c776626f6975c905f2401442e27c6b35a06c5977227034f32b2183a3b5ad0925bde6434c471f15ddf054ca519703e6e0852c94ef9ae60fc39a35766f7af1ab13ed8ddeeba50fd0078506b2755bea11ecbbea0c591014404ad866bd49faa73cef8bd6ba277369b4e38f7603dac934b30f061c3562f6853e6ae9048706bdd6d3885b864027f9bec6c0903cf298ac5b13ce2d44ea13cf603acbcfa76e23441bee50c0a222299671c79e69975d319c9c471f853dee77a39a801fc5071919c70a9838ce19c48fad6610f27e45575d1bb62ee04b842883640b6f225381ba614f2bb54605630e9bae29ad4ed715ac13a9825fd48133496b98632b8ecfb85f5185002ba4111b2e1d5d11d86b3d78df152852fd80cb21ff0b699fb146f024b16faf0aaf9a5fb45a2be9639dc67c93e316d0575510b9cab0b1432223458eb343a31d8eefce1e33013cbff4a13bbf4ce981b0ba48860f32f64393d22b2bb38dda63dc66771022785bc6da22ba0b2e85d1e65fa1fb73de8e9a6a84f102adaa5c9f2234a75a935ec6bc14ee5d0453871f478b25e04e7e09880777a428d6a94cc9f7dce3bfbf5d3d9f4b713ea36ce21170652372a69fdfb4e696d9c1e7cf041091a0ca0c51b46710e387e884e44321ebef6e76c560c0f73e20e3c4d12eef059ae943851cd6c3950c59b65f0bd7c398fcae3b7e6f4868d021aa3971180214d70fa37bda05f54d3f43d7bd832504c59443278f0402f0e327604daf692f5c0fd887640a8e738a54afe147994e8128442afd9a9e024cac28a2ffc979c7389ab83def44d6469b5488eda7d9fac5c416b3e69746282c1585b63fcfca29400b7ba1845f1a2d9b07208e1ffc61925fb95cd82d7bd7c0ccd047ac178c7bef8e471f25e53ca239879358c7b95a11cae1799adf02f264be26262b97efcfe3b656fafe20ae88fd7ec27cd0f43c0bd873ac8784305bafff4f43c6f59c7b3749f86b958eee355"}) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x110, 0xc8, 0x8, 0x110, 0x5803, 0x238, 0x2e8, 0x2e8, 0x238, 0x2e8, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0x110, 0x0, {0x0, 0x2000000000000}}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x11, 0x2, 0xdc1, 0x7, 'syz1\x00', 'syz1\x00', {0x9}}}}, {{@ipv6={@remote, @remote, [0x0, 0x0, 0xffffff00, 0xffffffff], [0xff000000, 0xff, 0xffffffff, 0xff000000], 'veth1_to_bond\x00', 'geneve1\x00', {0xff}, {}, 0x0, 0x0, 0x2, 0x70}, 0x0, 0x108, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x9}}, @common=@unspec=@quota={{0x38}, {0x1, 0x0, 0x2, {0x846}}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r2, &(0x7f00000005c0)={0x1f, 0x0, @none, 0x4}, 0xe) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000240)={0x1f, 0x20, @none, 0xc, 0x1}, 0xe) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) sendmsg$NFC_CMD_START_POLL(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x14, r4, 0x1, 0x123, 0x234}, 0x14}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x7, 0x4, 0x100, 0x4, 0x24}, 0x50) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r5, 0x0, 0x60, &(0x7f0000001a40)={'filter\x00', 0x7, 0x4, 0x3c8, 0x0, 0x110, 0x1f8, 0x2e0, 0x2e0, 0x2e0, 0x8000000, 0x0, {[{{@arp={@dev={0xac, 0x14, 0x14, 0x1}, @remote, 0xff, 0x0, 0x3, 0x9, {@mac=@remote, {[0x0, 0xff, 0xff, 0xff, 0xff, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0xff]}}, 0x0, 0x401, 0x6, 0x0, 0x400, 0x8, 'geneve0\x00', 'veth1_virt_wifi\x00', {0xff}, {}, 0x0, 0x8b999478824e41}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @private=0xa010102, 0x4}}}, {{@arp={@loopback, @private=0xa010101, 0xff000000, 0xff, 0xe, 0x1, {@empty, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@broadcast, {[0x0, 0xff, 0xff, 0xff, 0xff, 0xff]}}, 0x3ff, 0x28, 0x8000, 0x5, 0xffff, 0x48a3, 'xfrm0\x00', 'dvmrp1\x00', {}, {0xff}, 0x0, 0xc0}, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x2, 0x5, 0x1}}}, {{@arp={@rand_addr=0x64010101, @broadcast, 0xff, 0xff, 0x9, 0x7, {@empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, {@mac=@remote, {[0x0, 0xff, 0xff, 0x0, 0x0, 0xff]}}, 0x2, 0x39, 0x3137, 0x3, 0x1, 0x2, 'veth0\x00', 'batadv0\x00', {0xff}, {}, 0x0, 0xa}, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x6, 0x4}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r7, 0x12, 0x3, &(0x7f0000000100)=0x23, 0x4) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv4_newaddr={0x38, 0x14, 0x509, 0x70bd2c, 0xfffffffd, {0x2, 0x18, 0x0, 0xfe, r6}, [@IFA_ADDRESS={0x8, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IFA_ADDRESS={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1a}}, @IFA_BROADCAST={0x8, 0x4, @multicast1}, @IFA_LOCAL={0x8, 0x2, @broadcast}]}, 0x38}, 0x1, 0x0, 0x0, 0x871ac4b30833d133}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x70}}, 0x20008084) 3.604343497s ago: executing program 2 (id=11178): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0xa, 0x2400000001, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) unshare(0x22020400) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x4008054) write$nci(r1, &(0x7f0000000300)=@NCI_GID_PROPRIETARY_NFT={0xf, 0x0, 0x3, 0x0, 0x1, "d3"}, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r7, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000780)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000005000000003a00000008000300", @ANYRES32=r11, @ANYBLOB="05005b"], 0x24}}, 0x0) sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x48, r7, 0x2, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x0, 0xd}}}}, [@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1d6}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1db3}]}, 0x48}, 0x1, 0x0, 0x0, 0x30008000}, 0x4008840) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1100000004000000040000000200000010000000", @ANYRES32=0x1, @ANYBLOB="fcffffff000000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) socket$kcm(0x10, 0x400000002, 0x0) socket$packet(0x11, 0x3, 0x300) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000f00)=ANY=[@ANYBLOB="b702000002000000bfa30000000000000703000000feffff7a0af0fff8bffffd79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000081007d60b7030000000000006a0a00fefdff0000850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465c3a1f59916ffc9bf0bd09279c362f80e5cf8df265e1b40e4c8ae7a89cf8bd819b5c0c000000008da68076774bb4db2c769937000090af27db5b56024dcbbbd2cb2000ce94284673b4e8d5467e357754508535766c801100000000b290a248a120c9c6e39f3052aae80677eeba68562eaeaea5fecf298ca20f274233106e2baf69b1c60f0ce4099f366b89ab63ecf772de7b265040b6b1acbef92b2704550a4d1dd5c50b7420b58a93fe94c756008afcd0b2eb785632e0a85f02a5a6474ae549070000000000001294fba0ed5020e6477cc921fee1f6d8ad6a80d0947cd6d4a561ced23b0b4a902be6af7ec2d1ba000057f301000000000000000000000000100000aaf253886c0b9f6d4731d714ad72e5ad8530a6380ed2d29f47f96a576cd20cef7ed95157ab050000f0077e9d13d8b93eb0f2c6f8941e35e1577c10e509c9b133c849eb709df5c6ba73cccdfa3c58bc5204339b0b487f0eeed581cb202900000d322717c338033213c18a34ee0ca2cf61efb4b3797a642735d6d482ba98d252f36c54333aab1aa736369392239820f5f1557b0bf7ccb0a5a13c714e0b1a5bc3f9caff3283076cda3d0b1a2905cf7bd04f2db530abcbe44bc40528ad807970727fb819afa14aad99f93093ced7dd51995edcf53b907228fa9e83433eedb4ac88d0285594ffb0d14e71d5c57f33702f22b22417bfb38d04c8441ceec8bcaffbe800aa41307bd8325a76f395bc9a8b0c9d905979f34adddb521914f92eed3d3e9de82942a952e86bd67aff5bc2e3c1fcc00f61124dd06df4b8fd356cb365adc037e443820c05c5db160087a9cf471e0eff227f25b2c5cacebfcd55f8c81f5eb1f8d615ca27efb2193bb61665b8ce37f30c2efc9c3b5a4a5d95479fac471ba60fbd0e50223517a07a3484124c5563cd3700000000001825b05a580ea8cb7f85b77b35a06a895b287b47efbe220bc215aca4a65d7018a7f91c4228b35f71a7c183360ab7a7b6b7870086d851ff861ee07bbec801b79afa477ebab255c7265820456fdc3f34f9d729315d856be7ec564613d5e28cf7c405d6e2b6aeb20000b8505a36a8067cb459fab87c8de118117733d30f4fe049658a2c3edd43546ead9c7882858868cff89a49a693731140db1b7b7116060c30690a39de8b3e0eb4f5401e8354870848c546f9defe1a9c534c9030830fec3eeb5faf1d64bb8e80000000f6ff0000000000000055d843352632b829ceb5200a2cdeb63c0bc7e835e061f9ac3c052b5b6f689bf203aeb8858be07691bc83e178181fab55e6ed9e8a17819de49564d0f0c00dd507441b80cd499c39c5d03d6c00cf5be5215bae09a4f52abf8f1c1add498470a0bb9d7ab757a8b28e4accc939b3621e4c2c9e02741c51eeeaad40cf2e1c3659d83ed71fc628807739d70edda93542445e3204828c49bef648efdc2208341357dd158f411d379df9b1feffbe7c7ee80558a040fa3d5a303f36d5c1a66d9644fc0559aa0e291355ee3de6c7a705b8f7b45bb825044b9a82a6fd2f6eeb14eee0c3f71eeea9984e14c57022ef72850b6dc5fda167d6f98f6c1c73feb424b7937e3c7ca0d2525efbdac50eb94797cf3747b83b56cfea8c74dd3f957dc462e715b789934b422b7ddf3e11a6ad6ad9afd5389c728d14"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3f, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r12 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r12, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) 2.633958283s ago: executing program 0 (id=11189): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x13c, 0x19, 0x1, 0x0, 0x1, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in=@remote, 0x0, 0x0, 0x4e24, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2}, {0x0, 0x0, 0x800, 0x400000000000000}, 0x200, 0x10000000, 0x0, 0x0, 0x2}, [@tmpl={0x84, 0x5, [{{@in=@loopback, 0x0, 0x3c}, 0xa, @in6=@dev, 0x0, 0x4}, {{@in6=@private1, 0x0, 0x6c}, 0x0, @in=@broadcast}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) 2.569024198s ago: executing program 2 (id=11191): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f00000003c0)='ns/cgroup\x00') unshare(0x6a040000) r1 = socket(0x10, 0x3, 0xc0) ioctl$sock_netrom_SIOCADDRT(r1, 0x61d1, 0x0) recvfrom$rxrpc(0xffffffffffffffff, 0x0, 0x0, 0x40010001, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000000)=0x1, 0x4) getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f0000000640)=""/218, &(0x7f0000000240)=0xda) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) setsockopt$MRT_ADD_MFC(0xffffffffffffffff, 0x0, 0xcc, 0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = socket$igmp(0x2, 0x3, 0x2) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000180)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3c}}}, 0x24) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e23, @empty}}, 0x24) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f00000001c0)={@broadcast, @broadcast}, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001000010025bd7000f99cdf2500000000", @ANYRES32=0x0, @ANYBLOB="158804000300040008001b000000000008000d0002000000"], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x24048080) setsockopt$MRT_ADD_MFC_PROXY(r3, 0x0, 0xd2, &(0x7f0000000200)={@empty=0x1f, @multicast2=0xe000031f, 0x4, "ff00000058b274e6d845167fefe428970548fc3c7b00000000000000fcff00", 0xb2, 0x1ff, 0x6, 0x6}, 0x3c) r6 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r6, 0x10f, 0x87, 0x0, 0x0) socket(0x26, 0x2, 0x2) r7 = socket$inet6(0xa, 0x3, 0x7) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000000c0)={&(0x7f0000000400)=@deltaction={0x214, 0x31, 0x200, 0x70bd25, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @TCA_ACT_TAB={0x5c, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x101}}, {0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x21c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}, @TCA_ACT_TAB={0x3c, 0x1, [{0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x7, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xffffff24}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}, @TCA_ACT_TAB={0x64, 0x1, [{0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffff9}}, {0xc, 0xe, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x8, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7c}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xef}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x16, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}]}, @TCA_ACT_TAB={0x60, 0x1, [{0xc, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0xc, 0xd, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5d7}}, {0xc, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @TCA_ACT_TAB={0x54, 0x1, [{0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb}}, {0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x10}}, {0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x6, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}, @TCA_ACT_TAB={0x10, 0x1, [{0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x177}}]}, @TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x10, 0xa, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) getsockopt(r7, 0xff, 0x22, 0x0, &(0x7f00000002c0)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) 2.494329895s ago: executing program 0 (id=11192): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x95d6a000) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x4000, 0x4) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000540)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="110026bd7000ffdbdf2518000000240030802000018008000100020000000c000500a700000000000000080001000300000008000300", @ANYRES32=r5, @ANYBLOB="953372f2d9f82332872b812b335c973e41f091e49c7ff8d0cee9da3fe8a16f0e5b4deaf98575895f816dccf6759a647482e6aec1b53de746b6a3a45afd84633b7bcd8c8f33bb9ed12b44c66e16e58d39c7d9334d44bbdf0aa6c8dce62207dfc28bb07c1619178518bf23cdab282322b130f15eb618ca705d7b521a9054d23b03bdbde67b245e778be2074293454ddab3a1822ec7d903f043887be665e551618e2475d212a130db04e5e9204a7b6433b700bd0d5aeb9e1080c4d50210c400000000"], 0x40}, 0x1, 0x0, 0x0, 0x8080}, 0x0) sendmsg$NL802154_CMD_GET_SEC_KEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x50, r0, 0x300, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x20008810) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000002000000000000000100009308000000ffffffff070000000605db947c"], &(0x7f0000001f80)=""/212, 0x32, 0xd4, 0xa, 0x2}, 0x28) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000140)={0x40, r8, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x41, 0x60}}}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x348}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}]]}, 0x40}}, 0x0) socket$kcm(0x29, 0x5, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x4000000000000, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0xc08, 0x3, 0x1e8, 0x310, 0x5002004a, 0xb, 0x310, 0xea13, 0x3a8, 0x3c8, 0x3c8, 0x310, 0x3c8, 0x3, 0x0, {[{{@ip={@multicast2, @private=0xa010101, 0xff, 0xffffffff, 'bridge0\x00', 'veth0_macvtap\x00', {}, {0xff}, 0x5c, 0x3, 0x2}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x248) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb0800450000380000000009019078ac1e0201ac1414aa030190781209183f2500000000650100000100007f0000017f00000100186371ae9b1c03"], 0x0) r9 = socket$kcm(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000004c0)={'syztnl1\x00', &(0x7f0000000400)={'syztnl0\x00', 0x0, 0x29, 0x8, 0x4, 0x5, 0x10, @mcast1, @empty, 0x7800, 0x80, 0x4, 0x40}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000500)) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000c40), r10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002080)=@delchain={0x2f0, 0x65, 0x2, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0x8}, {0x0, 0x1}, {0x0, 0x8}}, [@TCA_RATE={0x6, 0x5, {0x5, 0x5}}, @TCA_CHAIN={0x8, 0xb, 0x6}, @filter_kind_options=@f_bpf={{0x8}, {0x2b4, 0x2, [@TCA_BPF_FD={0x8}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_ACT={0x94, 0x1, [@m_simple={0x30, 0x1e, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x79d0f023c2b305dd}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_connmark={0x60, 0x15, 0x0, 0x0, {{0xd}, {0x4}, {0x2d, 0x6, "726786f30e509174574dc37f3b098ea66afe225634df06865f963558e69516e656d1b4d3ec4c23aaed"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x3}, @TCA_BPF_NAME={0xc, 0x7, './file0\x00'}, @TCA_BPF_FLAGS={0x8, 0x8, 0x8000001}, @TCA_BPF_ACT={0x1ec, 0x1, [@m_ctinfo={0x128, 0x4, 0x0, 0x0, {{0xb}, {0x4c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ZONE={0x6, 0x4, 0x53}, @TCA_CTINFO_ACT={0x18, 0x3, {0x2, 0x7f, 0x10000000, 0x82c}}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x8}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x98c}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x2}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0xf3fa}]}, {0xb1, 0x6, "c14309d56e11f3e88ad36b866a06cff47631fe31f29c2d83a2e6f0bf13045227d5cfc3c4f57b9a903cf86c567461f60a0fb69f562613042765a016443f0181bfeba7e917511c20f8585f40c15cc948ecdd08e5acfddde4c4d1eeb8e4156045960e71ed491970a569097578137069861cf0a28baddf976ebf5e96eca138cadcea7bfb921158875a49e4975a5dbb3ab54f13ee0f5254fe6f752f120208ad930afb01c2417b4953f4774567f9bbf1"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x4, 0x1}}}}, @m_mpls={0xc0, 0xe, 0x0, 0x0, {{0x9}, {0x2c, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0xf9}, @TCA_MPLS_TTL={0x5, 0x7, 0x7}, @TCA_MPLS_TTL={0x5}, @TCA_MPLS_LABEL={0x8, 0x5, 0x58d1a}, @TCA_MPLS_LABEL={0x8, 0x5, 0xfb8e5}]}, {0x6c, 0x6, "6c93300feb03a958f74c54a24009f41e0af36bc7643876a09aebe62bb5bbf2fd080d893ae2e0b96bd4b83f588156e680e18798beeddcc40fa52be16c87d1fd4a05edd22e56176f7bc7531259230fee3b2c37f94c2cf2e2bba05955468acc714fcca66429b4711a98"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}]}, 0x2f0}, 0x1, 0x0, 0x0, 0x81}, 0x20000080) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90324fc60180c02400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r11 = accept4(r9, &(0x7f0000000300)=@tipc, &(0x7f0000000380)=0x80, 0x80800) setsockopt$CAN_RAW_FILTER(r11, 0x65, 0x1, &(0x7f00000003c0)=[{{0x4}, {0x0, 0x1, 0x1, 0x1}}, {{0x0, 0x1, 0x1, 0x1}, {0x2}}, {{0x3, 0x0, 0x1, 0x1}, {0x2, 0x1, 0x0, 0x1}}, {{0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}}, {{0x3, 0x1, 0x1, 0x1}, {0x2, 0x0, 0x1, 0x1}}], 0x28) 2.170440589s ago: executing program 0 (id=11198): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0x300, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x8, 0xffff}, {0x4, 0x1}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}}, 0x24}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.047469376s ago: executing program 0 (id=11200): socket$inet_udp(0x2, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x6, 0xc, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="120000002200000004"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000200), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r1, 0x0, &(0x7f00000006c0)=""/198}, 0x20) 1.812273719s ago: executing program 0 (id=11204): getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x99, 0x7, 0x0, 0x1, 0x5392, 0xc, 0x9, {0x0, @in6={{0xa, 0x4e20, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10}}, 0x81, 0x3, 0xc, 0x4b, 0x9}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e6400000000340002800500010004000000050016000000000008001c000000000005000c00000000000a001a"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r0, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @mcast1}, {0xa, 0x0, 0x0, @mcast2, 0xffffffff}, 0x0, {[0x0, 0x3]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x1}, 0x5c) close(0x3) write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_type(r1, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000280), 0x9) r3 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r7, 0x0, 0x1, 0x5) setsockopt$MRT_FLUSH(r6, 0x0, 0xd4, &(0x7f00000000c0)=0x7, 0x4) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) r8 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="8401000010000100000000000000000000000000000000000000000000000000ac1414bb00000000000000000000000000000000000000000000000016000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000001000004d26c000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000200010000000000000000004c001400626c616b6532622d33383400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000480003006465666c61746500"/316], 0x184}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r10 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r11 = openat$cgroup_procs(r10, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r11, &(0x7f00000001c0), 0x12) socket(0x10, 0x3, 0x0) 1.587200682s ago: executing program 4 (id=11208): r0 = socket$inet6(0xa, 0x3, 0x87) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000300)={{{@in=@private=0xa010100, @in=@loopback, 0x0, 0x0, 0xfffc, 0x4, 0xa, 0x0, 0x0, 0x52}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, {0x0, 0x400000}, 0x9, 0x0, 0x1, 0x1}, {{@in6=@rand_addr=' \x01\x00', 0x2000000, 0x33}, 0xa, @in=@multicast2, 0x0, 0x0, 0x0, 0x3}}, 0xe8) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0xff00}, 0x1c) 1.444453684s ago: executing program 4 (id=11210): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0x300, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x8, 0xffff}, {0x4, 0x1}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}}, 0x24}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.266234903s ago: executing program 4 (id=11212): bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d00"], 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b708000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0xc618, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r4}, &(0x7f0000000280), &(0x7f0000000240)=r1}, 0x20) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async) r6 = socket$kcm(0x2, 0x2, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r7, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r7, 0x0) (async) sendmsg$TIPC_NL_MON_SET(r7, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x40, 0x0, 0x100, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x2c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x614d}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x81}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000080}, 0x20008044) r8 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r8, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmmsg(r8, &(0x7f00000012c0)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000400)="1a", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000600)="526e481e", 0x4}], 0x1}}], 0x2, 0x8000) (async, rerun: 64) ioctl$sock_inet_SIOCGIFNETMASK(r6, 0x891b, &(0x7f0000000180)={'pimreg0\x00', {0x2, 0x0, @loopback}}) (rerun: 64) 1.125449996s ago: executing program 4 (id=11213): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20040884}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000300)='cgroup.controllers\x00', 0x275a, 0xfffe) preadv(r1, &(0x7f0000000100), 0xa, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f0000001a40)=ANY=[@ANYBLOB="8510000804000000950000000000000018000000000000000000000d000000009500000000000000851000001c16fca30fc8fc1aa3d0e07b5a9aa67c5c406dd9b829ddc08d93818a536fbf46b8e8da625d14f93568750f73461382576c1578ca780af676c27c8ecd00002b368e12e8273f31b368056ee58249541255567cff86100f23e63219600eea42578f733ef4c2fc0efe696ba991529c20e7986ac0d7baa7f99ac9088ab37b010b457932ad3957b7e5d562390b5c061480158ef8f8e04145884b880e4f48e1c126ca9455b42ca0976bbb118673a7168564c8d2585dcd22f9effcd2a0b9118acbe73b90eaf36e1e7548ebd6e04b1edaf708bc2997a881bf6592c4af942fabada1b99b96c317c70d72c049746cc1fef03d0503b092fbd91826bcb86dc97c6e6055b4d242743a4b4000466d61b3bf8e2163de3f11d83aeb7339d4852c3b65f163be788f351ffb1b2f81840ca8afd9d2430532"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4}, 0x94) accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000300), 0x80000) syz_genetlink_get_family_id$ethtool(0x0, r3) sendmsg$ETHTOOL_MSG_RINGS_GET(r2, 0x0, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000100)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x15, 0x0, 0x0, 0x0, 0x0, {[@mptcp=@remove_addr={0x1e, 0x3d, 0x0, 0x0, "23f12f4860a44b0bc15ba15ff24af6985862903ebeb97f2918c713975bf95aefc56dc0c47215146671a0c2baf90fa3de0356cd9d9628d4a62674"}]}}}}}}}, 0x0) recvmsg$unix(r7, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r10, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r9, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@bridge_newvlan={0x18, 0x76, 0x709, 0x1, 0x0, {0x7, 0x2}}, 0x18}, 0x1, 0x5502000000000000, 0x0, 0x40}, 0x40000) sendmsg$inet(r11, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socketpair(0x27, 0x4, 0xd, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) 1.116898937s ago: executing program 3 (id=11214): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="120000002200000004"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000200), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r1, 0x0, &(0x7f00000006c0)=""/198}, 0x20) 1.065345071s ago: executing program 3 (id=11215): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r0, 0x84, 0x6b, &(0x7f0000001080)=[@in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, '\x00', 0x11}, 0x9}, @in6={0xa, 0x4e23, 0xb, @remote, 0x3eb6}, @in6={0xa, 0x4e23, 0x7fffffff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e22, 0x2, @private2, 0x6}, @in6={0xa, 0x4e23, 0x1000, @mcast1, 0x2}, @in6={0xa, 0x4e21, 0x4, @mcast2, 0x6}, @in={0x2, 0x4e20, @multicast1}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x3e}}, @in={0x2, 0x4e20, @empty}], 0xe8) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private1, 0x9}]}, &(0x7f00000002c0)=0x10) (async) r1 = socket(0x2, 0x80805, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1fb, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0xc4}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2a}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x20, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0xc, 0x18, 0x0, 0x0, @binary="0bac0f0006ac0f00"}]}, 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x0) (async) getsockopt$bt_hci(r1, 0x84, 0x6d, &(0x7f0000000000)=""/4096, &(0x7f0000001040)=0x63ad82c2469e5e14) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000100000000000000090000009c9900000000000095"], &(0x7f0000000000)='GPL\x00', 0x1, 0x22, &(0x7f0000000140)=""/34, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) 998.153917ms ago: executing program 1 (id=11216): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r0, 0x1, 0x10000000000009, &(0x7f0000000180)="00050002", 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f0000000100)=0x1, 0x4) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f0000000100)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x9f}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xd2, &(0x7f0000000300)=""/210}, 0x94) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @rand_addr=' \x01\x00'}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @rand_addr=' \x01\x00'}}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4) (async) sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x2c, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) (async) r5 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYRES64=r5], 0x5c}, 0x1, 0x0, 0x0, 0x4000800}, 0x88010) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x76, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x90) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlinkprop={0x28, 0x6c, 0x1, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x4, 0x204}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000084}, 0x4040004) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r8, 0x84, 0x71, &(0x7f0000000080), 0x8) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0x403, 0x70bd25, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r10}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x4c}, 0x1, 0xba01, 0x0, 0x4000004}, 0x810) r11 = socket$packet(0x11, 0x3, 0x300) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x5, '\x00', r2, 0xffffffffffffffff, 0x3, 0x5, 0x3}, 0x50) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000005c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x5, '\x00', r2, 0xffffffffffffffff, 0x3, 0x5, 0x3}, 0x50) r12 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r12, 0x0, 0x63, &(0x7f0000000240)={'HL\x00'}, &(0x7f0000000400)=0x1e) (async) getsockopt$ARPT_SO_GET_REVISION_TARGET(r12, 0x0, 0x63, &(0x7f0000000240)={'HL\x00'}, &(0x7f0000000400)=0x1e) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'veth0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x25}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f00000004c0)={r13, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f00000004c0)={r13, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_drop_memb(r11, 0x107, 0x2, &(0x7f0000000000)={r13, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) 961.295032ms ago: executing program 2 (id=11217): r0 = socket(0x2d, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000540)={0x2d, 0x0, 0x8000}, 0xc) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1e, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7ff}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_DYNSET_SREG_KEY={0x8, 0x4, 0x1, 0x0, 0xa}, @NFTA_DYNSET_FLAGS={0x8}, @NFTA_DYNSET_OP={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r7, 0xfffffffc) sendto$inet6(r7, 0x0, 0x0, 0x20004011, 0x0, 0x0) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r8}, &(0x7f0000000280), &(0x7f0000000240)=r4}, 0x20) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r8, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x48020000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f00000000c0)=r9, 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4) r10 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r10, 0x0, 0x63, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x1e) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f00000000c0)=r1}, 0x20) r12 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r12, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x52, 0x1, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0xd, &(0x7f0000000180)=@framed={{}, [@jmp={0x6, 0x0, 0xc, 0x0, 0x0, 0x1, 0x25}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r11}}, @alu={0x7, 0x0, 0x1, 0x7, 0x0, 0xfffffffffffffff8, 0x1}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @exit, @call={0x85, 0x0, 0x0, 0x4c}]}, &(0x7f0000000100)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x807}, 0x94) 938.324743ms ago: executing program 3 (id=11218): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x24048011}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000100)=[0x8000000000000001, 0x7cc5, 0xd], 0x0, 0x101, 0x20000000000003bf}}, 0x40) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c00)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000d798c116fa", @ANYRES16=r3, @ANYBLOB="0100000000000000000001000000040007800c000200fcffffffffffffff"], 0x24}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000220000a3c000000120a09080000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a"], 0x64}, 0x1, 0x0, 0x0, 0x5}, 0x0) 863.278127ms ago: executing program 0 (id=11219): unshare(0x6a040000) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="180000000200000000"], 0x0, 0x8, 0x0, 0x0, 0x41100}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f000000be00)=[{{0x0, 0x0, &(0x7f0000002c80)=[{&(0x7f0000001900)=""/73, 0x49}, {&(0x7f0000001980)=""/233, 0x4b}], 0x2}, 0x10001}], 0x1, 0x40000000, 0x0) 677.620022ms ago: executing program 2 (id=11220): socket$igmp(0x2, 0x3, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) bind$rds(r0, &(0x7f0000000300)={0x2, 0x4e20, @local}, 0xffffffffffffff9b) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x615a}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xd, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x2a}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffff80}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x27, 0xe, 0x55, &(0x7f00000003c0)="f9ad48cc42cb29fc99d41a08320a", 0x0, 0x13fd, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) write$cgroup_int(r0, &(0x7f0000000200), 0xffffffc1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_buf(r3, 0x0, 0x4, &(0x7f0000000040)="440910bc996c301c81070704", 0xc) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000008, 0x1010, r0, 0xa091b000) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_opts(r4, 0x0, 0x4, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r0, 0x0) mmap(&(0x7f00007a6000/0x3000)=nil, 0x3000, 0x100000c, 0x22051, r0, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha12-simd\x00'}, 0x58) socket(0x10, 0x803, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x6000000}, 0x0) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r5, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x46, 0x0, 0x0) setsockopt$inet6_int(r5, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) unshare(0x6a040000) connect$unix(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) 664.669101ms ago: executing program 3 (id=11221): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="0a00000016000000b30000007f00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000674d45608691873f000000000000000000007c622820d34ec57a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0xb, &(0x7f0000000280)=@framed={{0x18, 0x3}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @generic={0x66, 0x0, 0x0, 0x0, 0x800000}, @initr0, @exit, @alu={0x7, 0x0, 0x7, 0x3, 0x0, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x8, 0x0, 0x0, 0x41100, 0x4c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000300)={@l2={0x1f, 0x8, @any, 0x88, 0x2}, {&(0x7f00000000c0)=""/6, 0x6}, &(0x7f0000000100), 0x22}, 0xa0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000140)={'bond0\x00', {0x2, 0x4e23, @multicast2}}) 664.531293ms ago: executing program 1 (id=11222): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@getchain={0x24, 0x66, 0x300, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x7}, {0x8, 0xffff}, {0x4, 0x1}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x24, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}}, 0x24}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 547.065382ms ago: executing program 1 (id=11223): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000b00), r1) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b40)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010028bd7000ffdbdf250700000008000400ac1414bb14000300fc000000000000000000000000000000140002"], 0x44}, 0x1, 0x0, 0x0, 0x20000800}, 0x24060004) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRES64=r3, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, r4}, 0x38) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x300000e, 0x40172, r3, 0xb2421000) 446.831257ms ago: executing program 3 (id=11224): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfd9f7, {0x0, 0x0, 0x0, 0x0, 0x2813, 0x2c21}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MTU={0x8, 0x4, 0x5aa}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x24, 0x2, 0x1, 0x201, 0x0, 0x0, {0x0, 0x0, 0xa}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1006}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x90a8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20008000}, 0x44) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x345340, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x345340, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="0a000000ffffffffffffbbbbbbbbbbbb88a800008100000008004500004000006000002f9078ac1e0001ac1414aa000086dd"], 0xb9) (async) write$tun(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="0a000000ffffffffffffbbbbbbbbbbbb88a800008100000008004500004000006000002f9078ac1e0001ac1414aa000086dd"], 0xb9) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@setlink={0x48, 0x13, 0x331, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x60644, 0x46001}, [@IFLA_IFNAME={0x14, 0x3, 'dummy0\x00'}, @IFLA_PROTO_DOWN={0x5, 0x27, 0x27}, @IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x2, 0x0, 0x1, {0x4}}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008810}, 0x4000054) 289.797196ms ago: executing program 1 (id=11225): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="120000002200000004"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000200), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000400)={r1, 0x0, &(0x7f00000006c0)=""/198}, 0x20) 186.759885ms ago: executing program 4 (id=11226): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071114200000000008510000002000000850000000500000095000d00000000009500a50000000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r0, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000040)=[0x0, 0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) 167.579421ms ago: executing program 1 (id=11227): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001980)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70400000800000085000000b500000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value=0x1000000}, 0x94) 102.412619ms ago: executing program 3 (id=11228): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001980)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000007b8a00fe0000000087080000000000007b8af0ff00000000bda100000000000027000000f8ffffffbfa400000000000007040000f0ffffffb70200000200000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70400000800000085000000b500000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value=0x2000000}, 0x94) 2.204828ms ago: executing program 4 (id=11229): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000940)={&(0x7f00000001c0)={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f0000000500)=[{&(0x7f0000000400)="14e9ccb5e2677a182ab2f797e8d79b2f9916a225a46de6ade1befeed5cc8609768da0900315211a2d96654e116114af555629d3a99ed7d8966ad7f9d79f011e6bfc9905a4054a239aa71a36e4ecbd8f6455db150b04f3b22fc78b827e45c8f1134f2ffae4557f119807dda5871c99ff43d705d242ce7d0e5c43bfbfaa5f1bfb9d16907453d9938183cb8ff8a67cfb2b4de72cd35e2a91dc4", 0x98}, {&(0x7f0000000200)="79c8cdc0a014d3bcd6dff4574b0db90805f6c1b27ff4e6c67d852ec0d1fd933d2df1ec09d9081fe3bb42cd109cb152766e276faa7d5c0aa198637ea0523a89a21fc05cf197f3e2ee143d02b7a03eefe5cd86ed0b503bb263bed64d1fb1089e8e7e97687fb662d3e8ab2e42c27af6baef856e7cf71f7fa4020435e6dc10", 0x7d}, {&(0x7f00000004c0)="b84ad34c845b1b6014a5bd0436d51c6a29", 0x11}], 0x3, &(0x7f0000000540)=[@ip_ttl={{0x14, 0x0, 0x2, 0x711}}, @ip_tos_int={{0x14}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7fffffff}}, @ip_retopts={{0x28, 0x0, 0x7, {[@rr={0x7, 0xb, 0x2f, [@broadcast, @multicast1]}, @generic={0x94, 0xc, "5f77ecac7088adb8c992"}]}}}], 0x70}, 0x80) socket(0x26, 0xa, 0xe) bind$inet(r0, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) (async) connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, &(0x7f0000000040)) (async) r1 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x50) (async, rerun: 64) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (rerun: 64) close(r2) (async) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000380)={{0xa, 0x4e26, 0x2a, @dev={0xfe, 0x80, '\x00', 0xb}, 0x3}, {0xa, 0x4e23, 0x1, @mcast1, 0x1}, 0x1, {[0x78, 0x0, 0x9, 0x2000, 0x9, 0x5, 0x4, 0x5]}}, 0x5c) (async, rerun: 32) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (rerun: 32) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x24, 0x0, 0x0) (async, rerun: 32) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x8, 0x3, 0x320, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x250, 0xffffffff, 0xffffffff, 0x250, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x100, 0x130, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@hashlimit1={{0x58}, {'\x00', {0x10, 0x9, 0xac, 0xfffffffa, 0x3, 0x7, 0x1, 0x80, 0x40}, {0x3}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xb2, 0x7000000, 0x8000}}}, {{@ipv6={@remote, @private2, [0xffffffff, 0xffffffff, 0x0, 0xffffff00], [0xffffff00, 0xffffff00, 0xffffffff, 0xff000000], 'team_slave_0\x00', 'ip6_vti0\x00', {}, {0xff}, 0x2b, 0x2, 0x5, 0x5}, 0x0, 0x100, 0x120, 0x0, {}, [@common=@srh={{0x30}, {0x2, 0xb7, 0x4, 0xe8, 0x6, 0x1268, 0xb2a}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) (async, rerun: 32) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000000)=@generic={&(0x7f00000017c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x8}, 0x18) (async) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) sendto$phonet(r5, &(0x7f0000000040)="db39a10134b77c671a302bd0a924e627bd4626cb5555a766ec7301b62d66", 0x1e, 0x4, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x3, 0x0, 0x0, 0xfffffffd}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r1}, @generic={0x66}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101}, @exit, @alu={0x4, 0x0, 0x6, 0x3}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) 0s ago: executing program 1 (id=11230): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)=ANY=[@ANYRES16=r0], 0x0, 0x52, 0x0, 0x1}, 0x28) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x25dfdbfc, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffefffff6, 0x110, 0xffffffffffffffff, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) close(r1) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000040)=0x80, 0x4) r2 = epoll_create(0xff) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000000)={0x80000000}) r3 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x8010, r3, 0xffffc000) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x4, 0x318, 0xffffffff, 0x0, 0x0, 0x1e8, 0xffffffff, 0xffffffff, 0x280, 0x280, 0x280, 0xffffffff, 0x4, &(0x7f0000000180), {[{{@ip={@private=0xa010102, @empty, 0xffffffff, 0xffffff00, 'ip6tnl0\x00', 'macvtap0\x00', {0xff}, {0xff}, 0x2, 0x5}, 0x0, 0xe0, 0x108, 0x0, {}, [@common=@set={{0x40}, {{0x4, [0x1, 0x0, 0x4, 0xa94c1d47be690512, 0x0, 0x2], 0x3, 0x6}}}, @common=@addrtype={{0x30}, {0x850, 0xa0c, 0x1, 0x1}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@ip={@empty, @multicast2, 0xff000000, 0xffffff00, 'bridge_slave_0\x00', 'geneve1\x00', {0xff}, {}, 0x73, 0x0, 0x1a}, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@icmp={{0x28}, {0xf, "0db5", 0x1}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x1, 0x2, {0x8}}}}, {{@ip={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff, 0xffffff00, 'ip6erspan0\x00', 'veth1\x00', {}, {0xff}, 0x84, 0x1, 0x4}, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x378) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f00000000c0)) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x54, &(0x7f00000001c0)=""/152, 0x41000, 0xa}, 0x23) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r5}, &(0x7f0000000080), &(0x7f0000000200)=r6}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000400000290f58e3209c8228", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r10}, &(0x7f0000000280), &(0x7f0000000240)=r7}, 0x20) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r10, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f00000000c0)=r11, 0x4) sendmsg$inet(r9, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYRES8=r3, @ANYRES32, @ANYRESHEX=r2, @ANYRES32=0x0, @ANYBLOB="0000000000000000079df969147d548019ade7857f150d3097d199d7dba7b40a68fd34e7"], 0x48}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r3) kernel console output (not intermixed with test programs): eftover after parsing attributes in process `syz.0.9942'. [ 1168.153143][T10388] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9942'. [ 1168.249719][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1168.257776][ C0] lec:lec_tx_timeout: lec0 [ 1168.263317][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1168.420921][T10411] veth3: entered promiscuous mode [ 1168.426468][T10409] ªªªªª9 speed is unknown, defaulting to 1000 [ 1168.488369][T10415] bond2: option lacp_active: invalid value (8) [ 1168.536623][T10415] bond2 (unregistering): Released all slaves [ 1168.635168][T10424] netlink: 'syz.2.9954': attribute type 4 has an invalid length. [ 1168.695404][T10425] netlink: 'syz.2.9954': attribute type 4 has an invalid length. [ 1168.754760][T10427] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1168.794453][T10393] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1168.929577][T10437] FAULT_INJECTION: forcing a failure. [ 1168.929577][T10437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1168.989214][T10409] virt_wifi0 speed is unknown, defaulting to 1000 [ 1168.997984][T10409] wg1 speed is unknown, defaulting to 1000 [ 1169.034544][T10439] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9959'. [ 1169.065080][T10437] CPU: 1 UID: 0 PID: 10437 Comm: syz.2.9957 Not tainted syzkaller #0 PREEMPT(full) [ 1169.065118][T10437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1169.065130][T10437] Call Trace: [ 1169.065139][T10437] [ 1169.065148][T10437] dump_stack_lvl+0xe8/0x150 [ 1169.065177][T10437] should_fail_ex+0x412/0x560 [ 1169.065207][T10437] _copy_to_user+0x31/0xb0 [ 1169.065237][T10437] bpf_test_finish+0x53c/0x6b0 [ 1169.065270][T10437] ? __pfx_bpf_test_finish+0x10/0x10 [ 1169.065298][T10437] ? _copy_from_user+0x94/0xb0 [ 1169.065324][T10437] ? bpf_test_init+0x113/0x150 [ 1169.065346][T10437] bpf_prog_test_run_xdp+0x8fa/0x1160 [ 1169.065389][T10437] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1169.065417][T10437] ? __fget_files+0x2a/0x420 [ 1169.065445][T10437] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1169.065470][T10437] bpf_prog_test_run+0x2c7/0x340 [ 1169.065498][T10437] __sys_bpf+0x5cb/0x920 [ 1169.065521][T10437] ? __pfx___sys_bpf+0x10/0x10 [ 1169.065561][T10437] ? ksys_write+0x242/0x270 [ 1169.065590][T10437] ? __pfx_ksys_write+0x10/0x10 [ 1169.065627][T10437] __x64_sys_bpf+0x7c/0x90 [ 1169.065657][T10437] do_syscall_64+0xe2/0xf80 [ 1169.065682][T10437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1169.065700][T10437] ? trace_irq_disable+0x37/0x100 [ 1169.065719][T10437] ? clear_bhb_loop+0x60/0xb0 [ 1169.065748][T10437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1169.065768][T10437] RIP: 0033:0x7fbc8c99aeb9 [ 1169.065787][T10437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1169.065804][T10437] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1169.065827][T10437] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1169.065842][T10437] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1169.065854][T10437] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1169.065866][T10437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1169.065877][T10437] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1169.065912][T10437] [ 1169.295391][T10439] geneve2: entered promiscuous mode [ 1169.314335][T10439] geneve2: entered allmulticast mode [ 1170.569242][T10478] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9966'. [ 1170.611319][T10478] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9966'. [ 1170.931090][T10488] FAULT_INJECTION: forcing a failure. [ 1170.931090][T10488] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1170.975848][T10488] CPU: 0 UID: 0 PID: 10488 Comm: syz.0.9971 Not tainted syzkaller #0 PREEMPT(full) [ 1170.975878][T10488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1170.975891][T10488] Call Trace: [ 1170.975900][T10488] [ 1170.975909][T10488] dump_stack_lvl+0xe8/0x150 [ 1170.975943][T10488] should_fail_ex+0x412/0x560 [ 1170.975972][T10488] _copy_to_user+0x31/0xb0 [ 1170.976005][T10488] simple_read_from_buffer+0xe1/0x170 [ 1170.976033][T10488] proc_fail_nth_read+0x1bb/0x230 [ 1170.976066][T10488] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1170.976098][T10488] ? rw_verify_area+0x2a6/0x4d0 [ 1170.976186][T10488] ? __fget_files+0x2a/0x420 [ 1170.976206][T10488] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1170.976235][T10488] vfs_read+0x20c/0xa70 [ 1170.976261][T10488] ? fdget_pos+0x246/0x320 [ 1170.976289][T10488] ? __pfx___mutex_lock+0x10/0x10 [ 1170.976316][T10488] ? __pfx_vfs_read+0x10/0x10 [ 1170.976346][T10488] ? __fget_files+0x2a/0x420 [ 1170.976372][T10488] ? __fget_files+0x3a0/0x420 [ 1170.976392][T10488] ? __fget_files+0x2a/0x420 [ 1170.976425][T10488] ksys_read+0x150/0x270 [ 1170.976455][T10488] ? __pfx_ksys_read+0x10/0x10 [ 1170.976497][T10488] do_syscall_64+0xe2/0xf80 [ 1170.976524][T10488] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1170.976542][T10488] ? trace_irq_disable+0x37/0x100 [ 1170.976561][T10488] ? clear_bhb_loop+0x60/0xb0 [ 1170.976585][T10488] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1170.976605][T10488] RIP: 0033:0x7fd5e4b5b78e [ 1170.976625][T10488] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1170.976641][T10488] RSP: 002b:00007fd5e5a3afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1170.976664][T10488] RAX: ffffffffffffffda RBX: 00007fd5e5a3b6c0 RCX: 00007fd5e4b5b78e [ 1170.976678][T10488] RDX: 000000000000000f RSI: 00007fd5e5a3b0a0 RDI: 0000000000000007 [ 1170.976691][T10488] RBP: 00007fd5e5a3b090 R08: 0000000000000000 R09: 0000000000000000 [ 1170.976704][T10488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1170.976716][T10488] R13: 00007fd5e4e16038 R14: 00007fd5e4e15fa0 R15: 00007ffde2120468 [ 1170.976751][T10488] [ 1171.247974][T10494] netlink: 156 bytes leftover after parsing attributes in process `syz.0.9973'. [ 1171.265133][T10494] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9973'. [ 1171.323423][T10490] netlink: 'syz.2.9970': attribute type 1 has an invalid length. [ 1171.455831][T10495] bond4: (slave gretap1): making interface the new active one [ 1171.468292][T10495] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 1171.542502][T10506] netlink: 'syz.0.9975': attribute type 1 has an invalid length. [ 1171.550781][T10506] netlink: 244 bytes leftover after parsing attributes in process `syz.0.9975'. [ 1171.718404][T10509] ªªªªª9 speed is unknown, defaulting to 1000 [ 1171.982893][T10521] ªªªªª9 speed is unknown, defaulting to 1000 [ 1172.138712][T10509] virt_wifi0 speed is unknown, defaulting to 1000 [ 1172.147853][T10509] wg1 speed is unknown, defaulting to 1000 [ 1172.589563][T10538] netlink: 'syz.0.9984': attribute type 5 has an invalid length. [ 1172.692833][T10538] ip6erspan0: entered promiscuous mode [ 1172.701664][T10521] virt_wifi0 speed is unknown, defaulting to 1000 [ 1172.725231][T10521] wg1 speed is unknown, defaulting to 1000 [ 1173.013420][T10543] netlink: 'syz.0.9985': attribute type 29 has an invalid length. [ 1173.082365][T10541] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9985'. [ 1173.250031][T10544] netlink: 'syz.0.9985': attribute type 29 has an invalid length. [ 1173.269666][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1173.277817][ C0] lec:lec_tx_timeout: lec0 [ 1173.283133][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1173.365010][T10550] pim6reg99999999: entered allmulticast mode [ 1173.451273][T10547] ªªªªª9 speed is unknown, defaulting to 1000 [ 1173.876506][T10564] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9990'. [ 1173.896696][T10564] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9990'. [ 1174.112959][T10564] ªªªªª9 speed is unknown, defaulting to 1000 [ 1174.122437][T10547] virt_wifi0 speed is unknown, defaulting to 1000 [ 1174.141725][T10547] wg1 speed is unknown, defaulting to 1000 [ 1174.685759][T10580] af_packet: tpacket_rcv: packet too big, clamped from 240 to 4294967272. macoff=96 [ 1174.717850][T10581] netlink: 'syz.4.9996': attribute type 2 has an invalid length. [ 1174.747281][T10564] virt_wifi0 speed is unknown, defaulting to 1000 [ 1174.766661][T10564] wg1 speed is unknown, defaulting to 1000 [ 1175.006712][T10589] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9999'. [ 1175.389265][T10603] sctp: [Deprecated]: syz.1.10004 (pid 10603) Use of int in maxseg socket option. [ 1175.389265][T10603] Use struct sctp_assoc_value instead [ 1175.755885][T10615] ªªªªª9 speed is unknown, defaulting to 1000 [ 1175.781597][T10617] netlink: 'syz.2.10007': attribute type 1 has an invalid length. [ 1176.158486][T10632] netlink: 17 bytes leftover after parsing attributes in process `syz.3.10013'. [ 1176.604451][T10615] virt_wifi0 speed is unknown, defaulting to 1000 [ 1176.631814][T10615] wg1 speed is unknown, defaulting to 1000 [ 1177.170422][T10670] ªªªªª9 speed is unknown, defaulting to 1000 [ 1177.855877][T10670] virt_wifi0 speed is unknown, defaulting to 1000 [ 1177.911808][T10670] wg1 speed is unknown, defaulting to 1000 [ 1178.289682][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1178.297733][ C0] lec:lec_tx_timeout: lec0 [ 1178.303664][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1178.330534][T10724] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10041'. [ 1178.359961][T10724] openvswitch: netlink: Flow actions attr not present in new flow. [ 1178.607984][T10737] bond1: option ad_user_port_key: invalid value (65535) [ 1178.660592][T10742] Cannot find set identified by id 65534 to match [ 1178.671069][T10737] bond1: option ad_user_port_key: allowed values 0 - 1023 [ 1178.715991][T10737] bond1 (unregistering): Released all slaves [ 1178.734159][T10748] netlink: 36 bytes leftover after parsing attributes in process `syz.2.10048'. [ 1179.471137][T10783] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10061'. [ 1179.511229][T10790] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10064'. [ 1179.676198][T10792] syzkaller0: entered promiscuous mode [ 1179.700208][T10792] syzkaller0: entered allmulticast mode [ 1179.740606][T10792] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10065'. [ 1179.784750][T10801] sctp: [Deprecated]: syz.0.10066 (pid 10801) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1179.784750][T10801] Use struct sctp_sack_info instead [ 1179.955479][T10803] netlink: 'syz.1.10070': attribute type 1 has an invalid length. [ 1180.334951][T10831] netlink: 'syz.2.10076': attribute type 12 has an invalid length. [ 1180.353150][T10831] netlink: 'syz.2.10076': attribute type 29 has an invalid length. [ 1180.375025][T10831] netlink: 148 bytes leftover after parsing attributes in process `syz.2.10076'. [ 1180.395059][T10831] netlink: 'syz.2.10076': attribute type 2 has an invalid length. [ 1180.405365][T10831] netlink: 23 bytes leftover after parsing attributes in process `syz.2.10076'. [ 1180.471821][T10831] tipc: Enabling of bearer rejected, failed to enable media [ 1181.088099][T10878] netlink: 'syz.4.10093': attribute type 1 has an invalid length. [ 1181.152416][T10878] bond1: entered promiscuous mode [ 1181.158056][T10878] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1181.584068][T10908] netlink: 72 bytes leftover after parsing attributes in process `syz.2.10099'. [ 1182.165989][T10919] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1182.193861][T23838] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1182.223232][T23838] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1182.249064][T23838] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1182.270496][T23838] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1182.281468][T23838] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1182.298862][T23838] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1182.320341][T23838] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1182.360719][T23838] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1182.492466][T10950] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1182.538518][T10954] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.10113'. [ 1182.550249][T10954] netlink: Unknown conntrack attr (0) [ 1182.696723][T10966] netlink: 44 bytes leftover after parsing attributes in process `syz.3.10116'. [ 1183.101752][T10980] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.114782][T10980] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.320558][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1183.328856][ C0] lec:lec_tx_timeout: lec0 [ 1183.333813][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1183.393732][T10980] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.438963][T10980] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.495136][T11010] __nla_validate_parse: 4 callbacks suppressed [ 1183.495157][T11010] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10129'. [ 1183.546453][T11010] vlan2: entered promiscuous mode [ 1183.551901][T11010] bond0: entered promiscuous mode [ 1183.595825][T11014] bond4 (unregistering): Released all slaves [ 1183.711120][T10980] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.734259][T10980] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.935916][T10980] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.959509][T10980] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1184.031469][T11043] netlink: 'syz.1.10140': attribute type 13 has an invalid length. [ 1184.038447][T11042] nbd: must specify at least one socket [ 1184.048230][T11042] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 1184.083590][T11040] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1184.092906][T11040] syzkaller0: entered promiscuous mode [ 1184.098401][T11040] syzkaller0: entered allmulticast mode [ 1184.214853][T23838] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1184.229778][T23838] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1184.267086][T11049] netlink: 14 bytes leftover after parsing attributes in process `syz.0.10142'. [ 1184.276754][T23838] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1184.292223][T23838] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1184.317015][T11051] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10143'. [ 1184.382639][T30902] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1184.396130][T11052] netlink: 40 bytes leftover after parsing attributes in process `syz.3.10143'. [ 1184.403130][T30902] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1184.428615][T30902] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1184.439019][T30902] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1184.458316][T11054] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 1184.768920][T11067] ªªªªª9 speed is unknown, defaulting to 1000 [ 1184.942020][T11082] netlink: 20 bytes leftover after parsing attributes in process `syz.0.10152'. [ 1184.989551][T11085] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10153'. [ 1185.034625][T11088] netlink: 'syz.3.10154': attribute type 1 has an invalid length. [ 1185.085199][T11091] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10153'. [ 1185.138892][T11085] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1185.229063][T11088] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1185.299335][T11097] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1185.306722][T11097] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1185.318838][T11097] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1185.408183][T11085] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1185.430883][T11100] mac80211_hwsim hwsim90 wlan0: entered promiscuous mode [ 1185.450840][T11100] bond1: (slave wlan0): Opening slave failed [ 1185.486164][T11091] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1185.498925][T11091] bond3: (slave macvlan2): Enslaving as a backup interface with a down link [ 1185.540823][T11067] virt_wifi0 speed is unknown, defaulting to 1000 [ 1185.547412][T11097] tipc: Enabled bearer , priority 0 [ 1185.600238][T11088] netlink: 44 bytes leftover after parsing attributes in process `syz.3.10154'. [ 1185.654941][T11067] wg1 speed is unknown, defaulting to 1000 [ 1185.664145][T11088] tipc: Resetting bearer [ 1185.722208][T11100] syzkaller0: entered promiscuous mode [ 1185.728129][T11100] syzkaller0: entered allmulticast mode [ 1185.758172][T11086] tipc: Resetting bearer [ 1185.803837][T11127] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10162'. [ 1185.814995][T11086] tipc: Disabling bearer [ 1186.047855][T11137] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10166'. [ 1186.106350][T11140] tipc: Enabling of bearer rejected, failed to enable media [ 1186.432237][T11148] bond4 (unregistering): Released all slaves [ 1186.489051][T11145] netlink: 'syz.2.10169': attribute type 4 has an invalid length. [ 1186.862390][T11173] bond2 (unregistering): Released all slaves [ 1186.895091][T11184] tunl0: Caught tx_queue_len zero misconfig [ 1187.262480][T11202] ªªªªª9 speed is unknown, defaulting to 1000 [ 1187.349519][T11214] netlink: 'syz.4.10191': attribute type 8 has an invalid length. [ 1187.595206][T11220] nbd: must specify at least one socket [ 1187.604651][T11220] block nbd0: reconnected socket [ 1187.662536][ T52] block nbd0: Receive control failed (result -32) [ 1187.685933][T11202] virt_wifi0 speed is unknown, defaulting to 1000 [ 1187.695210][T11202] wg1 speed is unknown, defaulting to 1000 [ 1188.010255][T11240] ªªªªª9 speed is unknown, defaulting to 1000 [ 1188.251784][T11258] mac80211_hwsim hwsim87 syzkaller0: entered promiscuous mode [ 1188.260750][T11258] mac80211_hwsim hwsim87 syzkaller0: entered allmulticast mode [ 1188.283059][T11259] tipc: Enabling of bearer rejected, media not registered [ 1188.321556][T11251] macvlan0: entered allmulticast mode [ 1188.328918][T11251] veth1_vlan: entered allmulticast mode [ 1188.770076][T11284] __nla_validate_parse: 10 callbacks suppressed [ 1188.770100][T11284] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10212'. [ 1188.795406][T11278] netlink: 248 bytes leftover after parsing attributes in process `syz.4.10210'. [ 1188.912712][T11240] virt_wifi0 speed is unknown, defaulting to 1000 [ 1188.952791][T11240] wg1 speed is unknown, defaulting to 1000 [ 1189.099069][T11292] netlink: 192 bytes leftover after parsing attributes in process `syz.2.10215'. [ 1189.160040][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5820 ms [ 1189.168089][ C0] lec:lec_tx_timeout: lec0 [ 1189.173675][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1189.204694][T11297] macvlan3: entered promiscuous mode [ 1189.276195][T11300] macvlan4: entered promiscuous mode [ 1189.373915][T11295] ªªªªª9 speed is unknown, defaulting to 1000 [ 1189.376125][T11308] syzkaller0: entered promiscuous mode [ 1189.386877][T11308] syzkaller0: entered allmulticast mode [ 1189.426855][T11308] netlink: 'syz.0.10219': attribute type 10 has an invalid length. [ 1189.851885][T11295] virt_wifi0 speed is unknown, defaulting to 1000 [ 1189.880057][T11295] wg1 speed is unknown, defaulting to 1000 [ 1190.230543][T11324] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10224'. [ 1190.242098][T11324] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10224'. [ 1190.655761][T11341] ip6gretap0: entered promiscuous mode [ 1190.662318][T11341] macsec1: entered promiscuous mode [ 1190.667744][T11341] macsec1: entered allmulticast mode [ 1190.673427][T11341] ip6gretap0: entered allmulticast mode [ 1190.691842][T11341] ip6gretap0: left allmulticast mode [ 1190.716179][T11341] ip6gretap0: left promiscuous mode [ 1190.918090][T11351] ªªªªª9 speed is unknown, defaulting to 1000 [ 1191.111489][T11365] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10236'. [ 1191.416514][T11378] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10242'. [ 1191.451573][T11351] virt_wifi0 speed is unknown, defaulting to 1000 [ 1191.466365][T11351] wg1 speed is unknown, defaulting to 1000 [ 1191.832476][T11404] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10250'. [ 1191.847055][T11404] netlink: 64 bytes leftover after parsing attributes in process `syz.0.10250'. [ 1192.267970][T11426] netlink: 'syz.1.10257': attribute type 2 has an invalid length. [ 1192.276341][T11426] netlink: 'syz.1.10257': attribute type 2 has an invalid length. [ 1192.325591][T11426] netlink: 'syz.1.10257': attribute type 2 has an invalid length. [ 1192.374497][T11426] netlink: 'syz.1.10257': attribute type 2 has an invalid length. [ 1192.411366][T11431] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10257'. [ 1192.552901][T11438] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 1192.875636][T11450] ªªªªª9 speed is unknown, defaulting to 1000 [ 1192.927737][T11452] netlink: 'syz.2.10265': attribute type 1 has an invalid length. [ 1193.518502][T11450] virt_wifi0 speed is unknown, defaulting to 1000 [ 1193.560057][ C1] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 1193.651858][T11450] wg1 speed is unknown, defaulting to 1000 [ 1193.785502][T11474] netlink: 'syz.1.10272': attribute type 1 has an invalid length. [ 1193.796589][T11474] __nla_validate_parse: 2 callbacks suppressed [ 1193.796609][T11474] netlink: 224 bytes leftover after parsing attributes in process `syz.1.10272'. [ 1194.199659][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1194.207976][ C0] lec:lec_tx_timeout: lec0 [ 1194.213972][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1194.599947][ C1] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 1194.877421][T11515] bridge0: port 3(macvlan2) entered blocking state [ 1194.902410][T11515] bridge0: port 3(macvlan2) entered disabled state [ 1194.919339][T11515] macvlan2: entered allmulticast mode [ 1194.951159][T11515] bridge0: entered allmulticast mode [ 1194.977911][T11515] macvlan2: left allmulticast mode [ 1195.013593][T11515] bridge0: left allmulticast mode [ 1195.296134][T11530] vxcan0: entered allmulticast mode [ 1195.375955][T11539] syzkaller0: entered promiscuous mode [ 1195.406551][T11539] syzkaller0: entered allmulticast mode [ 1195.441166][T11546] netlink: 516 bytes leftover after parsing attributes in process `syz.2.10290'. [ 1195.969367][T11569] netlink: 40 bytes leftover after parsing attributes in process `syz.0.10298'. [ 1195.984446][T11569] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10298'. [ 1196.011732][T11569] openvswitch: netlink: Key type 12292 is out of range max 32 [ 1196.082694][T11569] ªªªªª9 speed is unknown, defaulting to 1000 [ 1196.473139][T11569] virt_wifi0 speed is unknown, defaulting to 1000 [ 1196.485601][T11569] wg1 speed is unknown, defaulting to 1000 [ 1196.505295][T11597] netlink: 64 bytes leftover after parsing attributes in process `syz.1.10306'. [ 1196.806478][T11609] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10310'. [ 1196.822045][T11609] netlink: 7 bytes leftover after parsing attributes in process `syz.2.10310'. [ 1197.413952][ T11] block nbd3: Possible stuck request ffff888025998000: control (read@0,1024B). Runtime 240 seconds [ 1197.424952][ T11] block nbd3: Possible stuck request ffff888025998200: control (read@1024,1024B). Runtime 240 seconds [ 1197.444893][T11634] siw: device registration error -23 [ 1197.453777][T11634] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10318'. [ 1197.482201][T11641] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10320'. [ 1197.651932][T11637] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1197.669900][T11637] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1197.717184][T11641] geneve3: entered promiscuous mode [ 1197.854096][T11637] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1197.885164][T11637] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1197.909148][T11663] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10325'. [ 1197.965062][T11663] netlink: 'syz.4.10325': attribute type 6 has an invalid length. [ 1198.081144][T11637] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1198.093288][T11637] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.109056][T11671] tipc: Started in network mode [ 1198.114185][T11671] tipc: Node identity a6666ab41f4c, cluster identity 4711 [ 1198.123328][T11671] tipc: Enabled bearer , priority 0 [ 1198.139309][T11666] syzkaller0: entered promiscuous mode [ 1198.154279][T11666] syzkaller0: entered allmulticast mode [ 1198.224891][T11637] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1198.243011][T11637] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1198.289230][T11666] 8021q: VLANs not supported on ip6gre0 [ 1198.300285][T11666] tipc: Resetting bearer [ 1198.309513][T11664] tipc: Resetting bearer [ 1198.343641][T11664] tipc: Disabling bearer [ 1198.517940][T23835] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1198.538710][T23835] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1198.628005][T11696] bond2: option broadcast_neighbor: invalid value (30) [ 1198.644509][T11696] bond2 (unregistering): Released all slaves [ 1198.717796][T23835] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1198.732091][T23835] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1198.794544][T23838] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1198.803276][T23838] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1198.833759][T23838] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1198.844601][T23838] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1198.985450][T11721] bridge3: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1199.229894][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1199.238247][ C0] lec:lec_tx_timeout: lec0 [ 1199.243467][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1199.313417][T11742] __nla_validate_parse: 5 callbacks suppressed [ 1199.313439][T11742] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10348'. [ 1199.416609][T11742] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1199.556442][T11748] ªªªªª9 speed is unknown, defaulting to 1000 [ 1199.586130][T11742] netlink: 84 bytes leftover after parsing attributes in process `syz.0.10348'. [ 1199.609889][T11742] netlink: 175 bytes leftover after parsing attributes in process `syz.0.10348'. [ 1199.631615][T11755] syzkaller1: entered promiscuous mode [ 1199.637413][T11755] syzkaller1: entered allmulticast mode [ 1199.664272][T11758] tipc: Enabled bearer , priority 0 [ 1199.692639][T11751] ªªªªª9 speed is unknown, defaulting to 1000 [ 1199.864900][T11748] virt_wifi0 speed is unknown, defaulting to 1000 [ 1199.874576][T11748] wg1 speed is unknown, defaulting to 1000 [ 1200.072786][T11767] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10358'. [ 1200.247919][T11751] virt_wifi0 speed is unknown, defaulting to 1000 [ 1200.258008][T11751] wg1 speed is unknown, defaulting to 1000 [ 1200.320557][T11775] netlink: 96 bytes leftover after parsing attributes in process `syz.1.10361'. [ 1200.336022][T11775] vlan2: entered allmulticast mode [ 1200.342645][T11775] gretap0: entered allmulticast mode [ 1200.367503][T11776] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10362'. [ 1200.528432][T11782] nftables ruleset with unbound set [ 1201.111262][T11810] A link change request failed with some changes committed already. Interface hsr0 may have been left with an inconsistent configuration, please check. [ 1201.256872][T11807] ªªªªª9 speed is unknown, defaulting to 1000 [ 1201.385061][T11822] tipc: Started in network mode [ 1201.399342][T11822] tipc: Node identity e6127b44362a, cluster identity 4711 [ 1201.417688][T11822] tipc: Enabled bearer , priority 0 [ 1201.536712][T11827] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.10380'. [ 1201.570005][T11822] syzkaller0: entered promiscuous mode [ 1201.575620][T11822] syzkaller0: entered allmulticast mode [ 1201.582213][T11822] tipc: Resetting bearer [ 1201.588325][T11826] team0: No ports can be present during mode change [ 1201.602161][T11835] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10384'. [ 1201.631711][T11821] tipc: Resetting bearer [ 1204.125756][T11821] tipc: Disabling bearer [ 1204.167843][T11838] tipc: Invalid UDP bearer configuration [ 1204.167910][T11838] tipc: Enabling of bearer rejected, failed to enable media [ 1204.194676][T11807] virt_wifi0 speed is unknown, defaulting to 1000 [ 1204.210455][ T5900] tipc: Node number set to 3493362500 [ 1204.216238][T11807] wg1 speed is unknown, defaulting to 1000 [ 1204.259920][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1204.268175][ C0] lec:lec_tx_timeout: lec0 [ 1204.273369][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1204.372499][T11846] openvswitch: netlink: IP tunnel TTL not specified. [ 1204.505026][T11854] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10392'. [ 1205.405595][T11893] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10405'. [ 1205.422139][T11893] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10405'. [ 1205.446764][T11896] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10407'. [ 1205.584711][T11902] sctp: [Deprecated]: syz.1.10411 (pid 11902) Use of int in max_burst socket option. [ 1205.584711][T11902] Use struct sctp_assoc_value instead [ 1205.588824][T11898] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1205.630492][T11900] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10409'. [ 1205.738261][T11906] netlink: 'syz.0.10410': attribute type 10 has an invalid length. [ 1205.756991][T11906] netlink: 228 bytes leftover after parsing attributes in process `syz.0.10410'. [ 1205.875103][T11922] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10415'. [ 1206.310991][T11945] syzkaller0: entered promiscuous mode [ 1206.316511][T11945] syzkaller0: entered allmulticast mode [ 1206.383993][T11948] siw: device registration error -23 [ 1206.411445][T11950] netlink: 'syz.1.10425': attribute type 2 has an invalid length. [ 1206.422193][T11950] netlink: 'syz.1.10425': attribute type 3 has an invalid length. [ 1206.449418][T11953] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10426'. [ 1208.280335][ C0] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:0c [ 1208.295935][ C0] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:1b [ 1209.176627][T11937] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1209.279658][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1209.287748][ C0] lec:lec_tx_timeout: lec0 [ 1209.292374][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1209.477234][T11984] ªªªªª9 speed is unknown, defaulting to 1000 [ 1209.542314][T11996] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10436'. [ 1209.838557][T11984] virt_wifi0 speed is unknown, defaulting to 1000 [ 1209.864217][T11984] wg1 speed is unknown, defaulting to 1000 [ 1209.974068][T12011] vlan2: entered promiscuous mode [ 1209.979422][T12011] vlan2: entered allmulticast mode [ 1210.028405][T12011] hsr_slave_1: entered allmulticast mode [ 1210.151848][T12011] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10442'. [ 1210.361462][ T5825] Bluetooth: hci5: command 0x0406 tx timeout [ 1210.481519][T12039] FAULT_INJECTION: forcing a failure. [ 1210.481519][T12039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1210.496915][T12029] sctp: [Deprecated]: syz.1.10446 (pid 12029) Use of int in max_burst socket option deprecated. [ 1210.496915][T12029] Use struct sctp_assoc_value instead [ 1210.528007][T12039] CPU: 0 UID: 0 PID: 12039 Comm: syz.2.10450 Not tainted syzkaller #0 PREEMPT(full) [ 1210.528038][T12039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1210.528049][T12039] Call Trace: [ 1210.528058][T12039] [ 1210.528068][T12039] dump_stack_lvl+0xe8/0x150 [ 1210.528099][T12039] should_fail_ex+0x412/0x560 [ 1210.528128][T12039] _copy_from_user+0x2d/0xb0 [ 1210.528156][T12039] ___sys_sendmsg+0x1c6/0x360 [ 1210.528181][T12039] ? __lock_acquire+0x6b5/0x2cf0 [ 1210.528213][T12039] ? __pfx____sys_sendmsg+0x10/0x10 [ 1210.528237][T12039] ? __lock_acquire+0x6b5/0x2cf0 [ 1210.528267][T12039] ? kstrtouint+0x6e/0xe0 [ 1210.528333][T12039] __sys_sendmmsg+0x27c/0x4e0 [ 1210.528384][T12039] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1210.528408][T12039] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1210.528464][T12039] ? ksys_write+0x242/0x270 [ 1210.528494][T12039] ? __pfx_ksys_write+0x10/0x10 [ 1210.528529][T12039] __x64_sys_sendmmsg+0xa0/0xc0 [ 1210.528555][T12039] do_syscall_64+0xe2/0xf80 [ 1210.528580][T12039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1210.528597][T12039] ? trace_irq_disable+0x37/0x100 [ 1210.528615][T12039] ? clear_bhb_loop+0x60/0xb0 [ 1210.528639][T12039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1210.528657][T12039] RIP: 0033:0x7fbc8c99aeb9 [ 1210.528677][T12039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1210.528693][T12039] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1210.528716][T12039] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1210.528731][T12039] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1210.528744][T12039] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1210.528757][T12039] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1210.528770][T12039] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1210.528804][T12039] [ 1210.557648][T12044] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10451'. [ 1210.998583][T12054] netlink: 428 bytes leftover after parsing attributes in process `syz.4.10453'. [ 1211.049495][T12054] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10453'. [ 1211.110212][T12060] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 1211.468161][T12078] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10462'. [ 1211.489208][T12076] bridge_slave_0: left allmulticast mode [ 1211.502958][T12076] bridge_slave_0: left promiscuous mode [ 1211.515789][T12076] bridge0: port 1(bridge_slave_0) entered disabled state [ 1211.571265][T12076] bridge_slave_1: left allmulticast mode [ 1211.597562][T12076] bridge_slave_1: left promiscuous mode [ 1211.605227][T12076] bridge0: port 2(bridge_slave_1) entered disabled state [ 1211.687654][T12076] team0: Port device team_slave_0 removed [ 1211.719486][T12076] team0: Port device team_slave_1 removed [ 1211.739967][T12076] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1211.747725][T12076] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1211.760473][T12076] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1211.778184][T12076] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1211.789387][T12076] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1211.817006][T12097] netlink: 11 bytes leftover after parsing attributes in process `syz.4.10467'. [ 1212.414019][T12123] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1212.564894][ T30] audit: type=1800 audit(1770174718.301:48): pid=12105 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.10471" name="memory.events" dev="tmpfs" ino=1219 res=0 errno=0 [ 1212.975815][T12145] ªªªªª9 speed is unknown, defaulting to 1000 [ 1213.011092][T12149] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10486'. [ 1213.156385][T12156] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10487'. [ 1213.234337][T12156] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10487'. [ 1213.402013][ C1] batman_adv: batadv0: Local translation table size (88) exceeds maximum packet size (-320); Ignoring new local tt entry: aa:aa:aa:aa:aa:1c [ 1213.763454][T12145] virt_wifi0 speed is unknown, defaulting to 1000 [ 1213.819230][T12145] wg1 speed is unknown, defaulting to 1000 [ 1214.299887][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1214.308303][ C0] lec:lec_tx_timeout: lec0 [ 1214.314066][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1214.713712][T12235] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10508'. [ 1215.085602][T12247] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10513'. [ 1215.388937][ T5527] udevd[5527]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1215.437895][ T4010] udevd[4010]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1215.519870][T12264] netlink: 'syz.3.10516': attribute type 21 has an invalid length. [ 1215.528014][T12264] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10516'. [ 1215.569792][T12264] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10516'. [ 1215.645010][T12269] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10518'. [ 1215.784196][T12269] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10518'. [ 1215.802662][T12269] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10518'. [ 1215.834441][T12273] bond2 (unregistering): Released all slaves [ 1215.854520][T12269] netlink: 'syz.1.10518': attribute type 14 has an invalid length. [ 1216.158964][T12289] IPVS: fo: FWM 3 0x00000003 - no destination available [ 1216.168401][ C1] IPVS: fo: FWM 3 0x00000003 - no destination available [ 1216.353505][T12294] ªªªªª9 speed is unknown, defaulting to 1000 [ 1216.375050][T12295] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10526'. [ 1216.399239][T12295] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10526'. [ 1216.410053][T12295] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 1216.424650][T12295] tipc: MTU too low for tipc bearer [ 1216.937791][T12294] virt_wifi0 speed is unknown, defaulting to 1000 [ 1216.945550][T12320] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10533'. [ 1217.350764][T12294] wg1 speed is unknown, defaulting to 1000 [ 1218.374687][T12352] ªªªªª9 speed is unknown, defaulting to 1000 [ 1218.757199][T12352] virt_wifi0 speed is unknown, defaulting to 1000 [ 1218.777081][T12352] wg1 speed is unknown, defaulting to 1000 [ 1218.958046][T12380] netlink: 'syz.2.10551': attribute type 1 has an invalid length. [ 1218.978008][T12382] netlink: 'syz.2.10551': attribute type 1 has an invalid length. [ 1219.105432][T12386] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1219.129109][T12386] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 1219.221912][T12395] netlink: 'syz.0.10555': attribute type 32 has an invalid length. [ 1219.329668][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1219.337763][ C0] lec:lec_tx_timeout: lec0 [ 1219.342790][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1219.384163][T12402] FAULT_INJECTION: forcing a failure. [ 1219.384163][T12402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1219.391805][T12395] bond4: Setting coupled_control to off (0) [ 1219.398066][T12402] CPU: 0 UID: 0 PID: 12402 Comm: syz.2.10556 Not tainted syzkaller #0 PREEMPT(full) [ 1219.398090][T12402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1219.398102][T12402] Call Trace: [ 1219.398110][T12402] [ 1219.398119][T12402] dump_stack_lvl+0xe8/0x150 [ 1219.398147][T12402] should_fail_ex+0x412/0x560 [ 1219.398173][T12402] _copy_from_user+0x2d/0xb0 [ 1219.398199][T12402] ___sys_sendmsg+0x1c6/0x360 [ 1219.398223][T12402] ? __lock_acquire+0x6b5/0x2cf0 [ 1219.398251][T12402] ? __pfx____sys_sendmsg+0x10/0x10 [ 1219.398272][T12402] ? __lock_acquire+0x6b5/0x2cf0 [ 1219.398299][T12402] ? kstrtouint+0x6e/0xe0 [ 1219.398359][T12402] __sys_sendmmsg+0x27c/0x4e0 [ 1219.398388][T12402] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1219.398409][T12402] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1219.398457][T12402] ? ksys_write+0x242/0x270 [ 1219.398484][T12402] ? __pfx_ksys_write+0x10/0x10 [ 1219.398523][T12402] __x64_sys_sendmmsg+0xa0/0xc0 [ 1219.398549][T12402] do_syscall_64+0xe2/0xf80 [ 1219.398571][T12402] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1219.398587][T12402] ? trace_irq_disable+0x37/0x100 [ 1219.398604][T12402] ? clear_bhb_loop+0x60/0xb0 [ 1219.398625][T12402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1219.398642][T12402] RIP: 0033:0x7fbc8c99aeb9 [ 1219.398660][T12402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1219.398675][T12402] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1219.398694][T12402] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1219.398708][T12402] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1219.398720][T12402] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1219.398731][T12402] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1219.398741][T12402] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1219.398771][T12402] [ 1219.757788][T12413] netlink: 'syz.0.10561': attribute type 4 has an invalid length. [ 1220.021400][T12426] __nla_validate_parse: 5 callbacks suppressed [ 1220.021422][T12426] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10567'. [ 1220.220402][T12442] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10571'. [ 1220.280328][T12438] syzkaller0: entered promiscuous mode [ 1220.285856][T12438] syzkaller0: entered allmulticast mode [ 1220.325769][T12442] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10571'. [ 1220.326667][T12447] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10575'. [ 1220.335232][T12442] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10571'. [ 1220.335254][T12442] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10571'. [ 1220.342913][T12442] vlan2: entered allmulticast mode [ 1220.373819][T12442] dummy0: entered allmulticast mode [ 1220.450038][T12438] netlink: 52 bytes leftover after parsing attributes in process `syz.2.10572'. [ 1220.601710][ T5825] Bluetooth: hci2: command 0x0406 tx timeout [ 1220.674269][T12467] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10580'. [ 1220.691111][T12467] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10580'. [ 1220.909461][T12480] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10583'. [ 1221.057003][T12489] syzkaller0: entered promiscuous mode [ 1221.072817][T12489] syzkaller0: entered allmulticast mode [ 1221.232861][T12494] netlink: 'syz.4.10589': attribute type 1 has an invalid length. [ 1221.265845][T12493] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 1221.537439][T12506] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1221.579175][T12506] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1221.694783][T12506] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1221.707216][T12506] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1221.797111][T12506] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1221.810096][T12506] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1221.853948][T12519] netlink: 'syz.3.10597': attribute type 1 has an invalid length. [ 1221.925534][T12519] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1221.987130][T12521] bond2: (slave veth3): Enslaving as an active interface with a down link [ 1222.011821][T12506] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1222.030434][T12506] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1222.086642][T12519] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1222.098227][T12519] bond2: (slave batadv1): making interface the new active one [ 1222.120821][T12519] batadv1: entered promiscuous mode [ 1222.134771][T12519] bond2: (slave batadv1): Enslaving as an active interface with an up link [ 1222.155998][T12526] FAULT_INJECTION: forcing a failure. [ 1222.155998][T12526] name failslab, interval 1, probability 0, space 0, times 0 [ 1222.210227][T12526] CPU: 0 UID: 0 PID: 12526 Comm: syz.2.10599 Not tainted syzkaller #0 PREEMPT(full) [ 1222.210257][T12526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1222.210270][T12526] Call Trace: [ 1222.210277][T12526] [ 1222.210287][T12526] dump_stack_lvl+0xe8/0x150 [ 1222.210319][T12526] should_fail_ex+0x412/0x560 [ 1222.210347][T12526] should_failslab+0xa8/0x100 [ 1222.210370][T12526] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 1222.210398][T12526] ? __alloc_skb+0x186/0x7d0 [ 1222.210422][T12526] ? __alloc_skb+0x1d0/0x7d0 [ 1222.210449][T12526] ? __local_bh_enable_ip+0xd0/0x130 [ 1222.210474][T12526] __alloc_skb+0x1d0/0x7d0 [ 1222.210504][T12526] netlink_sendmsg+0x5d4/0xb40 [ 1222.210549][T12526] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1222.210577][T12526] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1222.210602][T12526] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1222.210625][T12526] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1222.210647][T12526] ____sys_sendmsg+0xa68/0xad0 [ 1222.210674][T12526] ? __might_fault+0xaf/0x130 [ 1222.210709][T12526] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1222.210746][T12526] ? import_iovec+0x73/0xa0 [ 1222.210779][T12526] ___sys_sendmsg+0x2a5/0x360 [ 1222.210806][T12526] ? __lock_acquire+0x6b5/0x2cf0 [ 1222.210837][T12526] ? __pfx____sys_sendmsg+0x10/0x10 [ 1222.210870][T12526] ? kstrtouint+0x6e/0xe0 [ 1222.210922][T12526] ? __fget_files+0x2a/0x420 [ 1222.210943][T12526] ? __fget_files+0x3a0/0x420 [ 1222.210976][T12526] __sys_sendmmsg+0x27c/0x4e0 [ 1222.211010][T12526] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1222.211034][T12526] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1222.211089][T12526] ? ksys_write+0x242/0x270 [ 1222.211120][T12526] ? __pfx_ksys_write+0x10/0x10 [ 1222.211155][T12526] __x64_sys_sendmmsg+0xa0/0xc0 [ 1222.211185][T12526] do_syscall_64+0xe2/0xf80 [ 1222.211211][T12526] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1222.211230][T12526] ? trace_irq_disable+0x37/0x100 [ 1222.211249][T12526] ? clear_bhb_loop+0x60/0xb0 [ 1222.211273][T12526] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1222.211291][T12526] RIP: 0033:0x7fbc8c99aeb9 [ 1222.211311][T12526] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1222.211327][T12526] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1222.211350][T12526] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1222.211364][T12526] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 1222.211378][T12526] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1222.211391][T12526] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1222.211403][T12526] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1222.211435][T12526] [ 1222.554009][T23835] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1222.562699][T23835] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.643560][T30902] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1222.652951][T30902] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.727821][T10115] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1222.772089][T10115] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.828221][T10115] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1222.848413][T10115] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.990903][T12550] FAULT_INJECTION: forcing a failure. [ 1222.990903][T12550] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1223.006203][T12550] CPU: 0 UID: 0 PID: 12550 Comm: syz.1.10609 Not tainted syzkaller #0 PREEMPT(full) [ 1223.006231][T12550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1223.006243][T12550] Call Trace: [ 1223.006251][T12550] [ 1223.006260][T12550] dump_stack_lvl+0xe8/0x150 [ 1223.006293][T12550] should_fail_ex+0x412/0x560 [ 1223.006323][T12550] _copy_from_user+0x2d/0xb0 [ 1223.006351][T12550] ___sys_sendmsg+0x1c6/0x360 [ 1223.006378][T12550] ? __lock_acquire+0x6b5/0x2cf0 [ 1223.006410][T12550] ? __pfx____sys_sendmsg+0x10/0x10 [ 1223.006435][T12550] ? __lock_acquire+0x6b5/0x2cf0 [ 1223.006467][T12550] ? kstrtouint+0x6e/0xe0 [ 1223.006545][T12550] __sys_sendmmsg+0x27c/0x4e0 [ 1223.006580][T12550] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1223.006602][T12550] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1223.006658][T12550] ? ksys_write+0x242/0x270 [ 1223.006690][T12550] ? __pfx_ksys_write+0x10/0x10 [ 1223.006726][T12550] __x64_sys_sendmmsg+0xa0/0xc0 [ 1223.006757][T12550] do_syscall_64+0xe2/0xf80 [ 1223.006781][T12550] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1223.006800][T12550] ? trace_irq_disable+0x37/0x100 [ 1223.006819][T12550] ? clear_bhb_loop+0x60/0xb0 [ 1223.006844][T12550] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1223.006863][T12550] RIP: 0033:0x7fc92879aeb9 [ 1223.006895][T12550] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1223.006913][T12550] RSP: 002b:00007fc929624028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1223.006935][T12550] RAX: ffffffffffffffda RBX: 00007fc928a15fa0 RCX: 00007fc92879aeb9 [ 1223.006950][T12550] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1223.006963][T12550] RBP: 00007fc929624090 R08: 0000000000000000 R09: 0000000000000000 [ 1223.006976][T12550] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1223.006989][T12550] R13: 00007fc928a16038 R14: 00007fc928a15fa0 R15: 00007fff41868238 [ 1223.007022][T12550] [ 1223.260410][T12556] IPVS: set_ctl: invalid protocol: 94 0.0.0.0:21 [ 1223.346584][T12546] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1223.358222][T12546] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1223.468167][T12546] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1223.482480][T12546] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1223.556792][T12565] netlink: 'syz.0.10611': attribute type 10 has an invalid length. [ 1223.558610][T12546] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1223.579177][T12546] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1223.611323][T12573] netlink: 'syz.0.10611': attribute type 10 has an invalid length. [ 1223.632438][T12565] team0: Failed to send options change via netlink (err -105) [ 1223.653448][T12565] team0: Port device dummy0 added [ 1223.662551][T12573] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 1223.723781][T12573] team0: Failed to send options change via netlink (err -105) [ 1223.752700][T12573] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 1223.776877][T12573] team0: Port device dummy0 removed [ 1223.798030][T12582] tipc: Enabling of bearer rejected, already enabled [ 1223.830892][T12546] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1223.841741][T12546] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1223.938061][T12576] ªªªªª9 speed is unknown, defaulting to 1000 [ 1224.036625][T10115] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1224.056596][T10115] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1224.131187][T23838] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1224.141066][T23838] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1224.165082][T23838] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1224.174214][T23838] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1224.202722][T12591] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1224.255776][T12591] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1224.319252][T12601] Set syz0 is full, maxelem 0 reached [ 1224.357079][T10115] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1224.370014][T10115] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1224.422383][T12591] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1224.439903][T12591] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1224.536935][T12591] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1224.547321][T12591] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1224.578644][T12576] virt_wifi0 speed is unknown, defaulting to 1000 [ 1224.594540][T12604] netlink: 'syz.1.10623': attribute type 1 has an invalid length. [ 1224.641727][T12604] bond4: entered promiscuous mode [ 1224.648071][T12604] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1224.656166][T12576] wg1 speed is unknown, defaulting to 1000 [ 1224.665598][T12591] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1224.679317][T12591] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1224.723866][T12612] bond4: (slave bridge6): making interface the new active one [ 1224.733761][T12612] bridge6: entered promiscuous mode [ 1224.742477][T12612] bond4: (slave bridge6): Enslaving as an active interface with an up link [ 1225.188252][T12623] netlink: 'syz.4.10624': attribute type 1 has an invalid length. [ 1225.227380][T12623] bond2: (slave geneve4): making interface the new active one [ 1225.236573][T12623] bond2: (slave geneve4): Enslaving as an active interface with an up link [ 1225.245983][T23856] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 1225.255867][T23856] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 1225.265010][T23856] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 1225.274923][T23856] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 1225.559713][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6220 ms [ 1225.567894][ C0] lec:lec_tx_timeout: lec0 [ 1225.572768][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1225.669915][T12635] netlink: 'syz.4.10628': attribute type 4 has an invalid length. [ 1225.677991][T12635] __nla_validate_parse: 9 callbacks suppressed [ 1225.678011][T12635] netlink: 152 bytes leftover after parsing attributes in process `syz.4.10628'. [ 1225.706650][T12635] .`: renamed from bond0 (while UP) [ 1226.211395][T23835] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1226.219917][T23835] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1226.235825][T23835] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1226.244875][T23835] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1226.261575][T10115] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1226.270780][T10115] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1226.287783][T10115] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1226.296683][T10115] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1226.422253][T12654] ªªªªª9 speed is unknown, defaulting to 1000 [ 1226.585019][T12654] virt_wifi0 speed is unknown, defaulting to 1000 [ 1226.593842][T12654] wg1 speed is unknown, defaulting to 1000 [ 1227.480823][ T11] block nbd3: Possible stuck request ffff888025998000: control (read@0,1024B). Runtime 270 seconds [ 1227.491905][ T11] block nbd3: Possible stuck request ffff888025998200: control (read@1024,1024B). Runtime 270 seconds [ 1227.574024][T12606] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1227.786527][T12675] netlink: 200 bytes leftover after parsing attributes in process `syz.4.10640'. [ 1227.849237][T12673] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1227.858102][T12682] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1227.868446][T12682] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1227.902874][T12682] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1227.921325][T12682] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1227.934000][T12684] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1227.945343][T12684] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1227.955652][T12684] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1228.012806][T12680] ªªªªª9 speed is unknown, defaulting to 1000 [ 1228.047057][T12684] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1228.082494][T12684] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1228.103180][T12684] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1228.173110][T12695] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10645'. [ 1228.185456][T12693] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10645'. [ 1228.280405][T12684] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1228.299886][T12684] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1228.313569][T12684] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1228.406081][T12684] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1228.453854][T12684] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1228.472568][T12684] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1228.535057][T12680] virt_wifi0 speed is unknown, defaulting to 1000 [ 1228.543931][T12680] wg1 speed is unknown, defaulting to 1000 [ 1228.565282][T12709] netlink: 'syz.0.10647': attribute type 1 has an invalid length. [ 1228.575530][T12709] netlink: 224 bytes leftover after parsing attributes in process `syz.0.10647'. [ 1228.714505][T23838] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1228.723120][T23838] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1228.732965][T23838] netdevsim netdevsim4 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 1228.892893][T23838] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1228.930463][T23838] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1228.970701][T23838] netdevsim netdevsim4 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 1229.049848][T23844] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1229.058177][T23844] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1229.081979][T23844] netdevsim netdevsim4 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 1229.169864][T12719] batman_adv: batadv0: Adding interface: dummy0 [ 1229.176261][T12719] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1229.221657][T12719] batman_adv: batadv0: Interface activated: dummy0 [ 1229.244209][T23844] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1229.261470][T23844] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1229.273745][T23844] netdevsim netdevsim4 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 1229.282573][T12720] ªªªªª9 speed is unknown, defaulting to 1000 [ 1229.616298][T12743] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10655'. [ 1229.887941][T12720] virt_wifi0 speed is unknown, defaulting to 1000 [ 1229.907292][T12720] wg1 speed is unknown, defaulting to 1000 [ 1229.916355][T12715] infiniband syz1: set active [ 1229.929952][T12715] infiniband syz1: added bond0 [ 1229.937349][T12715] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1229.964466][T12715] infiniband syz1: Couldn't open port 1 [ 1230.047823][T12715] RDS/IB: syz1: added [ 1230.062818][T12715] smc: adding ib device syz1 with port count 1 [ 1230.077992][T12715] smc: ib device syz1 port 1 has no pnetid [ 1230.274211][T12769] FAULT_INJECTION: forcing a failure. [ 1230.274211][T12769] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1230.315264][T12769] CPU: 0 UID: 0 PID: 12769 Comm: syz.4.10664 Not tainted syzkaller #0 PREEMPT(full) [ 1230.315294][T12769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1230.315306][T12769] Call Trace: [ 1230.315314][T12769] [ 1230.315321][T12769] dump_stack_lvl+0xe8/0x150 [ 1230.315351][T12769] should_fail_ex+0x412/0x560 [ 1230.315390][T12769] _copy_from_user+0x2d/0xb0 [ 1230.315420][T12769] ___sys_sendmsg+0x1c6/0x360 [ 1230.315447][T12769] ? __lock_acquire+0x6b5/0x2cf0 [ 1230.315479][T12769] ? __pfx____sys_sendmsg+0x10/0x10 [ 1230.315503][T12769] ? __lock_acquire+0x6b5/0x2cf0 [ 1230.315535][T12769] ? kstrtouint+0x6e/0xe0 [ 1230.315594][T12769] __sys_sendmmsg+0x27c/0x4e0 [ 1230.315625][T12769] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1230.315649][T12769] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1230.315700][T12769] ? ksys_write+0x242/0x270 [ 1230.315731][T12769] ? __pfx_ksys_write+0x10/0x10 [ 1230.315762][T12769] __x64_sys_sendmmsg+0xa0/0xc0 [ 1230.315792][T12769] do_syscall_64+0xe2/0xf80 [ 1230.315815][T12769] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.315834][T12769] ? trace_irq_disable+0x37/0x100 [ 1230.315851][T12769] ? clear_bhb_loop+0x60/0xb0 [ 1230.315875][T12769] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.315892][T12769] RIP: 0033:0x7f4f0fd9aeb9 [ 1230.315911][T12769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1230.315927][T12769] RSP: 002b:00007f4f10c4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1230.315949][T12769] RAX: ffffffffffffffda RBX: 00007f4f10015fa0 RCX: 00007f4f0fd9aeb9 [ 1230.315963][T12769] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1230.315975][T12769] RBP: 00007f4f10c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1230.315987][T12769] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1230.315999][T12769] R13: 00007f4f10016038 R14: 00007f4f10015fa0 R15: 00007ffe41d821d8 [ 1230.316032][T12769] [ 1230.671577][T12775] netlink: 'syz.1.10667': attribute type 1 has an invalid length. [ 1230.752953][T12775] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1230.767758][T12779] batman_adv: batadv0: Interface deactivated: dummy0 [ 1230.779308][T12779] batman_adv: batadv0: Removing interface: dummy0 [ 1230.795828][T12779] bond5: (slave dummy0): making interface the new active one [ 1230.805630][T12779] bond5: (slave dummy0): Enslaving as an active interface with an up link [ 1230.881230][T12785] __nla_validate_parse: 5 callbacks suppressed [ 1230.881250][T12785] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10668'. [ 1231.181688][T12794] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10671'. [ 1231.319606][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 1231.327729][ C0] lec:lec_tx_timeout: lec0 [ 1231.332905][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1231.593863][T12809] FAULT_INJECTION: forcing a failure. [ 1231.593863][T12809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1231.611229][T12809] CPU: 0 UID: 0 PID: 12809 Comm: syz.4.10676 Not tainted syzkaller #0 PREEMPT(full) [ 1231.611257][T12809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1231.611270][T12809] Call Trace: [ 1231.611278][T12809] [ 1231.611288][T12809] dump_stack_lvl+0xe8/0x150 [ 1231.611320][T12809] should_fail_ex+0x412/0x560 [ 1231.611350][T12809] _copy_from_user+0x2d/0xb0 [ 1231.611377][T12809] ___sys_sendmsg+0x1c6/0x360 [ 1231.611403][T12809] ? __lock_acquire+0x6b5/0x2cf0 [ 1231.611435][T12809] ? __pfx____sys_sendmsg+0x10/0x10 [ 1231.611459][T12809] ? __lock_acquire+0x6b5/0x2cf0 [ 1231.611489][T12809] ? kstrtouint+0x6e/0xe0 [ 1231.611554][T12809] __sys_sendmmsg+0x27c/0x4e0 [ 1231.611586][T12809] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1231.611611][T12809] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1231.611667][T12809] ? ksys_write+0x242/0x270 [ 1231.611699][T12809] ? __pfx_ksys_write+0x10/0x10 [ 1231.611734][T12809] __x64_sys_sendmmsg+0xa0/0xc0 [ 1231.611764][T12809] do_syscall_64+0xe2/0xf80 [ 1231.611790][T12809] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.611808][T12809] ? trace_irq_disable+0x37/0x100 [ 1231.611827][T12809] ? clear_bhb_loop+0x60/0xb0 [ 1231.611859][T12809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1231.611878][T12809] RIP: 0033:0x7f4f0fd9aeb9 [ 1231.611897][T12809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1231.611913][T12809] RSP: 002b:00007f4f10c4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1231.611936][T12809] RAX: ffffffffffffffda RBX: 00007f4f10015fa0 RCX: 00007f4f0fd9aeb9 [ 1231.611950][T12809] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1231.611964][T12809] RBP: 00007f4f10c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1231.611976][T12809] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1231.611988][T12809] R13: 00007f4f10016038 R14: 00007f4f10015fa0 R15: 00007ffe41d821d8 [ 1231.612022][T12809] [ 1232.373747][T12829] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10682'. [ 1232.547733][T12832] netlink: 'syz.1.10683': attribute type 2 has an invalid length. [ 1233.329985][T12815] ªªªªª9 speed is unknown, defaulting to 1000 [ 1233.571790][T12840] FAULT_INJECTION: forcing a failure. [ 1233.571790][T12840] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1233.590151][T30902] batadv1: left promiscuous mode [ 1233.629808][T12840] CPU: 0 UID: 0 PID: 12840 Comm: syz.2.10687 Not tainted syzkaller #0 PREEMPT(full) [ 1233.629839][T12840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1233.629852][T12840] Call Trace: [ 1233.629860][T12840] [ 1233.629870][T12840] dump_stack_lvl+0xe8/0x150 [ 1233.629903][T12840] should_fail_ex+0x412/0x560 [ 1233.629933][T12840] _copy_from_user+0x2d/0xb0 [ 1233.629965][T12840] ___sys_sendmsg+0x1c6/0x360 [ 1233.630003][T12840] ? __lock_acquire+0x6b5/0x2cf0 [ 1233.630053][T12840] ? __pfx____sys_sendmsg+0x10/0x10 [ 1233.630077][T12840] ? __lock_acquire+0x6b5/0x2cf0 [ 1233.630110][T12840] ? kstrtouint+0x6e/0xe0 [ 1233.630180][T12840] __sys_sendmmsg+0x27c/0x4e0 [ 1233.630215][T12840] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1233.630240][T12840] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1233.630296][T12840] ? ksys_write+0x242/0x270 [ 1233.630327][T12840] ? __pfx_ksys_write+0x10/0x10 [ 1233.630364][T12840] __x64_sys_sendmmsg+0xa0/0xc0 [ 1233.630395][T12840] do_syscall_64+0xe2/0xf80 [ 1233.630420][T12840] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1233.630439][T12840] ? trace_irq_disable+0x37/0x100 [ 1233.630458][T12840] ? clear_bhb_loop+0x60/0xb0 [ 1233.630482][T12840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1233.630502][T12840] RIP: 0033:0x7fbc8c99aeb9 [ 1233.630521][T12840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1233.630539][T12840] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1233.630562][T12840] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1233.630576][T12840] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1233.630590][T12840] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1233.630603][T12840] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1233.630615][T12840] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1233.630649][T12840] [ 1233.909294][T12815] virt_wifi0 speed is unknown, defaulting to 1000 [ 1233.926884][T12815] wg1 speed is unknown, defaulting to 1000 [ 1234.817907][T12867] netlink: 'syz.2.10698': attribute type 1 has an invalid length. [ 1234.918844][T12867] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1234.936090][T12870] vlan2: entered promiscuous mode [ 1234.969844][T12870] bond6: entered promiscuous mode [ 1234.975779][T12870] vlan2: entered allmulticast mode [ 1234.989999][T12870] bond6: entered allmulticast mode [ 1235.020158][T12872] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1235.030453][T12867] bond6: (slave bridge2): making interface the new active one [ 1235.038170][T12867] bridge2: entered promiscuous mode [ 1235.044529][T12867] bridge2: entered allmulticast mode [ 1235.051309][T12872] netlink: 'syz.3.10699': attribute type 1 has an invalid length. [ 1235.079832][T12867] bond6: (slave bridge2): Enslaving as an active interface with an up link [ 1235.364853][T12876] syzkaller1: entered promiscuous mode [ 1235.371097][T12876] syzkaller1: entered allmulticast mode [ 1235.614266][T12902] netlink: 108 bytes leftover after parsing attributes in process `syz.2.10708'. [ 1236.007026][T12929] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1236.046222][T12930] ªªªªª9 speed is unknown, defaulting to 1000 [ 1236.104711][T12939] gtp0: entered promiscuous mode [ 1236.139696][T12939] gtp0: entered allmulticast mode [ 1236.374721][T12930] virt_wifi0 speed is unknown, defaulting to 1000 [ 1236.384101][T12930] wg1 speed is unknown, defaulting to 1000 [ 1236.626187][T12954] mac80211_hwsim hwsim86 wlan0: entered promiscuous mode [ 1236.633682][T12954] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1237.160067][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5830 ms [ 1237.168251][ C0] lec:lec_tx_timeout: lec0 [ 1237.173786][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1237.288084][T12969] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10730'. [ 1237.316308][T12969] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10730'. [ 1238.640625][T12907] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1238.662882][T12953] netlink: 'syz.4.10723': attribute type 1 has an invalid length. [ 1238.682145][T12953] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10723'. [ 1238.710072][T12982] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10736'. [ 1239.008842][ T1299] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1239.600373][T13036] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10751'. [ 1239.612919][T13036] openvswitch: netlink: Flow actions attr not present in new flow. [ 1239.636674][T13036] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.10751'. [ 1239.741795][T13043] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10755'. [ 1239.815349][T13046] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10756'. [ 1239.992934][T13049] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10756'. [ 1240.079328][T13046] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10756'. [ 1240.951227][T13083] bridge0: port 2(bridge_slave_1) entered blocking state [ 1240.958603][T13083] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1240.966328][T13083] bridge0: port 1(bridge_slave_0) entered blocking state [ 1240.973558][T13083] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1241.034413][T13083] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1241.075246][T13074] ªªªªª9 speed is unknown, defaulting to 1000 [ 1241.235988][T13096] ªªªªª9 speed is unknown, defaulting to 1000 [ 1241.369266][T13074] virt_wifi0 speed is unknown, defaulting to 1000 [ 1241.392234][T13074] wg1 speed is unknown, defaulting to 1000 [ 1241.495560][T13108] netlink: 'syz.4.10777': attribute type 2 has an invalid length. [ 1241.528676][T13108] : entered promiscuous mode [ 1241.903642][T13096] virt_wifi0 speed is unknown, defaulting to 1000 [ 1241.955976][T13096] wg1 speed is unknown, defaulting to 1000 [ 1242.189698][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1242.197891][ C0] lec:lec_tx_timeout: lec0 [ 1242.203253][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1242.210888][T13132] xt_hashlimit: size too large, truncated to 1048576 [ 1242.217915][T13132] xt_hashlimit: overflow, try lower: 0/0 [ 1242.539954][T13142] __nla_validate_parse: 4 callbacks suppressed [ 1242.539973][T13142] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10785'. [ 1242.580319][T13142] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10785'. [ 1242.603329][T13138] netlink: 240 bytes leftover after parsing attributes in process `syz.3.10784'. [ 1242.619932][T13138] netlink: 'syz.3.10784': attribute type 9 has an invalid length. [ 1243.084318][T13148] bond3: option ad_select: invalid value (34) [ 1243.152728][T13148] bond3 (unregistering): Released all slaves [ 1243.663398][T13160] netlink: 'syz.4.10789': attribute type 1 has an invalid length. [ 1243.817048][T13160] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1243.884431][T13165] vlan3: entered allmulticast mode [ 1243.898089][T13165] dummy0: entered allmulticast mode [ 1243.908702][T13165] bond3: (slave vlan3): Error -34 calling dev_set_mtu [ 1244.113061][T13178] ªªªªª9 speed is unknown, defaulting to 1000 [ 1244.524983][T13199] ip6t_srh: unknown srh match flags 4000 [ 1244.564099][T13178] virt_wifi0 speed is unknown, defaulting to 1000 [ 1244.573593][T13178] wg1 speed is unknown, defaulting to 1000 [ 1244.614178][T13199] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10802'. [ 1244.644042][T13199] netlink: 'syz.4.10802': attribute type 7 has an invalid length. [ 1244.660310][T13199] netlink: 'syz.4.10802': attribute type 8 has an invalid length. [ 1244.688718][T13199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10802'. [ 1244.781918][T13210] netlink: 'syz.2.10803': attribute type 2 has an invalid length. [ 1245.404307][T13238] FAULT_INJECTION: forcing a failure. [ 1245.404307][T13238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1245.432326][T13238] CPU: 1 UID: 0 PID: 13238 Comm: syz.2.10813 Not tainted syzkaller #0 PREEMPT(full) [ 1245.432356][T13238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1245.432369][T13238] Call Trace: [ 1245.432378][T13238] [ 1245.432387][T13238] dump_stack_lvl+0xe8/0x150 [ 1245.432418][T13238] should_fail_ex+0x412/0x560 [ 1245.432447][T13238] _copy_from_user+0x2d/0xb0 [ 1245.432474][T13238] ___sys_sendmsg+0x1c6/0x360 [ 1245.432499][T13238] ? __lock_acquire+0x6b5/0x2cf0 [ 1245.432528][T13238] ? __pfx____sys_sendmsg+0x10/0x10 [ 1245.432551][T13238] ? __lock_acquire+0x6b5/0x2cf0 [ 1245.432581][T13238] ? kstrtouint+0x6e/0xe0 [ 1245.432644][T13238] __sys_sendmmsg+0x27c/0x4e0 [ 1245.432675][T13238] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1245.432698][T13238] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1245.432750][T13238] ? ksys_write+0x242/0x270 [ 1245.432780][T13238] ? __pfx_ksys_write+0x10/0x10 [ 1245.432814][T13238] __x64_sys_sendmmsg+0xa0/0xc0 [ 1245.432843][T13238] do_syscall_64+0xe2/0xf80 [ 1245.432865][T13238] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1245.432882][T13238] ? trace_irq_disable+0x37/0x100 [ 1245.432899][T13238] ? clear_bhb_loop+0x60/0xb0 [ 1245.432920][T13238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1245.432938][T13238] RIP: 0033:0x7fbc8c99aeb9 [ 1245.432958][T13238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1245.432975][T13238] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1245.432996][T13238] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1245.433011][T13238] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1245.433024][T13238] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1245.433035][T13238] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1245.433046][T13238] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1245.433079][T13238] [ 1245.734861][T13236] ªªªªª9 speed is unknown, defaulting to 1000 [ 1245.972651][T13236] virt_wifi0 speed is unknown, defaulting to 1000 [ 1245.991848][T13236] wg1 speed is unknown, defaulting to 1000 [ 1246.446627][T13270] tipc: Enabled bearer , priority 0 [ 1246.465167][T13270] syzkaller0: entered promiscuous mode [ 1246.494048][T13270] syzkaller0: entered allmulticast mode [ 1246.693785][T13270] tipc: Resetting bearer [ 1246.722601][T13269] tipc: Resetting bearer [ 1246.790895][T13269] tipc: Disabling bearer [ 1246.832866][T13283] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10826'. [ 1246.849878][T13283] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10826'. [ 1247.162304][T13292] netlink: 'syz.3.10830': attribute type 39 has an invalid length. [ 1247.209701][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1247.218006][ C0] lec:lec_tx_timeout: lec0 [ 1247.223061][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1247.843233][T13307] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10835'. [ 1250.070260][T13307] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10835'. [ 1250.679007][T13341] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10845'. [ 1250.888251][T13356] lo: Caught tx_queue_len zero misconfig [ 1250.888637][T13352] ªªªªª9 speed is unknown, defaulting to 1000 [ 1250.917723][T13349] ªªªªª9 speed is unknown, defaulting to 1000 [ 1251.115825][T13365] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10850'. [ 1251.125480][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10850'. [ 1252.231723][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1252.239850][ C0] lec:lec_tx_timeout: lec0 [ 1252.244824][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1253.772543][T13365] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10850'. [ 1253.790000][T13365] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10850'. [ 1253.807258][T13370] syzkaller0: entered promiscuous mode [ 1253.814371][T13370] syzkaller0: entered allmulticast mode [ 1253.827097][T13352] virt_wifi0 speed is unknown, defaulting to 1000 [ 1253.940124][T13352] wg1 speed is unknown, defaulting to 1000 [ 1254.452629][T13393] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10856'. [ 1256.805624][T13349] virt_wifi0 speed is unknown, defaulting to 1000 [ 1256.827952][T13399] kthread_run failed with err -4 [ 1256.836523][T13349] wg1 speed is unknown, defaulting to 1000 [ 1257.103849][T13413] netlink: 'syz.2.10862': attribute type 1 has an invalid length. [ 1257.126621][T13413] netlink: 224 bytes leftover after parsing attributes in process `syz.2.10862'. [ 1257.144088][T13415] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10863'. [ 1257.163772][T13415] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10863'. [ 1257.212137][T13418] netlink: 36 bytes leftover after parsing attributes in process `syz.2.10862'. [ 1257.226578][T13415] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10863'. [ 1257.250064][T13415] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10863'. [ 1257.259733][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1257.268247][ C0] lec:lec_tx_timeout: lec0 [ 1257.274902][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1257.504922][T13422] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10865'. [ 1257.536202][T13422] Bluetooth: MGMT ver 1.23 [ 1257.563785][ T11] block nbd3: Possible stuck request ffff888025998000: control (read@0,1024B). Runtime 300 seconds [ 1257.580421][ T11] block nbd3: Possible stuck request ffff888025998200: control (read@1024,1024B). Runtime 300 seconds [ 1257.880027][T13428] netlink: 'syz.3.10867': attribute type 2 has an invalid length. [ 1257.888025][T13428] netlink: 'syz.3.10867': attribute type 1 has an invalid length. [ 1257.896913][T13428] netlink: 'syz.3.10867': attribute type 1 has an invalid length. [ 1258.184825][T13431] ªªªªª9 speed is unknown, defaulting to 1000 [ 1258.330725][T13442] syzkaller0: entered promiscuous mode [ 1258.336614][T13442] syzkaller0: entered allmulticast mode [ 1258.562045][T13431] virt_wifi0 speed is unknown, defaulting to 1000 [ 1258.573095][T13431] wg1 speed is unknown, defaulting to 1000 [ 1258.892882][T13454] ªªªªª9 speed is unknown, defaulting to 1000 [ 1259.121470][T13454] virt_wifi0 speed is unknown, defaulting to 1000 [ 1259.129358][T13454] wg1 speed is unknown, defaulting to 1000 [ 1259.257976][T13439] rdma_rxe: rxe_newlink: failed to add bond_slave_0 [ 1259.650046][ T52] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 1259.658113][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 1260.606715][T13498] ªªªªª9 speed is unknown, defaulting to 1000 [ 1260.858878][T13514] __nla_validate_parse: 1 callbacks suppressed [ 1260.858901][T13514] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10893'. [ 1260.892024][T13514] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10893'. [ 1260.952065][T13518] netlink: 'syz.2.10894': attribute type 1 has an invalid length. [ 1261.141963][T13518] bond7 (unregistering): Released all slaves [ 1261.305194][T13529] netlink: 185772 bytes leftover after parsing attributes in process `syz.1.10898'. [ 1261.313061][T13527] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 1261.323681][T13527] openvswitch: netlink: Message has 16 unknown bytes. [ 1261.550167][T13498] virt_wifi0 speed is unknown, defaulting to 1000 [ 1261.595737][T13498] wg1 speed is unknown, defaulting to 1000 [ 1262.128099][T13564] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10910'. [ 1262.139433][T13563] netlink: 28 bytes leftover after parsing attributes in process `syz.1.10908'. [ 1262.289974][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1262.298174][ C0] lec:lec_tx_timeout: lec0 [ 1262.575426][T13571] FAULT_INJECTION: forcing a failure. [ 1262.575426][T13571] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1262.588885][T13571] CPU: 1 UID: 0 PID: 13571 Comm: syz.0.10913 Not tainted syzkaller #0 PREEMPT(full) [ 1262.588914][T13571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1262.588926][T13571] Call Trace: [ 1262.588938][T13571] [ 1262.588949][T13571] dump_stack_lvl+0xe8/0x150 [ 1262.588981][T13571] should_fail_ex+0x412/0x560 [ 1262.589010][T13571] _copy_from_user+0x2d/0xb0 [ 1262.589031][T13571] bpf_test_init+0xd8/0x150 [ 1262.589047][T13571] bpf_prog_test_run_xdp+0x529/0x1160 [ 1262.589070][T13571] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1262.589086][T13571] ? __fget_files+0x2a/0x420 [ 1262.589102][T13571] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1262.589117][T13571] bpf_prog_test_run+0x2c7/0x340 [ 1262.589132][T13571] __sys_bpf+0x5cb/0x920 [ 1262.589145][T13571] ? __pfx___sys_bpf+0x10/0x10 [ 1262.589166][T13571] ? ksys_write+0x242/0x270 [ 1262.589184][T13571] ? __pfx_ksys_write+0x10/0x10 [ 1262.589205][T13571] __x64_sys_bpf+0x7c/0x90 [ 1262.589223][T13571] do_syscall_64+0xe2/0xf80 [ 1262.589239][T13571] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1262.589250][T13571] ? trace_irq_disable+0x37/0x100 [ 1262.589261][T13571] ? clear_bhb_loop+0x60/0xb0 [ 1262.589275][T13571] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1262.589287][T13571] RIP: 0033:0x7fd5e4b9aeb9 [ 1262.589299][T13571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1262.589309][T13571] RSP: 002b:00007fd5e5a3b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1262.589323][T13571] RAX: ffffffffffffffda RBX: 00007fd5e4e15fa0 RCX: 00007fd5e4b9aeb9 [ 1262.589332][T13571] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 1262.589340][T13571] RBP: 00007fd5e5a3b090 R08: 0000000000000000 R09: 0000000000000000 [ 1262.589347][T13571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1262.589354][T13571] R13: 00007fd5e4e16038 R14: 00007fd5e4e15fa0 R15: 00007ffde2120468 [ 1262.589373][T13571] [ 1264.400419][T13531] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1264.615230][T13580] siw: device registration error -23 [ 1264.808092][T13587] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10919'. [ 1264.917529][T13598] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10924'. [ 1264.961750][T13606] netlink: 'syz.4.10925': attribute type 3 has an invalid length. [ 1264.989530][T13606] syz_tun: entered allmulticast mode [ 1265.093090][T13606] netlink: 120 bytes leftover after parsing attributes in process `syz.4.10925'. [ 1265.131883][T13604] syz_tun: left allmulticast mode [ 1265.507080][T13623] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.10930'. [ 1265.595783][T13632] netlink: 'syz.4.10930': attribute type 1 has an invalid length. [ 1265.609620][T13630] Bluetooth: hci4: Opcode 0x0401 failed: -22 [ 1265.808948][T13643] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10939'. [ 1265.895248][T13647] __nla_validate_parse: 1 callbacks suppressed [ 1265.895271][T13647] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10939'. [ 1265.992727][T13652] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10940'. [ 1266.063813][T13656] FAULT_INJECTION: forcing a failure. [ 1266.063813][T13656] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1266.191880][T13656] CPU: 0 UID: 0 PID: 13656 Comm: syz.4.10942 Not tainted syzkaller #0 PREEMPT(full) [ 1266.191910][T13656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1266.191923][T13656] Call Trace: [ 1266.191932][T13656] [ 1266.191941][T13656] dump_stack_lvl+0xe8/0x150 [ 1266.191974][T13656] should_fail_ex+0x412/0x560 [ 1266.192005][T13656] _copy_from_user+0x2d/0xb0 [ 1266.192035][T13656] ___sys_sendmsg+0x1c6/0x360 [ 1266.192071][T13656] ? __pfx____sys_sendmsg+0x10/0x10 [ 1266.192123][T13656] ? lockdep_hardirqs_on+0x7a/0x110 [ 1266.192181][T13656] __sys_sendmmsg+0x27c/0x4e0 [ 1266.192216][T13656] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1266.192241][T13656] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1266.192298][T13656] ? ksys_write+0x242/0x270 [ 1266.192329][T13656] ? __pfx_ksys_write+0x10/0x10 [ 1266.192366][T13656] __x64_sys_sendmmsg+0xa0/0xc0 [ 1266.192397][T13656] do_syscall_64+0xe2/0xf80 [ 1266.192424][T13656] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1266.192443][T13656] ? trace_irq_disable+0x37/0x100 [ 1266.192462][T13656] ? clear_bhb_loop+0x60/0xb0 [ 1266.192486][T13656] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1266.192505][T13656] RIP: 0033:0x7f4f0fd9aeb9 [ 1266.192524][T13656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1266.192540][T13656] RSP: 002b:00007f4f10c4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1266.192571][T13656] RAX: ffffffffffffffda RBX: 00007f4f10015fa0 RCX: 00007f4f0fd9aeb9 [ 1266.192585][T13656] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1266.192598][T13656] RBP: 00007f4f10c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1266.192610][T13656] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1266.192622][T13656] R13: 00007f4f10016038 R14: 00007f4f10015fa0 R15: 00007ffe41d821d8 [ 1266.192663][T13656] [ 1266.553070][T13674] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10944'. [ 1266.635673][T13678] vlan0: entered promiscuous mode [ 1266.671153][T13674] vlan0: entered promiscuous mode [ 1266.807849][T13688] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1266.826380][T13688] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1266.866022][T13690] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10951'. [ 1266.902332][T13688] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1266.916452][T13688] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1266.959783][T13689] ªªªªª9 speed is unknown, defaulting to 1000 [ 1266.992442][T13688] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1267.003397][T13688] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.082437][T13688] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1267.092870][T13688] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1267.446871][T23844] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1267.460828][T23844] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1267.507396][T23838] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1267.516101][T23838] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1267.579396][T23838] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1267.594578][T23838] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1267.624940][T23838] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1267.643471][T23838] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1267.711389][T13717] netlink: 508 bytes leftover after parsing attributes in process `syz.2.10961'. [ 1267.720411][T13689] virt_wifi0 speed is unknown, defaulting to 1000 [ 1267.730484][T13689] wg1 speed is unknown, defaulting to 1000 [ 1267.924396][T13722] FAULT_INJECTION: forcing a failure. [ 1267.924396][T13722] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1267.949309][T13722] CPU: 0 UID: 0 PID: 13722 Comm: syz.2.10964 Not tainted syzkaller #0 PREEMPT(full) [ 1267.949339][T13722] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1267.949353][T13722] Call Trace: [ 1267.949362][T13722] [ 1267.949371][T13722] dump_stack_lvl+0xe8/0x150 [ 1267.949404][T13722] should_fail_ex+0x412/0x560 [ 1267.949435][T13722] _copy_to_user+0x31/0xb0 [ 1267.949467][T13722] simple_read_from_buffer+0xe1/0x170 [ 1267.949494][T13722] proc_fail_nth_read+0x1bb/0x230 [ 1267.949525][T13722] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1267.949560][T13722] ? rw_verify_area+0x2a6/0x4d0 [ 1267.949584][T13722] ? __fget_files+0x2a/0x420 [ 1267.949603][T13722] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1267.949629][T13722] vfs_read+0x20c/0xa70 [ 1267.949654][T13722] ? fdget_pos+0x246/0x320 [ 1267.949679][T13722] ? __pfx___mutex_lock+0x10/0x10 [ 1267.949705][T13722] ? __pfx_vfs_read+0x10/0x10 [ 1267.949732][T13722] ? __fget_files+0x2a/0x420 [ 1267.949758][T13722] ? __fget_files+0x3a0/0x420 [ 1267.949777][T13722] ? __fget_files+0x2a/0x420 [ 1267.949807][T13722] ksys_read+0x150/0x270 [ 1267.949836][T13722] ? __pfx_ksys_read+0x10/0x10 [ 1267.949884][T13722] do_syscall_64+0xe2/0xf80 [ 1267.949908][T13722] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1267.949926][T13722] ? trace_irq_disable+0x37/0x100 [ 1267.949945][T13722] ? clear_bhb_loop+0x60/0xb0 [ 1267.949970][T13722] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1267.949988][T13722] RIP: 0033:0x7fbc8c95b78e [ 1267.950008][T13722] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1267.950026][T13722] RSP: 002b:00007fbc8d874fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1267.950057][T13722] RAX: ffffffffffffffda RBX: 00007fbc8d8756c0 RCX: 00007fbc8c95b78e [ 1267.950071][T13722] RDX: 000000000000000f RSI: 00007fbc8d8750a0 RDI: 0000000000000005 [ 1267.950082][T13722] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1267.950093][T13722] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1267.950105][T13722] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1267.950138][T13722] [ 1268.274017][T13728] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10963'. [ 1268.536335][T13736] veth0_to_bond: entered promiscuous mode [ 1268.640963][T13738] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10966'. [ 1268.887918][T13751] netlink: 'syz.2.10972': attribute type 10 has an invalid length. [ 1268.896588][T13751] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10972'. [ 1268.922789][T13751] batadv0: entered promiscuous mode [ 1268.928143][T13751] batadv0: entered allmulticast mode [ 1268.974469][T13751] bridge0: port 3(batadv0) entered blocking state [ 1268.990455][T13751] bridge0: port 3(batadv0) entered disabled state [ 1269.027381][T13751] bridge0: port 3(batadv0) entered blocking state [ 1269.034555][T13751] bridge0: port 3(batadv0) entered forwarding state [ 1269.098329][T13766] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10975'. [ 1269.202363][T30902] batman_adv: batadv0: IGMP Querier appeared [ 1269.208495][T30902] batman_adv: batadv0: MLD Querier appeared [ 1269.235283][T13772] netlink: 'syz.4.10971': attribute type 3 has an invalid length. [ 1269.334873][T13772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10971'. [ 1269.347788][T13760] ªªªªª9 speed is unknown, defaulting to 1000 [ 1269.369143][T13774] netlink: 'syz.1.10976': attribute type 10 has an invalid length. [ 1269.408739][T13774] batadv0: entered promiscuous mode [ 1269.436507][T13774] batadv0: entered allmulticast mode [ 1269.478894][T13774] bridge0: port 1(batadv0) entered blocking state [ 1269.577464][T13774] bridge0: port 1(batadv0) entered disabled state [ 1269.681959][T13752] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1269.704581][T13752] batadv0: mtu less than device minimum [ 1269.711301][ T510] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1269.711349][ T510] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1269.800799][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.813323][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.825498][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.837392][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.849690][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.861563][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.873511][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.885757][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1269.898125][T13752] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1270.192046][T13806] netlink: 'syz.1.10984': attribute type 13 has an invalid length. [ 1270.419013][T13760] virt_wifi0 speed is unknown, defaulting to 1000 [ 1270.432599][T13760] wg1 speed is unknown, defaulting to 1000 [ 1271.419995][T13847] __nla_validate_parse: 4 callbacks suppressed [ 1271.420018][T13847] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10998'. [ 1271.439992][T13849] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11000'. [ 1271.471218][T13847] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10998'. [ 1271.849874][T13861] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11003'. [ 1271.949125][T13866] ªªªªª9 speed is unknown, defaulting to 1000 [ 1272.170905][T13882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11009'. [ 1272.312388][T13888] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11010'. [ 1272.457869][T13886] bond6: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 1272.477034][T13886] bond6 (unregistering): Released all slaves [ 1272.508554][T13888] bridge0: port 3(batadv0) entered disabled state [ 1272.522690][T13888] bridge_slave_1: left allmulticast mode [ 1272.528386][T13888] bridge_slave_1: left promiscuous mode [ 1272.545199][T13888] bridge0: port 2(bridge_slave_1) entered disabled state [ 1272.586950][T13888] bridge_slave_0: left allmulticast mode [ 1272.593042][T13888] bridge_slave_0: left promiscuous mode [ 1272.599320][T13888] bridge0: port 1(bridge_slave_0) entered disabled state [ 1272.773760][T13866] virt_wifi0 speed is unknown, defaulting to 1000 [ 1272.782886][T13866] wg1 speed is unknown, defaulting to 1000 [ 1272.863216][T13905] bridge0: entered promiscuous mode [ 1272.870859][T13905] bridge0: port 3(macvlan2) entered blocking state [ 1272.877713][T13905] bridge0: port 3(macvlan2) entered disabled state [ 1272.910251][T13905] macvlan2: entered allmulticast mode [ 1272.918762][T13905] bridge0: entered allmulticast mode [ 1272.937195][T13905] macvlan2: left allmulticast mode [ 1272.949808][T13905] bridge0: left allmulticast mode [ 1272.960586][T13905] bridge0: left promiscuous mode [ 1272.980551][T13909] netlink: 'syz.2.11019': attribute type 13 has an invalid length. [ 1273.172088][T13916] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11022'. [ 1273.240033][ T3673] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1273.426395][T13924] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11026'. [ 1273.751094][T13942] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11031'. [ 1273.891871][ T3673] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1273.981250][T30902] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1274.074986][T13955] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11035'. [ 1274.100707][T13956] tipc: Enabling of bearer rejected, failed to enable media [ 1274.309998][T13962] ªªªªª9 speed is unknown, defaulting to 1000 [ 1274.405318][T13957] sctp: [Deprecated]: syz.3.11036 (pid 13957) Use of int in max_burst socket option. [ 1274.405318][T13957] Use struct sctp_assoc_value instead [ 1274.810062][T13982] netlink: 'syz.3.11042': attribute type 39 has an invalid length. [ 1274.888932][T13962] virt_wifi0 speed is unknown, defaulting to 1000 [ 1274.931842][T13962] wg1 speed is unknown, defaulting to 1000 [ 1275.002756][T23835] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1275.014207][T23835] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1275.141692][T13994] ªªªªª9 speed is unknown, defaulting to 1000 [ 1275.643255][T13994] virt_wifi0 speed is unknown, defaulting to 1000 [ 1275.743188][T13994] wg1 speed is unknown, defaulting to 1000 [ 1275.777122][T14004] ªªªªª9 speed is unknown, defaulting to 1000 [ 1276.040257][ T3673] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1276.361152][T14033] netlink: 'syz.4.11055': attribute type 1 has an invalid length. [ 1276.361475][T14004] virt_wifi0 speed is unknown, defaulting to 1000 [ 1276.488066][T14004] wg1 speed is unknown, defaulting to 1000 [ 1276.978168][T14059] __nla_validate_parse: 10 callbacks suppressed [ 1276.978223][T14059] netlink: 52 bytes leftover after parsing attributes in process `syz.4.11060'. [ 1277.392482][T14070] team0: Caught tx_queue_len zero misconfig [ 1278.782440][T14112] xt_TCPMSS: Only works on TCP SYN packets [ 1278.893563][T14126] netlink: 72 bytes leftover after parsing attributes in process `syz.1.11072'. [ 1278.946017][T14115] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11072'. [ 1279.079847][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1279.101754][T14109] ªªªªª9 speed is unknown, defaulting to 1000 [ 1279.264037][T14141] netlink: 'syz.1.11076': attribute type 1 has an invalid length. [ 1279.303163][T14141] netlink: 224 bytes leftover after parsing attributes in process `syz.1.11076'. [ 1279.360087][T14141] NCSI netlink: No device for ifindex 0 [ 1279.620194][T14163] net_ratelimit: 11 callbacks suppressed [ 1279.620216][T14163] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x3 [ 1279.658448][T14162] syzkaller0: entered promiscuous mode [ 1279.690876][T14162] syzkaller0: entered allmulticast mode [ 1279.921797][T14156] netlink: 'syz.1.11080': attribute type 13 has an invalid length. [ 1279.959386][T14109] virt_wifi0 speed is unknown, defaulting to 1000 [ 1279.960122][T14172] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11083'. [ 1279.973450][T14109] wg1 speed is unknown, defaulting to 1000 [ 1280.116592][T14183] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11085'. [ 1280.250760][T14190] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11087'. [ 1280.296810][T14190] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11087'. [ 1280.321365][T14196] netlink: 320 bytes leftover after parsing attributes in process `syz.3.11088'. [ 1280.375173][T14196] nbd: must specify at least one socket [ 1280.487880][T14207] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11089'. [ 1280.571345][T14205] nbd2: detected capacity change from 0 to 127 [ 1280.579178][T14209] block nbd0: reconnected socket [ 1280.639194][T14209] nbd: socks must be embedded in a SOCK_ITEM attr [ 1280.795684][ T52] block nbd0: Receive control failed (result -32) [ 1280.802549][ T5825] block nbd2: Receive control failed (result -104) [ 1281.776814][T14264] netlink: 'syz.2.11102': attribute type 3 has an invalid length. [ 1282.164831][T14282] tipc: Trying to set illegal importance in message [ 1282.236664][T14292] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1282.355031][T14298] lo: Caught tx_queue_len zero misconfig [ 1282.382680][T14299] x_tables: duplicate underflow at hook 2 [ 1282.652857][T14313] FAULT_INJECTION: forcing a failure. [ 1282.652857][T14313] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1282.687068][T14313] CPU: 1 UID: 0 PID: 14313 Comm: syz.2.11116 Not tainted syzkaller #0 PREEMPT(full) [ 1282.687099][T14313] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1282.687111][T14313] Call Trace: [ 1282.687131][T14313] [ 1282.687141][T14313] dump_stack_lvl+0xe8/0x150 [ 1282.687173][T14313] should_fail_ex+0x412/0x560 [ 1282.687202][T14313] _copy_from_user+0x2d/0xb0 [ 1282.687232][T14313] ___sys_sendmsg+0x1c6/0x360 [ 1282.687267][T14313] ? __pfx____sys_sendmsg+0x10/0x10 [ 1282.687292][T14313] ? __lock_acquire+0x6b5/0x2cf0 [ 1282.687375][T14313] __sys_sendmmsg+0x27c/0x4e0 [ 1282.687408][T14313] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1282.687433][T14313] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1282.687497][T14313] ? ksys_write+0x242/0x270 [ 1282.687528][T14313] ? __pfx_ksys_write+0x10/0x10 [ 1282.687564][T14313] __x64_sys_sendmmsg+0xa0/0xc0 [ 1282.687594][T14313] do_syscall_64+0xe2/0xf80 [ 1282.687620][T14313] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1282.687638][T14313] ? trace_irq_disable+0x37/0x100 [ 1282.687657][T14313] ? clear_bhb_loop+0x60/0xb0 [ 1282.687681][T14313] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1282.687700][T14313] RIP: 0033:0x7fbc8c99aeb9 [ 1282.687720][T14313] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1282.687736][T14313] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1282.687760][T14313] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1282.687775][T14313] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1282.687788][T14313] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1282.687801][T14313] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1282.687813][T14313] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1282.687848][T14313] [ 1282.900643][T14317] sctp: [Deprecated]: syz.4.11117 (pid 14317) Use of int in max_burst socket option deprecated. [ 1282.900643][T14317] Use struct sctp_assoc_value instead [ 1283.004787][T14317] __nla_validate_parse: 9 callbacks suppressed [ 1283.004811][T14317] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11117'. [ 1283.043578][T14317] netlink: 209852 bytes leftover after parsing attributes in process `syz.4.11117'. [ 1283.053074][T14326] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11119'. [ 1283.157448][T14326] bond7: entered promiscuous mode [ 1283.167559][T14326] bond7: entered allmulticast mode [ 1283.180780][T14326] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1283.536860][T14339] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11123'. [ 1283.735747][T14350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11126'. [ 1283.752729][T14350] veth1: entered promiscuous mode [ 1283.787406][T14350] veth1: left promiscuous mode [ 1283.871401][T14357] FAULT_INJECTION: forcing a failure. [ 1283.871401][T14357] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1283.888184][T14357] CPU: 1 UID: 0 PID: 14357 Comm: syz.3.11129 Not tainted syzkaller #0 PREEMPT(full) [ 1283.888214][T14357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1283.888226][T14357] Call Trace: [ 1283.888234][T14357] [ 1283.888243][T14357] dump_stack_lvl+0xe8/0x150 [ 1283.888275][T14357] should_fail_ex+0x412/0x560 [ 1283.888303][T14357] _copy_from_user+0x2d/0xb0 [ 1283.888330][T14357] ___sys_sendmsg+0x1c6/0x360 [ 1283.888363][T14357] ? __pfx____sys_sendmsg+0x10/0x10 [ 1283.888386][T14357] ? __lock_acquire+0x6b5/0x2cf0 [ 1283.888462][T14357] __sys_sendmmsg+0x27c/0x4e0 [ 1283.888506][T14357] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1283.888531][T14357] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1283.888586][T14357] ? ksys_write+0x242/0x270 [ 1283.888615][T14357] ? __pfx_ksys_write+0x10/0x10 [ 1283.888649][T14357] __x64_sys_sendmmsg+0xa0/0xc0 [ 1283.888680][T14357] do_syscall_64+0xe2/0xf80 [ 1283.888706][T14357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1283.888724][T14357] ? trace_irq_disable+0x37/0x100 [ 1283.888740][T14357] ? clear_bhb_loop+0x60/0xb0 [ 1283.888764][T14357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1283.888782][T14357] RIP: 0033:0x7f79a499aeb9 [ 1283.888800][T14357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1283.888816][T14357] RSP: 002b:00007f79a587c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1283.888837][T14357] RAX: ffffffffffffffda RBX: 00007f79a4c15fa0 RCX: 00007f79a499aeb9 [ 1283.888851][T14357] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1283.888863][T14357] RBP: 00007f79a587c090 R08: 0000000000000000 R09: 0000000000000000 [ 1283.888874][T14357] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1283.888886][T14357] R13: 00007f79a4c16038 R14: 00007f79a4c15fa0 R15: 00007ffc43f6dbd8 [ 1283.888918][T14357] [ 1284.087364][T14359] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11130'. [ 1284.130920][T14359] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11130'. [ 1284.316271][T14367] ip6gre1: entered promiscuous mode [ 1284.329447][T14367] ip6gre1: entered allmulticast mode [ 1284.387609][T14373] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11133'. [ 1284.402015][T14373] netlink: 28 bytes leftover after parsing attributes in process `syz.4.11133'. [ 1284.464601][T14373] netlink: 'syz.4.11133': attribute type 1 has an invalid length. [ 1284.506286][T14384] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11137'. [ 1284.583266][T14384] geneve2: entered promiscuous mode [ 1284.651494][T14392] FAULT_INJECTION: forcing a failure. [ 1284.651494][T14392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1284.678907][T14392] CPU: 0 UID: 0 PID: 14392 Comm: syz.4.11142 Not tainted syzkaller #0 PREEMPT(full) [ 1284.678938][T14392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1284.678951][T14392] Call Trace: [ 1284.678960][T14392] [ 1284.678969][T14392] dump_stack_lvl+0xe8/0x150 [ 1284.679000][T14392] should_fail_ex+0x412/0x560 [ 1284.679028][T14392] _copy_from_user+0x2d/0xb0 [ 1284.679057][T14392] ___sys_sendmsg+0x1c6/0x360 [ 1284.679090][T14392] ? __pfx____sys_sendmsg+0x10/0x10 [ 1284.679113][T14392] ? __lock_acquire+0x6b5/0x2cf0 [ 1284.679194][T14392] __sys_sendmmsg+0x27c/0x4e0 [ 1284.679228][T14392] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1284.679254][T14392] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1284.679310][T14392] ? ksys_write+0x242/0x270 [ 1284.679341][T14392] ? __pfx_ksys_write+0x10/0x10 [ 1284.679376][T14392] __x64_sys_sendmmsg+0xa0/0xc0 [ 1284.679406][T14392] do_syscall_64+0xe2/0xf80 [ 1284.679431][T14392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.679449][T14392] ? trace_irq_disable+0x37/0x100 [ 1284.679467][T14392] ? clear_bhb_loop+0x60/0xb0 [ 1284.679490][T14392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.679510][T14392] RIP: 0033:0x7f4f0fd9aeb9 [ 1284.679530][T14392] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1284.679551][T14392] RSP: 002b:00007f4f10c4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1284.679572][T14392] RAX: ffffffffffffffda RBX: 00007f4f10015fa0 RCX: 00007f4f0fd9aeb9 [ 1284.679586][T14392] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1284.679599][T14392] RBP: 00007f4f10c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1284.679610][T14392] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1284.679622][T14392] R13: 00007f4f10016038 R14: 00007f4f10015fa0 R15: 00007ffe41d821d8 [ 1284.679655][T14392] [ 1285.186217][T14408] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1285.406720][T14420] bond3: option resend_igmp: invalid value (2878) [ 1285.425750][T14420] bond3: option resend_igmp: allowed values 0 - 255 [ 1285.535528][T14437] FAULT_INJECTION: forcing a failure. [ 1285.535528][T14437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1285.568269][T14437] CPU: 0 UID: 0 PID: 14437 Comm: syz.2.11157 Not tainted syzkaller #0 PREEMPT(full) [ 1285.568296][T14437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1285.568307][T14437] Call Trace: [ 1285.568314][T14437] [ 1285.568322][T14437] dump_stack_lvl+0xe8/0x150 [ 1285.568351][T14437] should_fail_ex+0x412/0x560 [ 1285.568377][T14437] _copy_from_user+0x2d/0xb0 [ 1285.568403][T14437] ___sys_sendmsg+0x1c6/0x360 [ 1285.568434][T14437] ? __pfx____sys_sendmsg+0x10/0x10 [ 1285.568465][T14437] ? __lock_acquire+0x6b5/0x2cf0 [ 1285.568537][T14437] __sys_sendmmsg+0x27c/0x4e0 [ 1285.568565][T14437] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1285.568586][T14437] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1285.568634][T14437] ? ksys_write+0x242/0x270 [ 1285.568662][T14437] ? __pfx_ksys_write+0x10/0x10 [ 1285.568691][T14437] __x64_sys_sendmmsg+0xa0/0xc0 [ 1285.568717][T14437] do_syscall_64+0xe2/0xf80 [ 1285.568738][T14437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1285.568756][T14437] ? trace_irq_disable+0x37/0x100 [ 1285.568772][T14437] ? clear_bhb_loop+0x60/0xb0 [ 1285.568793][T14437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1285.568809][T14437] RIP: 0033:0x7fbc8c99aeb9 [ 1285.568827][T14437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1285.568844][T14437] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1285.568866][T14437] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1285.568881][T14437] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1285.568894][T14437] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1285.568907][T14437] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1285.568919][T14437] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1285.568953][T14437] [ 1285.764394][T14420] bond3 (unregistering): Released all slaves [ 1285.820030][T14440] No such timeout policy "syz1" [ 1286.110442][T14457] syzkaller0: entered promiscuous mode [ 1286.115979][T14457] syzkaller0: entered allmulticast mode [ 1286.660438][T14479] openvswitch: netlink: Tunnel attr 333 out of range max 16 [ 1286.999842][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1287.643006][ T11] block nbd3: Possible stuck request ffff888025998000: control (read@0,1024B). Runtime 330 seconds [ 1287.655433][ T11] block nbd3: Possible stuck request ffff888025998200: control (read@1024,1024B). Runtime 330 seconds [ 1288.466947][T14457] veth9: entered promiscuous mode [ 1288.473120][T14460] tipc: Enabled bearer , priority 0 [ 1288.480988][T14465] syzkaller0: entered promiscuous mode [ 1288.487805][T14465] syzkaller0: entered allmulticast mode [ 1288.533535][T14478] tipc: Resetting bearer [ 1288.544803][T14459] tipc: Resetting bearer [ 1288.576410][T14459] tipc: Disabling bearer [ 1288.786927][T14494] FAULT_INJECTION: forcing a failure. [ 1288.786927][T14494] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1288.813843][T14494] CPU: 1 UID: 0 PID: 14494 Comm: syz.2.11169 Not tainted syzkaller #0 PREEMPT(full) [ 1288.813884][T14494] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1288.813897][T14494] Call Trace: [ 1288.813906][T14494] [ 1288.813915][T14494] dump_stack_lvl+0xe8/0x150 [ 1288.813948][T14494] should_fail_ex+0x412/0x560 [ 1288.813978][T14494] _copy_from_user+0x2d/0xb0 [ 1288.814009][T14494] ___sys_sendmsg+0x1c6/0x360 [ 1288.814042][T14494] ? __pfx____sys_sendmsg+0x10/0x10 [ 1288.814066][T14494] ? __lock_acquire+0x6b5/0x2cf0 [ 1288.814154][T14494] __sys_sendmmsg+0x27c/0x4e0 [ 1288.814188][T14494] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1288.814212][T14494] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1288.814263][T14494] ? ksys_write+0x242/0x270 [ 1288.814293][T14494] ? __pfx_ksys_write+0x10/0x10 [ 1288.814328][T14494] __x64_sys_sendmmsg+0xa0/0xc0 [ 1288.814372][T14494] do_syscall_64+0xe2/0xf80 [ 1288.814398][T14494] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1288.814417][T14494] ? trace_irq_disable+0x37/0x100 [ 1288.814435][T14494] ? clear_bhb_loop+0x60/0xb0 [ 1288.814459][T14494] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1288.814476][T14494] RIP: 0033:0x7fbc8c99aeb9 [ 1288.814494][T14494] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1288.814509][T14494] RSP: 002b:00007fbc8d875028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1288.814531][T14494] RAX: ffffffffffffffda RBX: 00007fbc8cc15fa0 RCX: 00007fbc8c99aeb9 [ 1288.814545][T14494] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1288.814558][T14494] RBP: 00007fbc8d875090 R08: 0000000000000000 R09: 0000000000000000 [ 1288.814570][T14494] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1288.814582][T14494] R13: 00007fbc8cc16038 R14: 00007fbc8cc15fa0 R15: 00007ffc257dc538 [ 1288.814614][T14494] [ 1289.056472][T14496] syzkaller0: entered promiscuous mode [ 1289.062627][T14496] syzkaller0: entered allmulticast mode [ 1289.181508][T14506] __nla_validate_parse: 3 callbacks suppressed [ 1289.181532][T14506] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11175'. [ 1289.231826][T14506] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11175'. [ 1289.351848][T14512] netlink: 'syz.1.11176': attribute type 10 has an invalid length. [ 1289.379861][T14521] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11179'. [ 1289.452353][T10115] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 1289.497763][T14527] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11180'. [ 1289.518395][T14527] vlan3: entered promiscuous mode [ 1289.524768][T14527] syz_tun: entered promiscuous mode [ 1289.549847][T14531] netlink: 80 bytes leftover after parsing attributes in process `syz.3.11181'. [ 1289.563603][T14531] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1289.574830][T14522] IPVS: set_ctl: invalid protocol: 46 172.20.20.187:20002 [ 1289.656540][T14536] FAULT_INJECTION: forcing a failure. [ 1289.656540][T14536] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1289.680113][T14536] CPU: 0 UID: 0 PID: 14536 Comm: syz.4.11183 Not tainted syzkaller #0 PREEMPT(full) [ 1289.680143][T14536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1289.680156][T14536] Call Trace: [ 1289.680164][T14536] [ 1289.680174][T14536] dump_stack_lvl+0xe8/0x150 [ 1289.680206][T14536] should_fail_ex+0x412/0x560 [ 1289.680237][T14536] _copy_from_user+0x2d/0xb0 [ 1289.680267][T14536] ___sys_sendmsg+0x1c6/0x360 [ 1289.680301][T14536] ? __pfx____sys_sendmsg+0x10/0x10 [ 1289.680324][T14536] ? __lock_acquire+0x6b5/0x2cf0 [ 1289.680407][T14536] __sys_sendmmsg+0x27c/0x4e0 [ 1289.680450][T14536] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1289.680475][T14536] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1289.680533][T14536] ? ksys_write+0x242/0x270 [ 1289.680564][T14536] ? __pfx_ksys_write+0x10/0x10 [ 1289.680599][T14536] __x64_sys_sendmmsg+0xa0/0xc0 [ 1289.680629][T14536] do_syscall_64+0xe2/0xf80 [ 1289.680655][T14536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1289.680674][T14536] ? clear_bhb_loop+0x60/0xb0 [ 1289.680698][T14536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1289.680717][T14536] RIP: 0033:0x7f4f0fd9aeb9 [ 1289.680736][T14536] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1289.680753][T14536] RSP: 002b:00007f4f10c4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1289.680777][T14536] RAX: ffffffffffffffda RBX: 00007f4f10015fa0 RCX: 00007f4f0fd9aeb9 [ 1289.680792][T14536] RDX: 000000000000005e RSI: 0000200000002000 RDI: 0000000000000003 [ 1289.680804][T14536] RBP: 00007f4f10c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1289.680817][T14536] R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000002 [ 1289.680829][T14536] R13: 00007f4f10016038 R14: 00007f4f10015fa0 R15: 00007ffe41d821d8 [ 1289.680863][T14536] [ 1289.949939][T14544] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11187'. [ 1289.962302][T14544] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11187'. [ 1290.044795][T14548] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11188'. [ 1290.179044][T14516] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1290.227030][T14546] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11186'. [ 1290.536962][T14560] ªªªªª9 speed is unknown, defaulting to 1000 [ 1290.547957][T14557] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1290.755547][T14573] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11196'. [ 1290.988114][T14560] virt_wifi0 speed is unknown, defaulting to 1000 [ 1291.021105][T14560] wg1 speed is unknown, defaulting to 1000 [ 1291.046808][T14589] bond0: option lacp_active: unable to set because the bond device is up [ 1291.174449][T14587] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1291.193870][T14595] netlink: 'syz.4.11205': attribute type 1 has an invalid length. [ 1291.421014][T14603] tipc: Enabled bearer , priority 10 [ 1291.457685][T14603] syzkaller0: entered promiscuous mode [ 1291.480028][T14603] syzkaller0: entered allmulticast mode [ 1291.588295][T14603] tipc: Resetting bearer [ 1291.611543][T14600] tipc: Resetting bearer [ 1291.682025][T14600] tipc: Disabling bearer [ 1291.711159][T14619] macvtap1: entered promiscuous mode [ 1291.716513][T14619] erspan0: entered promiscuous mode [ 1291.722751][T14619] macvtap1: entered allmulticast mode [ 1291.728166][T14619] erspan0: entered allmulticast mode [ 1291.758051][T14625] erspan0: left allmulticast mode [ 1291.768598][T14625] erspan0: left promiscuous mode [ 1292.248056][T14651] ªªªªª9 speed is unknown, defaulting to 1000 [ 1292.492725][ T6608] lec:lec_start_xmit: lec0:No lecd attached [ 1292.667141][T14651] virt_wifi0 speed is unknown, defaulting to 1000 [ 1292.670420][T14658] ªªªªª9 speed is unknown, defaulting to 1000 [ 1292.732908][T14651] wg1 speed is unknown, defaulting to 1000 [ 1293.168319][T14694] nbd: must specify an index to disconnect [ 1293.472172][T14658] virt_wifi0 speed is unknown, defaulting to 1000 [ 1293.493161][T14658] wg1 speed is unknown, defaulting to 1000 [ 1298.119633][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5630 ms [ 1298.127769][ C0] lec:lec_tx_timeout: lec0 [ 1300.453497][ T1299] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1300.466055][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 1300.832539][ T510] bond0 (unregistering): left promiscuous mode [ 1300.846082][ T510] bond0 (unregistering): Released all slaves [ 1300.856326][ T510] bond1 (unregistering): Released all slaves [ 1301.013146][ T510] bond2 (unregistering): Released all slaves [ 1301.166744][ T510] bond3 (unregistering): Released all slaves [ 1301.319610][ T510] bond4 (unregistering): Released all slaves [ 1301.333562][ T510] bond5 (unregistering): Released all slaves [ 1301.480040][ T510] bond6 (unregistering): Released all slaves [ 1301.632799][ T510] bond7 (unregistering): Released all slaves [ 1301.789654][ T510] bond8 (unregistering): Released all slaves [ 1301.945198][ T510] tipc: Left network mode [ 1302.366769][ C0] ip6_tunnel: ip6gretap2 xmit: Local address not yet configured! [ 1302.573852][ T510] hsr_slave_0: left promiscuous mode [ 1302.618129][ T510] pimreg (unregistering): left allmulticast mode [ 1306.119692][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5650 ms [ 1306.127781][ C0] lec:lec_tx_timeout: lec0 [ 1308.760448][ T31] INFO: task udevd:3832 blocked for more than 143 seconds. [ 1308.767722][ T31] Not tainted syzkaller #0 [ 1308.772837][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1308.781577][ T31] task:udevd state:D stack:22488 pid:3832 tgid:3832 ppid:5189 task_flags:0x400140 flags:0x00080002 [ 1308.793850][ T31] Call Trace: [ 1308.797218][ T31] [ 1308.800322][ T31] __schedule+0x14ea/0x5050 [ 1308.804864][ T31] ? __lock_acquire+0x6b5/0x2cf0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 1308.810012][ T31] ? __pfx___schedule+0x10/0x10 [ 1308.815152][ T31] ? schedule+0x90/0x360 [ 1308.819484][ T31] schedule+0x164/0x360 [ 1308.824028][ T31] io_schedule+0x7f/0xd0 [ 1308.828313][ T31] folio_wait_bit_common+0x6d8/0xbc0 [ 1308.833944][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 1308.840027][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 1308.881240][ T31] ? __filemap_get_folio_mpol+0x7a9/0xb00 [ 1308.887288][ T31] do_read_cache_folio+0x1ad/0x590 [ 1308.939810][ T31] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1308.945355][ T31] read_part_sector+0xb6/0x2b0 [ 1308.979745][ T31] adfspart_check_POWERTEC+0x92/0xef0 [ 1308.985186][ T31] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 1309.010075][ T31] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 1309.016138][ T31] bdev_disk_changed+0x765/0x14c0 [ 1309.049694][ T31] ? bdev_open+0xe0/0xd30 [ 1309.054192][ T31] ? __pfx_bdev_disk_changed+0x10/0x10 [ 1309.085998][ T31] blkdev_get_whole+0x380/0x510 [ 1309.091334][ T31] bdev_open+0x31e/0xd30 [ 1309.095629][ T31] blkdev_open+0x470/0x610 [ 1309.109998][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 1309.115238][ T31] do_dentry_open+0x7ce/0x1420 [ 1309.139931][ T31] vfs_open+0x3b/0x340 [ 1309.144081][ T31] ? path_openat+0x346e/0x3e20 [ 1309.149063][ T31] path_openat+0x3486/0x3e20 [ 1309.168851][ T31] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 1309.189700][ T31] ? getname_flags+0xb7/0x540 [ 1309.194718][ T31] ? __pfx_path_openat+0x10/0x10 [ 1309.209732][ T31] ? __lock_acquire+0x6b5/0x2cf0 [ 1309.214766][ T31] do_filp_open+0x22d/0x490 [ 1309.219322][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1309.241302][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1309.246396][ T31] ? alloc_fd+0x64b/0x6c0 [ 1309.260394][ T31] do_sys_openat2+0x12f/0x220 [ 1309.265133][ T31] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1309.279934][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1309.285306][ T31] ? rcu_is_watching+0x15/0xb0 [ 1309.319631][ T31] __x64_sys_openat+0x138/0x170 [ 1309.324562][ T31] do_syscall_64+0xe2/0xf80 [ 1309.329103][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.359620][ T31] ? trace_irq_disable+0x37/0x100 [ 1309.364710][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1309.389724][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.395678][ T31] RIP: 0033:0x7f6a6f4a7407 [ 1309.429702][ T31] RSP: 002b:00007fffb7704db0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1309.438195][ T31] RAX: ffffffffffffffda RBX: 00007f6a6fb6e880 RCX: 00007f6a6f4a7407 [ 1309.469723][ T31] RDX: 00000000000a0800 RSI: 0000561de3cd81f0 RDI: ffffffffffffff9c [ 1309.477765][ T31] RBP: 0000561de3cbd910 R08: 0000000000000000 R09: 0000000000000000 [ 1309.500875][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 0000561de3ce46d0 [ 1309.508925][ T31] R13: 0000561de3ccb190 R14: 0000000000000000 R15: 0000561de3ce46d0 [ 1309.517145][ T31] [ 1309.520387][ T31] [ 1309.520387][ T31] Showing all locks held in the system: [ 1309.528577][ T31] 1 lock held by khungtaskd/31: [ 1309.534050][ T31] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1309.544133][ T31] 1 lock held by klogd/5178: [ 1309.548747][ T31] #0: ffff8880b873a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 1309.559434][ T31] 2 locks held by getty/5577: [ 1309.564517][ T31] #0: ffff8880346030a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1309.574575][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 1309.584884][ T31] 2 locks held by kworker/1:10/11253: [ 1309.590381][ T31] #0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 [ 1309.601777][ T31] #1: ffffc90003467bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 [ 1309.612443][ T31] 1 lock held by udevd/3832: [ 1309.617115][ T31] #0: ffff8880258db358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 1309.626535][ T31] 1 lock held by udevd/4010: [ 1309.631284][ T31] #0: ffff8880297a1358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 1309.640653][ T31] 1 lock held by syz-executor/5790: [ 1309.645897][ T31] #0: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1309.657130][ T31] 5 locks held by syz-executor/8708: [ 1309.662590][ T31] #0: ffff888055c64ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 [ 1309.672879][ T31] #1: ffff888055c640c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 [ 1309.682790][ T31] #2: ffffffff8fb39be8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 1309.693155][ T31] #3: ffff88805fd612f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 [ 1309.702864][ T31] #4: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1309.735739][ T31] [ 1309.738227][ T31] ============================================= [ 1309.738227][ T31] [ 1309.762995][ T31] NMI backtrace for cpu 1 [ 1309.763018][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1309.763041][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1309.763054][ T31] Call Trace: [ 1309.763063][ T31] [ 1309.763072][ T31] dump_stack_lvl+0xe8/0x150 [ 1309.763104][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1309.763127][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1309.763168][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1309.763193][ T31] sys_info+0x135/0x170 [ 1309.763221][ T31] watchdog+0xf90/0xfe0 [ 1309.763248][ T31] ? watchdog+0x209/0xfe0 [ 1309.763277][ T31] kthread+0x726/0x8b0 [ 1309.763303][ T31] ? __pfx_watchdog+0x10/0x10 [ 1309.763323][ T31] ? __pfx_kthread+0x10/0x10 [ 1309.763349][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1309.763372][ T31] ? __pfx_kthread+0x10/0x10 [ 1309.763395][ T31] ret_from_fork+0x51b/0xa40 [ 1309.763420][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1309.763441][ T31] ? __switch_to+0xc82/0x1410 [ 1309.763467][ T31] ? __pfx_kthread+0x10/0x10 [ 1309.763491][ T31] ret_from_fork_asm+0x1a/0x30 [ 1309.763534][ T31] [ 1309.763542][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1309.888693][ C0] NMI backtrace for cpu 0 [ 1309.888714][ C0] CPU: 0 UID: 0 PID: 7333 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 1309.888736][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1309.888746][ C0] RIP: 0010:__lock_acquire+0x3c4/0x2cf0 [ 1309.888774][ C0] Code: 57 52 0e 48 c7 c6 0c 96 de 8d 67 48 0f b9 3a 90 31 c0 0f b6 98 c4 00 00 00 41 8b 45 20 25 ff 1f 00 00 48 0f a3 05 dc ef 5a 12 <73> 17 48 69 c0 c8 00 00 00 48 8d 88 b0 23 9c 93 84 db 75 3f e9 10 [ 1309.888788][ C0] RSP: 0018:ffffc9000da275b0 EFLAGS: 00000003 [ 1309.888803][ C0] RAX: 0000000000000007 RBX: 0000000000000003 RCX: 0000000000000007 [ 1309.888814][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1309.888824][ C0] RBP: 0000000000000000 R08: ffffffff81757195 R09: ffffffff8e55a360 [ 1309.888836][ C0] R10: ffffc9000da278b8 R11: ffffffff81af9170 R12: 0000000000000007 [ 1309.888847][ C0] R13: ffff88802de1a9b0 R14: ffff88802de19e80 R15: ffff88802de1a9b0 [ 1309.888859][ C0] FS: 0000000000000000(0000) GS:ffff8881256eb000(0000) knlGS:0000000000000000 [ 1309.888873][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1309.888885][ C0] CR2: 000055a06b68bee8 CR3: 000000007fc88000 CR4: 00000000003526f0 [ 1309.888903][ C0] Call Trace: [ 1309.888909][ C0] [ 1309.888918][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 1309.888943][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.888963][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.888978][ C0] lock_acquire+0x106/0x330 [ 1309.888998][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.889018][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.889034][ C0] ? vfree+0x25a/0x400 [ 1309.889054][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.889070][ C0] unwind_next_frame+0xc2/0x23c0 [ 1309.889086][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.889105][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 1309.889121][ C0] ? __free_frozen_pages+0xbf8/0xd70 [ 1309.889137][ C0] ? vfree+0x25a/0x400 [ 1309.889158][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1309.889177][ C0] arch_stack_walk+0x11b/0x150 [ 1309.889196][ C0] ? vfree+0x25a/0x400 [ 1309.889218][ C0] stack_trace_save+0xa9/0x100 [ 1309.889236][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1309.889258][ C0] save_stack+0x122/0x230 [ 1309.889280][ C0] ? __pfx_save_stack+0x10/0x10 [ 1309.889301][ C0] ? __free_frozen_pages+0xbf8/0xd70 [ 1309.889315][ C0] ? vfree+0x25a/0x400 [ 1309.889344][ C0] __reset_page_owner+0x71/0x1f0 [ 1309.889366][ C0] __free_frozen_pages+0xbf8/0xd70 [ 1309.889392][ C0] vfree+0x25a/0x400 [ 1309.889413][ C0] ? __pfx_kcov_close+0x10/0x10 [ 1309.889430][ C0] kcov_close+0x28/0x50 [ 1309.889445][ C0] __fput+0x44f/0xa70 [ 1309.889467][ C0] task_work_run+0x1d9/0x270 [ 1309.889487][ C0] ? __pfx_task_work_run+0x10/0x10 [ 1309.889506][ C0] ? kmem_cache_free+0x195/0x610 [ 1309.889527][ C0] ? do_exit+0x696/0x2310 [ 1309.889547][ C0] do_exit+0x69b/0x2310 [ 1309.889568][ C0] ? __pfx_do_exit+0x10/0x10 [ 1309.889585][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 1309.889608][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 1309.889629][ C0] do_group_exit+0x21b/0x2d0 [ 1309.889651][ C0] __x64_sys_exit_group+0x3f/0x40 [ 1309.889672][ C0] x64_sys_call+0x2210/0x2210 [ 1309.889696][ C0] do_syscall_64+0xe2/0xf80 [ 1309.889717][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.889732][ C0] ? trace_irq_disable+0x37/0x100 [ 1309.889747][ C0] ? clear_bhb_loop+0x60/0xb0 [ 1309.889767][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1309.889785][ C0] RIP: 0033:0x7f4f0fd9aeb9 [ 1309.889801][ C0] Code: Unable to access opcode bytes at 0x7f4f0fd9ae8f. [ 1309.889811][ C0] RSP: 002b:00007ffe41d82428 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 1309.889831][ C0] RAX: ffffffffffffffda RBX: 00007f4f0fe0abc4 RCX: 00007f4f0fd9aeb9 [ 1309.889845][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043 [ 1309.889856][ C0] RBP: 00007f4f0fe0abd6 R08: 0000000000000000 R09: 00000000000927c0 [ 1309.889868][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 1309.889880][ C0] R13: 00000000000927c0 R14: 000000000013bcbf R15: 00007ffe41d825d0 [ 1309.889902][ C0] [ 1310.016745][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1310.016767][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1310.016788][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1310.016800][ T31] Call Trace: [ 1310.016809][ T31] [ 1310.016818][ T31] vpanic+0x1e0/0x670 [ 1310.016849][ T31] panic+0xc5/0xd0 [ 1310.016870][ T31] ? __pfx_panic+0x10/0x10 [ 1310.016893][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1310.016925][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1310.016950][ T31] watchdog+0xfda/0xfe0 [ 1310.016974][ T31] ? watchdog+0x209/0xfe0 [ 1310.017001][ T31] kthread+0x726/0x8b0 [ 1310.367670][ T31] ? __pfx_watchdog+0x10/0x10 [ 1310.372805][ T31] ? __pfx_kthread+0x10/0x10 [ 1310.377410][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1310.382614][ T31] ? __pfx_kthread+0x10/0x10 [ 1310.387210][ T31] ret_from_fork+0x51b/0xa40 [ 1310.391991][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1310.397181][ T31] ? __switch_to+0xc82/0x1410 [ 1310.401871][ T31] ? __pfx_kthread+0x10/0x10 [ 1310.406575][ T31] ret_from_fork_asm+0x1a/0x30 [ 1310.411371][ T31] [ 1310.414815][ T31] Kernel Offset: disabled [ 1310.419165][ T31] Rebooting in 86400 seconds..