last executing test programs: 3.072381123s ago: executing program 3 (id=853): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xe4980, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x58, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x2005}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_USERDATA={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) r4 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000002c0)={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x7f, 0x0, 0x100, 0x1, 0x500002}) socket(0x2d, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0), 0x0) shutdown(0xffffffffffffffff, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0x4000084) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@mcast2, 0x300, 0x0, 0x2, 0x9, 0x0, 0x4}, 0x20) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000300)='bic', 0x3) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) 1.956148062s ago: executing program 3 (id=861): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_proto_private(r0, 0x8937, &(0x7f0000000100)="b468153a") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x4, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007919b8000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x4}, 0x94) 1.799191426s ago: executing program 1 (id=863): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x900, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000010280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x800c1}, 0x8004) accept4(r5, 0x0, 0x0, 0x80000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r6, 0x29, 0x3c, &(0x7f0000000240)=0xffffffff, 0x4) setsockopt$inet6_buf(r6, 0x29, 0x3e, &(0x7f00000000c0)="0b5d8c3f", 0x4) sendto$inet6(r6, &(0x7f0000001100)="51e251578851f74182a74b89b27df427aeef44966d202e4138b5a18e75a0424e7fe93b0d32c7abba87b65f97aba1c26a06b6d94c4aefd8fdca10e744391062c8e612721c20051608d9aa6dacf61e1eb331a4daad402b9885599d56130f7149fb1111fa116e94324d585a0569fbd311dad54cb4e32ff7f02216844ec3d526c878d5135ad1c9262239339c18885e2a0a95854d6cde3dd2feeaa50216af6c5760923413af81199a65a6332b02ec7bbf79d557c033cbe032fdc44f66a5c59cc4a3c5d218f5896b359d1efd60baf98df6396567478f7b817ce6e11d59a7def452a068e9607f57f626a5b8d476636ef1ee76307524009ae49be402000000000000001e80fed632155e14da1f7324d97bc61a3c1edc4431ee8a6caa2ed9f85cea5a2a9b263630c7d6fc35dda6002da571a2e51917e7c1019d8ce21a608147e408074c7c5f444fab931bda86d977d7c9ccefd881e5ef05b287f41eea526862885881c2cdc687dfff01a9b70a9b08734ac4d62c7f34465c34aa9e9f136c7f796d9eea41aa37f61830508338bb1f887089070567a1dd96cd700e7a098dabedb60f31acd17d487bc8be1a3101d2b5ac1715003793596c6daa93a27f4adb4d6fbea5669cabc206c944317ea18a2c762457f1bc945fec8f849641d44e7e2a24faeee28f3f266395fe18b0dce20c1f64e8896c8ff0e4a44a116fb32462471a0fcde143e551723d57339722765673b4163d66f473ac10f988cb252f106632f9884a47866d284b4efc6bb1aa74ed48d4a6535795f0873a99907ebc22be2337364cf9acc063e32f7d2e02fad64d04aa405d2dbdee1128ab1e4761d2dd30885ad37dd168478f10789d172feef4c817a5cd372caade57f23300e45f47e001e3ea093680ffffff802477368b9910f4e24037c871cb8251568c792287a6f49fa61b7c2600accaa0e7b40c59d88a29af5886c1f5dfc6837c58aaef12a9e100225c70441144ffa82927fa4802ed9ebb03eea8e945af5f4993f21a7f53baf7ec5bb6cc96b917dde82c18840c3500e9565f68f687b1c73d834c0d99d4acb002dc5682dbcdb1217a98f6c3ef8318b7fa93894e8a097b4511ba5c035e27c9fe8bfe7754741ac21bbc0303b81672e3117e5590fe2d92f912759b9937f64204ec5caa92e2cccb31016b13ed8d7bcabb03e176b1c9bda3bf1c1256ab74ab6f42ed9bafbbd0096263be1a7da1e1c88deec55a653d170e1e13c77dacaa60a37a6ba2383e661ebc9f13dbaade2dd884c9951819fb4608e19e70cd2496ccfb12f24c71f496cfe90400fe1bbea1e9a24b1d4664fb0776aca6269b396779680e52f86877d9209988d12ccb137be01ab7496d00547a7d4849d365a18dbb55c429cde87d33c4b74ad2273cdfee88b5418866ef327f25e9cbcd5a64d97107339f7e4cb5f8de171d2779c0f68884ae835e398f982d5749f085628d3608986656ea04b721f828202e9342bd7d19dfa091e772aebf9718030167a8c029df7c58b7f40029d7cfcaf26fd1900d8775ef373e8e2c5bf3525f907add3be426cd5a079c49abffe933e9ee213a3baf34f932d1299312691e1c53e6247ae0989ad66070d51fad22856a8b6b28954e7d41189b11c5321789eec8670de9e8db0b0473ba2e02731e60e7222697d61e052c18d4bcc6d1572fdf426f7b2fee6c1dee66c85c497b90facaf63b8ec5cde4a73400f9180bcfc0f81eca9580a7c81462a077f9034026bf72aa7c6de4b3c15d4a2dbd6fd7d87084aea9f25fb4bf5ec83eb56874a760533792dff2695407ccdd6a7375e0007230fd3f6501c152f1c1ff279b1d67cc95f2820762b7927659368e41657bdef2dd15b63498a93b787bdb26809d734aaf98b86fcf9fc643a34d03ebbe072820662d20d4774d66c5ae270adade5b8f6242a059b926221ee3d677487471c432b0d6d64dad030703475bb3ecac39b204a814f5ece5961621358e36f8a2cf7196c76959824bbb475a7cad8f57853fe05f59f341b5207cc9bb8d686982c2f158e0d8f5c7ec6cbfd500"/1453, 0x5ad, 0x10000800, &(0x7f0000000080)={0xa, 0x5e1f, 0x3, @mcast2}, 0x1c) recvfrom$inet6(r6, 0x0, 0x0, 0x20, 0x0, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r7, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x2, 0x4e20, @remote}, {0x2, 0x0, @broadcast}, 0xc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x200}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r8) r9 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x789d2d, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x8, 0x0, 0x1, 0x4, 0x9, 0x4cca}, {0x6, 0x1, 0x5, 0x10, 0x7, 0x312}, 0x3, 0x10, 0xd1d}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xa89d84ea6e694e0f}, @TCA_TBF_BURST={0x8, 0x6, 0xb1a}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'syzkaller0\x00'}) 1.558269974s ago: executing program 3 (id=866): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="600000000206010800000000000000000100000a11000300686173683a69702c6d61726b00000000050001000700000005000500020000000900020073797a300000000005000400000000001400078008000840000000d308000b"], 0x60}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x24004090) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [0x0, 0x0, 0x0, 0xffffff00], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a0000002c000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000004000000000000000000000000000000000000000000000000000000000000000ffffff7f00000000001000f800000000fbffffffffffffff000000000000000000ffffffffffffff7f0000000000000200"/112], 0xb8}}, 0x2c000030) r3 = getuid() sendmsg$nl_xfrm(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x300, 0x0, 0x1000, 0x0, 0x2, 0x20, 0x0, 0x2b, 0x0, r3}, {0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x1, 0x6, 0x0, 0xfffffffffffffffe}, 0x200, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x404c830}, 0x0) 1.521973326s ago: executing program 2 (id=867): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d7118ba000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0f0000000400000004000000a2"], 0x50) r3 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x11) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) unshare(0x24020400) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000200)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000001c40)=0x4) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000500)=0xffff0080) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000000000)=0x8) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="20000000181401", @ANYRESHEX=r5], 0x20}, 0x1, 0xf00, 0x0, 0x40000}, 0x4000004) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000140), 0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000e5ffffffffffffff00009500000000000000"], &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r8}, 0x10) sendmsg$TIPC_CMD_DISABLE_BEARER(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="07ad0023000400000000010000000000000002"], 0x2c}}, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r2, &(0x7f00000047c0), &(0x7f0000000100)=@tcp6=r1, 0x1}, 0x20) 1.42159527s ago: executing program 3 (id=869): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x181341, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000026c0)=@newtclass={0x24, 0x28, 0x20, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x8, 0x6}, {0xf, 0x4}, {0x2, 0x7}}}, 0x24}}, 0x400c0) getsockname$packet(r1, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="4800000010000104000000020000000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012800b000100697036746e6c00001800028014000300ff"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@newlink={0x38, 0x10, 0x401, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r2, 0x2500}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40001}, 0x20004090) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r7 = socket(0x2b, 0xa, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xxhash64\x00'}, 0x58) r9 = accept4(r8, 0x0, 0x0, 0x0) sendmmsg$unix(r9, &(0x7f0000009d00)=[{{0x0, 0x0, &(0x7f0000005300)=[{&(0x7f0000004300)="dc", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000006d40)=[{&(0x7f0000006c40)="324d86ee95", 0x5}], 0x1}}], 0x2, 0x0) connect$inet6(r7, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r7, 0x6, 0x2, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) 1.256985799s ago: executing program 4 (id=871): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="180200000700000000023800000303a8090085000000bc000000950000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x800000}, 0x94) r1 = socket$rds(0x15, 0x5, 0x0) accept4(r1, &(0x7f0000000500)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @local}}, &(0x7f0000000040)=0x80, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f00000003c0)="6f11ba816056a1827a33ae059cf3", 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x50) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000000)={&(0x7f00000000c0)="dccf2472255489bcf4c00c22fc093b9b87eb05c6eb8e2cc20235521c3e04e5d9f49191eb200807acccb065f4c7e4a5ca935be63a8f2058a61a0407daccd29109bfd494aa1efbb4c1186ae3fcadcb77a1e7c4770231f8c7e656ba09d20f133bfab6acb8448e427c302f3aa2952d839ee1ce4e81dbc7dd2d045fd898961a3a353bf56c70d117d34bc0da66e869575534c07a233c061cea36bfd121370c25965abd644fe6e103b956b3a3c3da1d3a403ed66587de9997056934d1e7d6", &(0x7f0000000680)=""/4096, &(0x7f0000000200)="a84d69e3434c228d6c07fcd2e65de23af5a45ddfcb2462feb48d5b8878a93d621d9761e871cd36baf285ad799f94dea2050a54fb338fa52bdc16cacbbc03de3b9842107ec556351a6698780204d4957213c1f3c4dec1882a02636fa0dc4bfee429c2b2d91e38b8eff0fc4d6eb6e385a7a5ebadd6d8a93463b98035ab347ab85e9092eb7bb7a98616e1f933494574afb47f4dba59", &(0x7f00000002c0)="e784279a07421ea18edb18aab6e1243c97096dced7a2cb7f96e735f0a6c5ea2a62db3274b4601d7e591b9731b26836433ad292538d9ec2f19f2484ef3ca3da2cfbebcec30fcbd663fb4367e2e911859a5e6a493b04656274b243ee0d02fcebc9fa1d754bd6d89b63deca166b5d1e6b4d5284bd9b366cec028b29abea6393ff55ee779d139fb89c2844324900766ce9ee58d3707839c278e2bee1a23cad7027b0e803caaac908f1062f429bf56cc6af63", 0x4, 0x1, 0x4}, 0x38) 1.148575277s ago: executing program 1 (id=872): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r2 = socket$tipc(0x1e, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0xd6, 0xa, 0x0, 0x0, 0x4, 0x61, 0x11, 0x34}, [@initr0]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) bind$tipc(r2, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r5, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) mmap(&(0x7f0000009000/0x4000)=nil, 0x4000, 0x1000001, 0x11, r1, 0xffffc000) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) r6 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000040)=0x4, 0x4) setsockopt$sock_int(r6, 0x1, 0x2, &(0x7f0000000080)=0x2, 0x4) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x17, @empty, 0x10000}, 0x1c) 1.147632158s ago: executing program 4 (id=873): r0 = syz_init_net_socket$ax25(0x3, 0x5, 0xce) bind$ax25(r0, &(0x7f0000000540)={{0x3, @default}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) (async) sendto$ax25(r0, 0x0, 0x0, 0x40, &(0x7f00000001c0)={{0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x8}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x48) r1 = socket$vsock_stream(0x28, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newlink={0x98, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x64, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x4c, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_FLOOD={0x5, 0x1b, 0x1}, @IFLA_BRPORT_GUARD={0x5}, @IFLA_BRPORT_VLAN_TUNNEL={0x5}, @IFLA_BRPORT_PROTECT={0x5, 0x6, 0x1}, @IFLA_BRPORT_PRIORITY={0x6, 0x2, 0x1}, @IFLA_BRPORT_BCAST_FLOOD={0x5}, @IFLA_BRPORT_UNICAST_FLOOD={0x5, 0x9, 0x1}, @IFLA_BRPORT_GROUP_FWD_MASK={0x6, 0x1f, 0x6}, @IFLA_BRPORT_UNICAST_FLOOD={0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x98}, 0x1, 0x0, 0x0, 0x20044010}, 0x4040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000005e0020002abd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="affcc8bd16d08b3e359691a912af4ed723d7c0421c13"], 0x1c}}, 0x8040) (async) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000080)={'wg1\x00', &(0x7f0000000040)=@ethtool_cmd={0x28, 0x6, 0xff, 0x0, 0xfa, 0xfa, 0x1, 0x8, 0x3, 0x0, 0x7fffffff, 0xefc2, 0x24, 0x4, 0x8, 0x0, [0x6e, 0x7]}}) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='cachefiles_lookup\x00', r4}, 0x18) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) write$cgroup_subtree(r5, &(0x7f0000000080)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r5, 0x0) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, r5, 0x0, 0x0, 0x0}, 0x30) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x7}) 1.109262299s ago: executing program 2 (id=874): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001440)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYBLOB="6947ac28cdadd8a7173d7f26def4840c5e7b9b30fb3aff0e8dd307b29fc198e065ef2fe065ceafca9c3c4116419338616794f528f70562bd562ecc726f9ea7da23a474d08279575a6d1b3def86b805ed862b493e56f5e647b6dacee1254fd239a37d36230cc5d2dd26e299598e8c517b6f4e68016a07a0e1700ff36e9168d82a766c6c6f81528f2a72a740a5caba7a8e95a247119cdc9b47b588366fdcdb00200b7a60d77e10ba902280d3344931e8061f17c135a927297eb8ee60c750b4725ade67c1ac4a61a7049b3b63", @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r1, @ANYBLOB="171ec97f9bf285a642425ec6db130dd79f69264d161f8b9c19bf7680c2f5498301a19b73baaa4079179d65fda93fdf509e37596ce09717a00f710613a60f0c989575b5c34ece054c7e727ecb82cc2c1e9e6e0defa6cad1d679acca967838c32c660980d15f26d1d0d9025d1aa577cf32f76257dce7619e72000f711c42457129861e6f965053ad5b7e4af33a6631b6374747c78d1205a7add3a01fc693a20e8ecede1e6feac8b88cacbfcde4d8729f2f359acf08bda101203520e52494531f9004f30e45c8fb3e4196e2d94a9492e58980f2af55367b75b4da9e64addcdff92a49418dc11643d5005fa587056b6602e127abf60ecd5d08f090459b63fdabe7c7228d8c688562803cab4e431b89b12fef011bca055c5ed3c083421c486340aacdcdd8997a4df088fa31911aee807872497c7c8597e18411e30c2645038c6b2bf823aeaf0a83ef943f637512d5267aec593f2166772455193c22c2704567ef7f45bb0f67fa1a605d729791b1ff66495614c7b91028dc47c198c1728adce821e023a7afc877a9c75b12a675f85c95670e357dfaf7ddd13127f6d8576c7b1d578942871f45858f9f817d216875f37325b9855b433eee4834df8800e7ad11275fdefca86951209d393937899d3df17ad2c583ba454da9800aa007782c8d59b755a30d9d0973ebd52f10a530d5abdbf2782080181297b96b3ac5a561443064e67ba002762260d80e8eb31a2da3cb14d3e6f2abc4084d5649d2d1ed2966644c01f109ebf571089db61cb5287e1109d201f52c40767e25fff54ad9a87e9bf37de7ed7d4919495cab9ce60d085adc0bc13f866b6110636182197d467fcec147d28f1eea047809a1026aaafb5b7f80884b5975c61eafe15c7d1aa5fc77310d1273f4afcc58b5622ccbd31dc1d936276f341cc7717e5a001ca80fc0676b83ac889e6ba200a3aa32bd46abd67da5685623ee484a7628b1950fec506176fb2aebffed2b3652208fdc149e151a04b98b5d025389f791d65fff4539823bab3947fbb98037ecfc4ba129dc9dfd2d661e526c66f38b6e8deb55649785f07ddde446509b3e7e0106ee5e3681828224c671652f2908d686abd69d452a1e790fafe83b12c75f68f277f79fd24e1651871467cf03b1f9dee77b89dea4c73e182bd08fc6e3bfe5b2fa20758204403b42ca4b394d05a15fe4e9cea4f40f582a09a4d79e4df540096c274d8eee9dcbe7e49ab9f2cd12dcd084be0deb1f420ffd613d6a7e9d9bc8ec8c034293f7495caa6ea2a02e084cfb93ec67f848d53afa0e4fe500ce007c2bfba048bf952d0a0aa098a300cbe09682af1958fb40c511aae29bc4139f68d89c8bddc7903137188f294caed30d8cdceb6536824a19d99f04f1e6d7b3c62b153aea74691a39862777ee01de4e52af3f574fe746217a469906adcf24243e76bee8844b14b0140a9aea262571fbff4dbb430f64378762329d25cab662adc75812405168b482543fef66c857b2473985780441322d76313cec7bce21f28f8c945c5d684e82f5189352909c6e29d1016571beb25ed27b38871abeab760870ad7d7e6a87db85ec45c755e766b9bcbf0541190a13f05fd211973cf314b9b687e358325edec28daa035d28dfc51a1665e890a76ec9e1b944b9121c4851f5474b1fcafccae2806ab0119231e696f55ded5bab0b3d6a820ba9d0f88e8c241ede23cf8c276911cd035c73496614148c9720921ff124f500a4e63f139496a9cf4925051b9f50e01502da007c066ad80ea7b0e9ed9a4a57b2e6e87539a2d086af6849d2ff38ddc3f1e7eaccad04dfb2844cc98d9499ad30cec13d61a919873a889b6d25eb4ca86f46b657163e473b3be4bb1b38245a65c948fa8ae2538528e90303ec8e343ff83c2e2f79175b198a78fc8711e2f9fb50e8d7db6d4a7d2ad7801a4c0d175200b03db365c1d96f089c41d03c79d5dca787400e865b898bf173607668a4fa1808797206675772e3e552449ccd1d56e60a2b3dc53d1789a72466f8f1eaa62bcb508d20c4012fc7be52588b1c418098256b5baecc4f0fa421ea5cef3bcdfb3b50eb15aa91d099986dc37571bed7d0f0e168f8eed0dbee7cb659647551f616be2ee8ddb1f94237dd886f3f044b6f782d5117323c470d4baf3b7715babd0f76b0651896ea9f727b158044436829af342a6881e7f61bec28afdd57e67b7797ec316630248af85ef3747a3843d4e85ba9fa01d6b2dff191d031b5433821129781464e5f45da3263331009cb7429c852559bcd8b8ee08350a9bfb161c6599c20c687a1e17f9cfd87f078e56750fdf2154b5ad2951014753ac8f37794d253a37d03d2e81df8eff491da9b78f2b9ca13bda22a731d4aaba07c99935f5fb373372b5ab2b3437379c0bb56aadb38c1d521c3ec0b9d8a02ebf33f3ab7e17cfece938deefe178ff33634b895d6fa085116abfad23d545bff050a64e130d460d82f2745ba29224046ba7b7bde4ca5961f7e8bb6dfa7659cb1bf6b3dfc4afad1c1354c968e422a1cfab3a7f81fdee1210d0b17aa6a21bca38319f5494274a40d6861474d7fc052d292b5f978607116f16b721398290c228a26242fdf9e070910e2121d0d61c49951b6c7e2cc914d38201c46c9c3816fe198b6f8c01ad96cb3da512392112454d3ab4e80c76d1c56c391144ba666ad5b204e124e5e3ae999926ca1d998603a36a77b0556cbcc51073ab3d0b70ebeb5282d4de641e97f732e21a1dbbdceff4cd66a6b5979db1a94f4ade9d8affb480e53ad032c4a552e06d3d4b3b9db212eda3e0c4dc7b551b419a9c07ebdce0b0d63cba69ecf01bd904121c86d69c77f50f5ea45cdce056c61d7c51526a574fd459ca1344d7e0cf8930486700c8e106932e2abf7f3bd75c09a05ba9d525cde76cc2fb3ae85cbc603b69d40c83e1049d812e6bb0cd14e15e98fe1af38197e2739183d60294ac06390e8f517cb7a66bd69295657f4ff3c1f6766bd277749152d82963bb2dccc8efed52e7bccc44ddad9563f74e7877882556a3c3059b0f7427bd3c63c8cd5bba16a6cf01df9aeaa0d8ce29297138c44d90aad51af63d2d5418a34425a3c0d5a5bf6e79bfe064a73d4e24e8f050387722719a51c907df995caa30f239b1a62f94bddc985d94556744374d0c2cfaf342d9f29d245a6eb3b25b0acf06d89add41c613cf019a8903e92d1614b0fdf4be89f8ec492972bba1382387c85217b680790796e8206f53625c99adca057f84fe4a7c73ec84e3edfbe31e1afd3553d7f35f9deb0b4fb51e6379c20f06b64cb4743a2bcff7e998d97491954bc44aa4f3a170bd65879cbbfb5101048a66df44260a16f053cde6f349aadeaf9f27448d0bcf4a6bea85d63b1b7f8387e61c411d965cfd68036f7f50c5deed159f184c160318b0a91789eadb0d466195889c853878e5e68709be3cd6233eb191c20240c9fba9eb26808ea4b58b874b4e85f979507f48ec4213dc279e8372767ba9ea6d0fee69b3d6ae8347e8943574ab95db534776fc6b179134be5dc9dd76bbfe9db7d1eeffd477bfd63bbde3858ddfe490c2ba43129d9732c094120e2430e4adf1f01370c99cfe0784406c54d5bef3f067cd2f7e6d36109548816fba21ffd799525afaba55311f11c6cce221393770c03deae9349cdfdaf2f64cda41165f56a2cfdce3071e612a37990c0ba5504b3e1d30d39949507e51143ba5091d5dcb68545ec099576ae1f7cfdcfe3f5a5a63cfb622456f3c8afb11b7f42621e4f095416f42ef4c587ea9a9c84ec9436d49bff1b31046a7c6d02d9207a077f5ce9ede54192a106b3b0d81fcc0184d8e42dae52d685497b6493badbd1d06fa772d0028ae26af5d248e3c01dc2f76b3e46ac85014010de1ab7865f1e93d52464d83a3a99c58d24f1c04d2a671be60368df8a47e4f7a17c7291aa34d752294f121fb10d9967338b6667b18b84cf5ac808486b5618f1996f2404bf7fc1e88595d483bee226934f2917ec59df1f3ed3d9625c521662724958f45ee0d3f33ac36213ba5d384323fd71685c67662f3aa0490d5ee2a43656b63bdc19181074d73610bc7acdd83c2f66f489a19b268053934aaf86b69f7692269de4587a1d755e444c0ec3b4d688eccfb862d629c28e61d07a944956eb2a458159fa3b0829a79a1b1d7a2c7feef0bc5fdc54a49378d9329946c7356df9368bae86e4665520de5bab70b9739217a7454bce1a38583a79832f33215f6a0880eba67bce3717b94153baec789b347edef3c4d13e4b4291f0963182d5383e5493238ee0ab7f1fb69b03feb3659ccaa464041cae1b2d305d9ddf3c74a8cb9365f6f8fec9925af676adc292d3b13f6fd210b697696d0ba0fce9a91d041e17da099c834883a186b20a593389b8b50033bdd54b4dc776e45c274ef19d7f414b133a378c2f2815998541d95c44e169f0a1f1ef1576b773e8b2e8f1ed1b3cd609d6bd1842ac38eb6f74fd30d5dcaa4551a6b3180cb7d5488aac8b0f92ca136e21562be38bca7d4caba32772bec69d1fa6ae4b565642508a6c211bcd212adcd7d03132cfc3c99870eaac788a1decead79c11237f7c77b71b5a15749ddb2b8e665e1ace120a6aa1c1e2e80955f9c691527069bf1f751a9b415622b256c5404e224d3733990ff72f4eac4e1cb16b9db1dfbe26249525c594945b583f829c87d798934b1d7ae94d9712afe70b2f6d4fe4e778ce1d4760eed111751b1339a42ed01a5dc470122094b221f46abe90bfce81dc595273cf29a73a44efb11a263f37f297404818b577c8c058211933797740b09ef259ada26b179690c724091033244c2ad546b9e288859bbc326873d17782efc094ebfc50676cc325454f943b03ae3f06986808266164ac34285d9fc5d2f5decdcb5a9a4fe0fc32d9b412d3611208d4fc024be4a20d921e69a37d96f20431e757a5a86e6236b753390c102ccc1d689c718e3b87b6a61a5c1096778bd2e22739511a34a2bae2c3cc78eba4776b26735adaa85b9404a1cf14d74980c94d72e2ba7ba23b27f0f9ec4cd3e225284f4bb164e64cb85daf43aca9fbe97c369a2d0c404a2aaaf362c5b868d06ae9618e5ea1704352814e09eedcbd08292f5c67f391a66c4edca263d7f2d3fd64855b54c141a4ba1bade6975d0953ba64a54c1e25f39c8f62e4ac1cd125e3ed897eb613b5ece97c32584fa5a034a9f0863dd1cca307d58b99a756707af1f2a65c2f521dee7ba1079a9e877f99eb0d4ad850a8c7c5bb64403a553e547328da91904fab9063523629e10691267f0812cc5ff5eb2fa5f471c49df33afa18c505071c8b6e830d4108f02d63c0b00e6fa3c2ae094101a9c8aeee174254936e7c62e6bc21861d9df5965aa846182e845f0f781c12163532c4930188f4b2eb47f15981f9654dea774eba8bacd50bebba915c367f5baf453c368901f87038d927fbc703105d1912c6bc729f65f8bdfecc677a4ab8743f5a55eff3e0ad12a0c4248a1d132bdb8522a742b3f3a48276b25b06407f4c8037c7f2732063e03f420c5cf29daf12a328e8a6fc8c30da7f5f966a693893d594ad236299d3614a4f9fb09472451f0b9a7675fa742233500aba76042c12e6111bbf11eb6f57fa5a0e6db127d330fdfbf376e8feb853a489530ab51d3381fbaac4c823d114f028838ea8fd3e1598d9f069051f53f21e460a57d5c27fb381386f8f5ce606fd019ddc29b3281dd294e912434544b0e9ce46562068b5f71ab08b435ce759127bc362b44296f82bb739c38aef74293d06c0954c6d96bf7d665bfcfe8f57521c5ea560331a", @ANYRES16=r0], 0xb4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1.057386216s ago: executing program 1 (id=875): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x13, &(0x7f0000000040)=@framed={{0x18, 0x2}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x6}, {0x7, 0x0, 0x4}, {0x6}, {}, {0x85, 0x0, 0x0, 0x5}}, @printk={@li, {0x3, 0x3, 0x6, 0xa, 0x1, 0xfff8, 0x51}, {0x5, 0x1, 0xb, 0x1, 0xa, 0x2}, {}, {}, {}, {0x85, 0x0, 0x0, 0x7b}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x5c, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x6}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) 936.499299ms ago: executing program 0 (id=876): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000340)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) (async) connect$inet6(r0, &(0x7f0000000340)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) socket$alg(0x26, 0x5, 0x0) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000010280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x800c1}, 0x8004) accept4(r2, 0x0, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)={0x12c, 0x4, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_CHAIN_HOOK={0x24, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x580a9c14}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x47f085d4}]}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_USERDATA={0x7b, 0xc, "76790c6872666dceda3d86ce49604f48b5139f192e577789b8a1d1abbda2901cd1a77d00017d75422ab1948948313fa30b5718cfe3449536d0068b457c1af78154df00521916d9bba70272fa4db331fcee6aeec639a695e791e1d71506bf172e6be2d5a40affdb4acad4126a3e2b51c801190d4d0a819b"}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x8000000000000000}]}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_HOOK={0x3c, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'syzkaller0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'gre0\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x26bbc3ba}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x390bea3e}]}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x4}]}, 0x12c}, 0x1, 0x0, 0x0, 0x40000}, 0x20048000) r3 = socket$netlink(0x10, 0x3, 0x8000000004) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r4, 0x10f, 0x82, 0x0, 0x0) (async) setsockopt$sock_attach_bpf(r4, 0x10f, 0x82, 0x0, 0x0) writev(r3, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) (async) writev(r3, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000040000000900000006"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r7 = openat$cgroup_devices(r6, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f00000000c0)=ANY=[@ANYBLOB='b *:4\tmr'], 0xa) (async) write$cgroup_devices(r7, &(0x7f00000000c0)=ANY=[@ANYBLOB='b *:4\tmr'], 0xa) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002300000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000280)={r8}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000280)={r8}, 0xc) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0xb, @dev={0xfe, 0x80, '\x00', 0x17}, 0x4}, 0x1c) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) 933.144834ms ago: executing program 1 (id=877): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000b80)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc6751dfb265a0e3ccae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce935b0f327cb3f011a7d06602e2fd52347125907000000000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df262ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71d20fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada12f7a1525320e716660000000000b02b001500a710eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d3294000000000000000000000000000000000000000000000000000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18a904c0e585a66c3b84b138efc20a546d3d5227e23b03f2a834391ad24fe7d9b20cf92cb151763d41f5c76e2ff3e93ee296c4082ee73e7e197253a2b66c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1c77a211bfa02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0843b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f04c7f0be31491eb8c9ff68236c8600000000000000000000000066e034c81c3cab4e33fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f2243471221c15fa12313ffbfa7c2730302b66a99f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca20508"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007200000095"], &(0x7f0000000500)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r0 = socket(0x10, 0x3, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(0x0, r1) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)={0x3c, r4, 0x1, 0x70fd2b, 0x25d7dbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4c040}, 0xc800) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="38000000b7574d3436cc790188c4a950f28314e780e2ddfdb3cc05f64479014206013b12a36cca697d64587aa65fc4fdb91395d65d75fbab634a87e38dd3f797044d47fcb2", @ANYRES16=r2, @ANYRES32=r6, @ANYBLOB="0c00050000000000000000000500370000000000"], 0x38}, 0x4, 0x700000000000000, 0x0, 0x4000000}, 0x0) (async) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1100000004000000040000000900000000000000", @ANYRES32=r6, @ANYBLOB='\x00'/20, @ANYRES16=r0, @ANYRES32, @ANYBLOB], 0x48) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$unix(0x1, 0x1, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) (async) r11 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000010c0)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) getsockopt$bt_hci(r11, 0x84, 0x6d, &(0x7f0000001100)=""/4112, &(0x7f0000001040)=0x1010) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@deltfilter={0x34, 0x2d, 0x8, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xd, 0xf}, {0xfff1}, {0xd, 0xa}}, [@TCA_CHAIN={0x8, 0xb, 0xfffffffd}, @TCA_CHAIN={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40040c5}, 0x24004800) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x6, 0xb, &(0x7f00000007c0)=ANY=[@ANYBLOB="1802000009f676280000000020000000180100002020752500000000002020207b1af8ff00000000ffa100000000000007010000f8ffffffb702000008000000b703000008000000850000000600100095000000000000005eb7e45d7548dd2f98a12c82360852da7f27b7223dfe630c0c34d3895f966c1bb2d4b412b8c49a58add46afc38823834dc5db75724d28d57b5c3195372f14b842653f982b3a229df5b07ffdaedbae4d2545e9e30e7112dfbcdc3e6a5953230098484f041aae0c1a2"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r12 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$sock_linger(r12, 0x1, 0x3c, 0x0, 0x0) (async) sendto$inet6(r11, 0x0, 0x0, 0x488c1, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2, 0xc}, 0x1c) (async) sendmmsg$inet6(r12, 0x0, 0x0, 0x400c404) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f00000000c0)={'ip_vti0\x00', 0x0}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r7, &(0x7f0000000000), &(0x7f0000000200)=@tcp, 0x3}, 0x20) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000004c0)={0x5, 0x40000}, 0x10) 932.108512ms ago: executing program 3 (id=878): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)=@o_path={0x0, 0x0, 0x10}, 0x18) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0x7, 0xf}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_cbs={{}, {0x0, 0x2, @TCA_CBS_PARMS={0x0, 0x1, {0x7, '\x00', 0x1, 0x5, 0x19bf, 0x3}}}}]}, 0x58}}, 0x44884) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) ioctl(r0, 0xfffffff6, &(0x7f0000000000)="673c467ae7fd8f631130e4edb96ff82112963295b83aec7b") r3 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000040)=0x4, 0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x3c}, 0x2, @in=@local, 0x6, 0x4, 0x3}]}]}, 0xfc}}, 0x0) r5 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg$inet6(r5, &(0x7f0000002dc0)=[{{&(0x7f0000000080)={0xa, 0x4e21, 0x4, @loopback, 0x12393448}, 0x1c, 0x0}}], 0x1, 0x8021) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r6) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r7, 0x1, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r9}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000101}, 0x84) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r1, {0x6}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_EMATCHES={0x4}]}}]}, 0x38}}, 0x2000c800) r10 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f00000002c0), 0x40000000000009f, 0x0) 929.371857ms ago: executing program 4 (id=879): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3}}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$packet(0x11, 0xa, 0x300) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async) write$tun(r1, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "6ad9ba", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x6}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x4}}}}}}, 0x7a) (async) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = socket(0x1, 0x803, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000840)={0x20, r5, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffc}]}]}, 0x20}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="adffa88800000000140012800b0001006d616373656300002a00028008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6], 0x44}}, 0x8000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040)={0xfffffffd}, 0x8) 922.133103ms ago: executing program 2 (id=880): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r2, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x2020) (async) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000002c00ef5f"], 0x14}, 0x1, 0x0, 0x0, 0x20008081}, 0x800) (async) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000001c0)={'wlan1\x00'}) (async) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x1e4783, 0x0) (async) r4 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000034000)={0x5, {{0xa, 0x4e21, 0xffffff00, @mcast2}}}, 0x88) (async) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000300)={0x2, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) getsockopt$inet6_buf(r4, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000e5f000)=0x90) (async) write$rfkill(r3, &(0x7f00000001c0)={0x20, 0x40, 0x2, 0x0, 0x1}, 0x8) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000020000000000000f0400000000005f"], 0x0, 0x28, 0x0, 0x3}, 0x28) (async, rerun: 32) r6 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r6, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xa000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x2f, 0x9f, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x80000000}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xc6}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x4c}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}]]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x40000) (async, rerun: 64) sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="74709fcbf1fcb0211c1e534ea2469cd8672ef37ecd1032889ee5c8bb8715caab6956984a3d37c93b8f47d65d77c0232a9a28298a676c09c9fc4e049714138f155693f7432bebfe97e2055781549276712466061c9fdfca3082bd99a0166b08bfe760659cc012c34b36cc11ec948305e80d92ed76386de5b415b299ecb1e39bb11b7f6518bf340ced80d6e971d49eab0ad371b564cd9fca5bb5436870142d854218", @ANYRES16=r5, @ANYBLOB="01002abd7000fedbdf2504000000"], 0x14}, 0x1, 0x0, 0x0, 0x2000}, 0x0) (async, rerun: 64) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000280), r0) syz_emit_ethernet(0x86, &(0x7f0000000480)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x50, 0x3a, 0x0, @mcast2, @local, {[], @pkt_toobig={0x8, 0x2, 0x0, 0x0, {0x0, 0x6, "000810", 0x0, 0x11, 0x0, @mcast1, @private2, [@dstopts={0x0, 0x0, '\x00', [@ra={0x5, 0x11, 0x1}]}], "fb36eeca6fad50b375a22a584d16ca55"}}}}}}}, 0x0) (async) sendmsg$DEVLINK_CMD_RATE_SET(r6, &(0x7f00000003c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0xc418e79cba278f6a}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r7, 0x401, 0x70bd25, 0x25dfdbfb, {}, [@DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 865.172772ms ago: executing program 0 (id=881): r0 = socket(0x2, 0x3, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x11}, 0x8001) syz_emit_ethernet(0x9c, &(0x7f0000000100)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@generic={0x9000, "a8c693f1767f82b18969754cfe20901b184257c5874bddf7b1e9d41826d36160b3dcc8ce16a0c9a426b2ca14dac31d8477531a52c61f4154ac4240e5f0a0d7988c742ce76e3196a10ebd319baf93cf789f98c2649726f9601b06c960b7477228d6247cfeea26d697dec8713b75b8ff05e0af431566b603462026181beea46aa28baefbcd2b1b5b373f45c1d5f520"}}}, &(0x7f0000000080)={0x0, 0x1, [0xa34, 0xc12, 0xef5, 0xb47]}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='X\x00k\v', @ANYBLOB="5dcb21d6739c44570ff31f6acd9715572d4be93241e00b5b4e0a066df30e31e01bd1b2b4a50251c5739cc60d78f1519dcea925b72c7a91f4a6d0e4e6eb8ab157a0d9d257dc34c6", @ANYBLOB="0100000000000000000009000000440003800800010002000000140002007663616e3000000000000000000000000800030000000000140006"], 0x58}}, 0x20008000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x48c0}, 0x40004c0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)={0x184, r3, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void, @val={0xc, 0x99, {0x9, 0x68}}}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xcc}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x4a17}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0xff}, @NL80211_ATTR_VENDOR_DATA={0x4}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xd}, @NL80211_ATTR_VENDOR_DATA={0xdd, 0xc5, "e0878d9e632eb264dea2a4ac12ffe2f2bf66a7ba4db01dd1491f75040ab7f4d153c970c45a1b5fc0f858af29f36202b3951d37061603852e348955d96388a93b10f3c79d4c69c9d3683795895d0ea046467d2e5f4b504c01de774d050c4658e1b80e0c38ab101e889f82ce13a45e8946bcc6a1f82a014a5d75b66fd26fe0926c29bb740faa93d40b5f828d5faf76d93d6fd03534c1ac99a77ced6a6e1db5d3d8b61dd56a13eca2e135c0b39cec89eeb270a90f7e151168fd72bd8cb54df32ead6788a8c4ccceaa981342df9d77a0f28c211d53eeaa10d247ec"}, @NL80211_ATTR_VENDOR_DATA={0x5e, 0xc5, "16f7b47579a26aac21891fb14f3fd4c2012b8a2cc73e7a55830dc6f7b424841965a6b9ac42993e82fd092b6fffe2e9f20652f039073afb5ad4a8194ca5880f9abeac7188285d90d0654855ca80c99bee30ce9e6b1be08fec81fe"}]}, 0x184}, 0x1, 0x0, 0x0, 0x4040}, 0x40d1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001000000400"/20, @ANYRESDEC=r1, @ANYBLOB="21000000000000002c00128009000100626f6e64000000001c000280050021", @ANYRES32=r0], 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 748.662761ms ago: executing program 2 (id=882): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x8, 0x4, 0x4, 0x4, 0x0, 0x1}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000300)='rcu_utilization\x00', r1}, 0x18) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) setsockopt$ax25_int(r3, 0x101, 0x7, 0x0, 0x0) setsockopt$ax25_int(r3, 0x101, 0x1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) ioctl$EXT4_IOC_GETFSUUID(r2, 0x8008662c, &(0x7f0000000100)) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) accept4(r4, 0x0, 0x0, 0x800) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r5, @ANYBLOB="08000100", @ANYRES32=r6], 0x90}}, 0x0) 655.803323ms ago: executing program 1 (id=883): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, 0x1406, 0x1, 0x70bd27, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0xfffffffffffffee1, 0x1, 0x4}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0xfffffffffffffd71, 0x1, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x4000004) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="00000000c0"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x7, 0x20, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6}, {0x27}}, [@printk={@lli, {}, {0x5}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x40}, {0x25}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfff}, @map_idx_val={0x18, 0x6, 0x6, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9}, @call={0x85, 0x0, 0x0, 0xd1}, @map_idx={0x18, 0x9, 0x5, 0x0, 0xf}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xffffffffffffffff}], {{0x4, 0x1, 0x9, 0x3, 0x2}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000000)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 577.786876ms ago: executing program 4 (id=884): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x34, &(0x7f00000000c0)=r0, 0x4) (async) listen(r1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x4, 0x0, 0x3, 0x4, 0x0, 0x70bd28, 0x0, [@sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}]}, 0x20}}, 0x0) readv(r3, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x1c}], 0x4) (async) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000080)={0x0, 'syzkaller1\x00', {0x4}, 0x1}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) (async) close(r1) (async) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000200)=r0, 0x4) 450.57078ms ago: executing program 0 (id=885): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x398, 0x0, 0xa, 0x148, 0x0, 0x10, 0x300, 0x2a8, 0x2a8, 0x300, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0, 0x0, {0x200003ae, 0x7f00}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x1, 0x1, {0xc9e5}}}}, {{@uncond, 0x0, 0x1f0, 0x250, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'wg2\x00', {0xffffffffffffffff, 0xff, 0x0, 0x0, 0x0, 0x7fff, 0x200}}}, @inet=@rpfilter={{0x28}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x2, 0x6, 0x0, 0x3, 0x1], 0x3, 0x3}, {0x2, [0x0, 0x8, 0x1, 0x5, 0x7, 0x7], 0x2, 0x5}}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x3f8) setsockopt$WPAN_WANTLQI(0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000480)=0x1, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8983, &(0x7f0000000440)={0x7, 'veth0_to_team\x00', {0x3}, 0xc17}) (async) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newtaction={0x64, 0x30, 0x871a15abc695f91d, 0x0, 0x80000, {}, [{0x50, 0x1, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x3468802, 0x40, 0x1, 0x3, 0x80000000}, 0x3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000004}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0xe, &(0x7f0000001740)=ANY=[@ANYBLOB="b702000000000000bfa30000000000001403000000feffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7040000050000006a0af2fe00000000850000007c000000b700000001000000950000000000000000e154cd844a954b26c933f7ffffffffffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da487130d5f24bf901115e17392ac66ad029d1c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f82ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d6f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a7c31de7910d1ed4065a097b1b44b451de736bb6d43db89b03d4b7745fef1d036c633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db3503680e5e5971ff4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dacfeb47479321a0574fb304bc2a1681989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3de8726c2a61ec45c19f97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde0745db06753a7ac7fe13cab6692422a46e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9bdce38c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c5f1e24d9f679e4fbe948dfb4cc4af05c28308241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5490f6589880ed6eea7b9c670012be05e7de0940313c5870786554df2623d58f5ace92d028f2c71a6ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77962a2cd8a104e16b77d5f7f13b1640d43e11801140caf1a8b1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b905fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af0a77fbcf2cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf34117a82a96b2ced73abb8e4bb700d6ee7aebf9ef40662d7836d252c566f5ee938a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7eee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab50fe82d5a96b09c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e3633be3f00000001762e5f5a3a0bc33fdbe28a5ffc83f2f08544eb2794e7f791e8f6429309d6adab4b7e508e5bf0aaed8f8a005f2bbf96c89739f5d81e750d50515a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f85d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d801002653c4d9818708e27c89b552d3fcd11ebce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff2a8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4000000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b850580994484305d7a1759782ae57773e0d8b0ab900edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af0bd91e328b6a6f732a91f0e2e9120be61e58c79d497247d278888901d44bf77ff246605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c2d0836395fe39f0e11c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc71300000000000021000000b12f0ec0412268860027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b50f3ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861ddb54684cb73e7aeefae47fa09fd88e6043bd52ae84c1bb0c8a6b769f952283a1f4e3842edb3d42c68a2102fa1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e81163bde261fd00000000007231e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d1b8b90bc0df4c4b51b1f922a44ec675203bf8d1548e49262727c3de6daab3b4ed15aa99802e45d0620617e839b5237ddfcf103c91e61d174e3be6c9fd47398797e3b814e751ff31ecb42de6dd9d6b88121aaa680c236a303914e00150e1ec3f144ebc28287d5b51cfb8cabb844d12b140767d0fc24425590024b2e431722392489e3d43b3e31438a0138988083c47c61384d54e9a40fba01cac6e59ec82edc764840fe551c1d57442970cd8e59b9f41094e158c0a1ee855d8515599685486c2a21fa1c107531a0db8306441e8408b34aa90e9736e672d74cb8e78f8bdb93a23d024fc200796836ab396911a56231e953efad6cd83db32ffc595d970108e9547ea0000002730d5d1b70fe8b458ac1651135037b6cb9c8053299f77ab84c5b9fd2f764c3caa9c69377c397d310ddc7bc4bfa165def7b49e28ef196ae263b6829a8419d8860f56c86c288964ac4bc19839d96ff24b981c3a4fd6f93a000000ea9d6b06dafae4c91177dfe70c4cf6c4af38e261fa4d0538c0c4201e2c4eb47d828bfc488fca2aaf37a09250032e22dba0d0fc9f4a10310758687c57e0c6552e0acb19a675bf29ebac9b62a286509b8d95c009ab91530e6a0220b82962699aa892b01620c078c183486fac284df57d7d4d29191704df53e1b7237dda23648f27b054282d0cef44a4a71fe29abb6754102015f196cc3f5ddbabb0e7aaa4a3d6a7ea87ef12f0316078ae0ce05a56f9c48ed124a60466d39628eabe5ed822eeeb4302a69b3e493d5f67b761f6f877846e148e1f87", @ANYRESDEC=r0], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, &(0x7f0000000400), 0x8, 0x10, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x8001}, 0x10, 0xffffffffffffffff}, 0x94) 450.063634ms ago: executing program 3 (id=886): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x80, 0x1, 0x28}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x6, '\x00', 0x0, @fallback=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="120000000800000004000000b47c000000000000", @ANYRES32, @ANYBLOB="1000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000200"/28], 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) socket$nl_crypto(0x10, 0x3, 0x15) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) listen(r5, 0x0) accept$ax25(r5, 0x0, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x1000000, 0xe, 0x0, &(0x7f0000000400)="e0b9547ed387c6e950a4e1f95bec", 0x0, 0xf, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x18) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000480)='mm_page_pcpu_drain\x00', r6, 0x0, 0xf2c8}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="61158800000000006113500000000000bfa000000000000007000000ee0016055e03010000000000160500000000000069163e0000000000bf07000000000000260507000fff07206706000007000000140600001be60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r7, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r3], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) close(r2) sendmsg$IPSET_CMD_FLUSH(r4, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c000000040101030000000000000000020000070900020073797a30000000000900020073797a310000000005000100070000000500010007000000"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000800) sendmsg$nl_route(r1, &(0x7f0000002bc0)={0x0, 0x0, &(0x7f0000002b80)={&(0x7f0000002980)=ANY=[@ANYBLOB="280000001100010027bd7000ffdbdf2500000000", @ANYRES32=r7, @ANYBLOB="c000000000140000ef4da59a0f000800"], 0x28}, 0x1, 0x0, 0x0, 0x60000145}, 0x40804) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000440)={'veth1_to_bond\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) close(0x4) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x48) 447.67809ms ago: executing program 1 (id=887): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$NET_DM_CMD_START(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r1, 0x10, 0x70bd25, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x28800}, 0x48000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @private=0xa010100}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x83, &(0x7f0000000480)={r6, 0x2}, 0x8) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x14, r3, 0x60b, 0x70bd29, 0x25dddbfc}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x24000080) 406.76752ms ago: executing program 2 (id=888): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x3a8, 0xffffffff, 0xf0, 0x260, 0xf0, 0xfeffffff, 0xffffffff, 0x330, 0x330, 0x330, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast1, [0xff, 0xff, 0x0, 0xffffff00], [], 'pimreg0\x00', 'bond_slave_0\x00', {}, {}, 0x6, 0x0, 0x3}, 0x2f2, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@dev={0xac, 0x14, 0x14, 0x1d}, 'caif0\x00', {0x7}}}}, {{@ipv6={@mcast1, @loopback, [], [0x0, 0x0, 0xffffffff], 'netdevsim0\x00', 'geneve0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "ddabf53d9b1435965491f6531877000001e770b689f173dfa40b58c10327e3121114449fd20ba2be6eb0cde72a972f25170163232ed996b4789b9d00"}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffd}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r0) sendmsg$NFC_CMD_LLC_GET_PARAMS(r3, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="240028bd7004ff00000000e919a9c01d8d6456f54da9334c802c00004000bd19c2252d61807e"], 0x14}, 0x1, 0x0, 0x0, 0x20000001}, 0x880) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0xcc, r2, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x24, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x1}, {0x5}, {0x5}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MLSCATLST={0x18, 0xc, 0x0, 0x1, [{0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x21fb065d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3a5d80a3}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x2c, 0x4, 0x0, 0x1, [{0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x1}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x1}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x38, 0x8, 0x0, 0x1, [{0xfd36, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x629297c5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7c}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2b5346a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xae}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4c3eeba8}]}]}]}, 0xcc}}, 0x0) 316.229038ms ago: executing program 0 (id=889): r0 = socket$inet_icmp(0x2, 0x2, 0x1) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xff}}, 0x10) (async) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{@in6=@mcast2, 0x0, 0x2b}, 0x0, @in=@empty}}, 0xe8) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x2, 0xd, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @private1}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast1}}, @sadb_x_policy={0x2, 0x12, 0x2, 0x2, 0x0, 0x0, 0x0, {0x6, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, @in6=@private1, @in6=@private1}}, @sadb_lifetime={0x4, 0x4}]}, 0xc0}}, 0x0) 227.887174ms ago: executing program 4 (id=890): r0 = socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x5, 0x0, 0x1}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000100)='mm_lru_insertion\x00', r2}, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r3, &(0x7f0000000180), 0x40010) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), 0xffffffffffffffff) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@newchain={0x34, 0x64, 0x300, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x9, 0xfff1}, {0x0, 0x1}, {0x10, 0x10}}, [@TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_CHAIN={0x8, 0xb, 0x401}]}, 0x34}, 0x1, 0x0, 0x0, 0x44045}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="5000000010000104"], 0x50}}, 0x4000084) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYRES64=r4], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='contention_end\x00', r7}, 0x18) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x15, 0x0, 0x7, 0xb, 0xffdffffe}) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r8, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r8, &(0x7f0000000080)=ANY=[], 0x6) 225.717701ms ago: executing program 2 (id=891): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x181341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f0000000080)=@assoc_value, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r6, 0x84, 0x10, &(0x7f00000000c0)=@assoc_value={0x0, 0x4}, &(0x7f0000000140)=0x8) ioctl$sock_inet6_SIOCDIFADDR(r6, 0x8936, &(0x7f0000000040)={@private2, 0x51, r4}) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r8, &(0x7f00000009c0)=[{&(0x7f0000000400)="1e8fcce8f00c20c3713b0c220663c3b66bb174e7d57d1fe72dbb0d27d9cbe1ec30047462375528c2c005a0ccd366c1ab0b8e5e0d788c178dbbdea330a90fa9e7c51a1aaf175a9d59559f29c09ff5e337e791be17c1ef703647852fe9e1b3ab3e6cd1c3b84b92c9822e232e0052c33bec0c49ee12b56b36e6c5be956e7791334289cd58966289930fe24f617b6c7821", 0x8f}, {&(0x7f00000002c0)="a019310500e5", 0x6}, {&(0x7f0000000640)="146d7d1fe23f2a38218e567b79d540f9855f11c272611653b571eaa7f1ae51d8da60a58cf2d3edc698914eaa6fb32bf9ba", 0x31}], 0x100000000000022b) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2180}, [@IFLA_IFNAME={0x14, 0x3, 'syz_tun\x00'}, @IFLA_CARRIER={0x5, 0x21, 0x4}]}, 0x3c}}, 0x0) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_netfilter(0x10, 0x3, 0xc) close(r10) socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r10, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) read(r10, &(0x7f0000000000)=""/31, 0x1f) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=@newtclass={0x8c8, 0x28, 0x20, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x8, 0x6}, {0xb, 0xfff2}, {0x9, 0x10}}, [@tclass_kind_options=@c_htb={{0x8}, {0x438, 0x2, [@TCA_HTB_PARMS={0x30, 0x1, {{0x5, 0x2, 0x4ea7}, {0x2, 0x0, 0x0, 0x4, 0x6, 0xbe96}, 0x9, 0x3, 0x2, 0x400}}, @TCA_HTB_CTAB={0x404, 0x3, [0x8, 0x6, 0xe, 0x6, 0x9, 0x7, 0x74d, 0x4, 0xe614, 0x6, 0x9, 0x0, 0x5, 0x4, 0x3, 0x100, 0x4, 0x9, 0xb, 0xae4, 0xa, 0x5ec8, 0xffff, 0xb, 0x4, 0x401, 0x10000002, 0x9, 0x7, 0x4a5, 0x939e, 0x2, 0x7fffffff, 0x3adb9e15, 0x9, 0xfffffff8, 0x8001, 0x8, 0x4, 0x1, 0xb, 0x2, 0xfff, 0x4, 0xffffffff, 0x1000, 0x2, 0x8, 0x5, 0x3, 0x50000, 0x1, 0xe3f, 0x8, 0x2, 0xdc4a, 0x0, 0x3, 0x80000000, 0x7, 0x8, 0x5, 0x9, 0x3, 0x5, 0x8, 0x2, 0x5, 0x10c, 0x0, 0x2, 0xff, 0x1ae5843, 0x2, 0x4, 0x3, 0x80000004, 0x6794, 0xcf9e, 0x2, 0x8001, 0x9, 0x9, 0x1, 0x3ff, 0x4, 0x8000, 0xd7, 0xffff0000, 0x80, 0x4, 0x93b, 0x0, 0x10001, 0x7aeb, 0x8, 0x8, 0x80000000, 0xfffffffe, 0x9, 0x2, 0x2, 0x8, 0x7f, 0xa, 0xf, 0xb25d, 0x5, 0x10000, 0xfd, 0x2, 0xff, 0xfffffe01, 0x3, 0x6, 0x3, 0x7, 0x401, 0x5, 0x3, 0x9e8, 0x0, 0xf1b7, 0x10000, 0x8, 0x0, 0x7fff, 0x3, 0x3, 0x7, 0x3, 0x5, 0x6, 0xffffffff, 0x3, 0xfe1, 0x10, 0x4, 0xc, 0x3, 0x7fffffff, 0x0, 0x1, 0x1, 0x7, 0x6, 0x2fe540, 0x0, 0x22, 0xd8, 0x3b, 0x440, 0x9, 0x10000, 0x9, 0x0, 0x3, 0x1000000, 0xb, 0x4, 0x301, 0x9, 0x5c, 0x0, 0x8ac7, 0xd3d, 0x1, 0x7a, 0x389, 0x4, 0x7, 0x1, 0x4, 0x7b1, 0x8, 0xffffff81, 0x7, 0x19, 0x0, 0x80000000, 0xf, 0x2, 0x2, 0xe8, 0x7, 0x8, 0x9, 0x41, 0xffffffff, 0x4, 0x7ff, 0x8, 0x2, 0xffff, 0x106, 0x5, 0x5, 0x3ff, 0x6, 0x3, 0x8, 0x815, 0x10001, 0x6eb, 0x3ff, 0x1, 0x7, 0x3, 0xfff, 0x0, 0xfffffffa, 0xc0, 0x8a30, 0x3, 0xfffffffc, 0x4, 0x0, 0x0, 0x5, 0x0, 0x896, 0x4, 0x7, 0x5, 0x53412cc7, 0x4, 0x9, 0x8000, 0x9, 0x1, 0xb3, 0x0, 0x9, 0x7, 0x3, 0x2, 0x3, 0xe, 0x1, 0x40008, 0x5, 0x6, 0x77c2, 0x9, 0x7, 0x2, 0x3, 0x7, 0x7, 0x9, 0x2, 0xc424, 0xff, 0x4, 0x7fffffff, 0x40000000]}]}}, @tclass_kind_options=@c_clsact={0xb}, @tclass_kind_options=@c_taprio={0xb}, @TCA_RATE={0x6, 0x5, {0xfe, 0xf}}, @tclass_kind_options=@c_mq={0x7}, @tclass_kind_options=@c_htb={{0x8}, {0x420, 0x2, [@TCA_HTB_CEIL64={0xc, 0x7, 0x8}, @TCA_HTB_CEIL64={0xc, 0x7, 0x2d6b}, @TCA_HTB_RTAB={0x404, 0x4, [0x8, 0x6, 0x4, 0xd35, 0x0, 0x4, 0xffff, 0x7f, 0x8001, 0xd, 0x0, 0x400, 0x9, 0x6, 0x3, 0x8, 0x0, 0x0, 0x7, 0x5, 0x56c0, 0x1a7fa648, 0x0, 0x8, 0x5e53, 0x2, 0x10, 0x7, 0x7, 0x0, 0x7, 0x5, 0x0, 0x0, 0x5, 0x8, 0x80000001, 0x7f, 0xb, 0x7, 0x5, 0x6c, 0x2, 0x2, 0x0, 0x4, 0x9, 0x3, 0x5, 0x8, 0x8, 0x1, 0x7, 0x3, 0x6, 0x8, 0x0, 0xffffffff, 0xfffffff8, 0x8000000, 0x8, 0x4, 0x3, 0x80, 0x8, 0x2, 0x1, 0xffff, 0xffffffff, 0x8, 0x2, 0x8001, 0x400, 0xf0, 0x40, 0x1, 0x6eaf, 0x4, 0xc0, 0x6, 0x3ff, 0x1be, 0x7f, 0x9, 0x8, 0x7, 0x4, 0x40, 0x4da2, 0x1, 0x8, 0x2c, 0x2cabc9ff, 0x8e84, 0xfff, 0x6, 0x6, 0x7, 0x9, 0x1, 0x1, 0x6, 0x2, 0x3, 0x402, 0x6, 0xfffffffa, 0x4, 0x0, 0x240, 0x10000, 0x4, 0x7, 0x7, 0x5, 0x6, 0x25e, 0x7, 0x9, 0x6, 0x101, 0x1, 0xf0, 0x1, 0x71, 0x44, 0x7, 0x6, 0x40000000, 0x7fff, 0x7, 0x578, 0x5, 0x3, 0x32, 0xffffff77, 0x5, 0x8, 0x3, 0x5, 0x0, 0x7, 0x4, 0x8, 0x34, 0x2, 0x9, 0x0, 0x4f9b, 0x9, 0x1, 0x6, 0x2, 0x77a8, 0x7fff, 0x0, 0xc0000000, 0x10000, 0x4, 0x3, 0x10001, 0x4, 0x1, 0xffff8001, 0x1, 0x2781, 0x0, 0x6de, 0x9, 0x9, 0x7, 0x8d30, 0x9, 0x1a7, 0x5, 0x3, 0x4, 0x4, 0x4a3, 0x1, 0xffffffc0, 0x2, 0x10000, 0x80000000, 0x0, 0x9, 0x7, 0x200, 0xfffffffb, 0x4, 0x20000, 0x1, 0x6, 0x4, 0x9, 0x3, 0x7ff, 0xfffff000, 0x8, 0x8c4, 0x3f1d5e64, 0x5, 0x58, 0x73, 0x7f, 0x4, 0x200, 0x7, 0x101, 0x1, 0x5b3, 0x401, 0x7600000, 0x5, 0xfffffe01, 0xd47, 0x815f, 0x2, 0x1, 0x9, 0x5, 0x65bd6dd6, 0x1, 0x6, 0x786, 0x8, 0x4, 0x2, 0x2, 0x200, 0xb, 0x8, 0x7, 0x2, 0x6, 0x7, 0x5, 0x7, 0x10, 0x9, 0x3, 0x800, 0x0, 0x1, 0x0, 0x0, 0x2, 0xf, 0x3, 0x7, 0xffff8000, 0x6, 0x9, 0x3b8, 0x9, 0x30f1]}]}}, @tclass_kind_options=@c_clsact={0xb}, @TCA_RATE={0x6, 0x5, {0x8, 0x2}}]}, 0x8c8}, 0x1, 0x0, 0x0, 0x4040000}, 0x240000a0) 156.960941ms ago: executing program 0 (id=892): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r0}, &(0x7f0000000840), &(0x7f0000000880)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000440)="b9ff03076804268c989e14f088a8", 0x0, 0x90d, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket(0x10, 0x6, 0x80000) write(r2, &(0x7f0000000000)="240000001e005f8000400000000000000a000000010000000000080008000100000303ff", 0x24) r3 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newqdisc={0x68, 0x14, 0xf0b, 0x4, 0x0, {0x2, 0x0, 0x0, 0x0, {0xa}, {0xd, 0xf}, {0x9}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0xfc, 0x200, 0x80000a, 0x0, 0x1, 0xa8}}, {0x4}}, {{0x1c, 0x1, {0x6, 0x4, 0x18, 0xd, 0x0, 0x8, 0x2}}, {0x4}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x400c012}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffe}, [@call={0x85, 0x0, 0x0, 0x1a}]}, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x25}, 0x94) 147.21362ms ago: executing program 4 (id=893): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="a14b474caea05f5e2cb7517394aa4d43fc6632474b2c4abc4e1851d24b2dabd95321a29e45b45e550f5a345bc9ff2a214210608a36231dc4", @ANYRESDEC=r0, @ANYRES16=r0, @ANYRESDEC, @ANYRES8=r1], 0xf4}, 0x1, 0x0, 0x0, 0x81}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000500)={0x34, r3, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_RINGS_TX={0x8}, @ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}]}, 0x34}}, 0x0) r4 = socket$can_bcm(0x1d, 0x2, 0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$IPVS_CMD_FLUSH(r5, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x74, r6, 0x200, 0x70bd2d, 0x4, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xa58d}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@empty}]}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x29}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x35}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x89}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000040) connect$can_bcm(r4, &(0x7f0000000140), 0x10) connect$can_bcm(r4, &(0x7f0000000040), 0x10) r7 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r7, 0x6, 0x20, &(0x7f0000000080)={@in={{0x2, 0x0, @remote}}, 0x3, 0x0, 0x1a, 0x0, "5e3b86774ef89ec669fabcaff49c2eeb8c4614c85b196a0c67a7768e058e3008931c08d43101cb8242bc42b8e0662749302c1ffcd1d1190000000000000000000000000000000000000000000200"}, 0xd8) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) r8 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg(r8, &(0x7f0000005280)=[{{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000002180)="f8d1c77d6dcbd92e9497d9ab1af5a50c00823b80a869df40c71b29ba", 0x1c}, {&(0x7f00000021c0)="28564cac5c4fd196b78495035d77cf067cfb87ad16e60bb969ff4930b0682e1f6b943c89e148f96543641d698430d4c66b705c5d6ffa8c041665f822468a31bd359abf8afad40bf978862619e145422848be54", 0x53}], 0x2}}, {{&(0x7f0000003580)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x2, 0x3, 0x3, 0x2, {0xa, 0x4e23, 0x0, @remote, 0x8000}}}, 0x80, &(0x7f0000003780)=[{0x0}], 0x1}}], 0x2, 0x4000004) socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f00000053c0)=[{{0x0, 0x0, 0x0}, 0x170}], 0x1, 0x1, 0x0) 0s ago: executing program 0 (id=894): r0 = socket$inet(0x10, 0x3, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r3, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000540)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r4 = socket(0x2d, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES64=r4], 0xa) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff3, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x4f8, 0x0, 0x72}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008850) recvfrom$l2tp6(r1, &(0x7f00000000c0)=""/7, 0x7, 0x40000000, &(0x7f0000000100)={0xa, 0x0, 0x0, @private2}, 0x20) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0xac, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0xe}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x2]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}]}, 0xac}}, 0x0) r8 = syz_genetlink_get_family_id$gtp(&(0x7f0000000240), r1) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000060000b000000000000000008500000017000000850000002300000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r9, 0x0, 0x8005, 0x0, &(0x7f0000000000)='\a\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x8005, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) sendmsg$GTP_CMD_NEWPDP(r7, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r8, 0x100, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000050}, 0x40800) kernel console output (not intermixed with test programs): rface with an up link [ 88.080665][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.092681][ T5832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.105573][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.147965][ T5832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.172544][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.234596][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.258159][ T5833] team0: Port device team_slave_0 added [ 88.278157][ T5829] team0: Port device team_slave_0 added [ 88.297624][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.305437][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.312594][ T5831] bridge_slave_0: entered allmulticast mode [ 88.320007][ T5831] bridge_slave_0: entered promiscuous mode [ 88.329808][ T5833] team0: Port device team_slave_1 added [ 88.337691][ T5832] team0: Port device team_slave_0 added [ 88.347067][ T5829] team0: Port device team_slave_1 added [ 88.364287][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.371499][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.378925][ T5831] bridge_slave_1: entered allmulticast mode [ 88.386368][ T5831] bridge_slave_1: entered promiscuous mode [ 88.407911][ T5832] team0: Port device team_slave_1 added [ 88.424867][ T5846] Bluetooth: hci0: command tx timeout [ 88.430768][ T5835] Bluetooth: hci2: command tx timeout [ 88.439445][ T5838] team0: Port device team_slave_0 added [ 88.447581][ T5838] team0: Port device team_slave_1 added [ 88.504056][ T5846] Bluetooth: hci3: command tx timeout [ 88.504063][ T5153] Bluetooth: hci4: command tx timeout [ 88.515486][ T5835] Bluetooth: hci1: command tx timeout [ 88.536151][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.543133][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.569626][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.593806][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.600894][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.627804][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.654780][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.665571][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.672535][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.699213][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.711193][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.718259][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.744613][ T5832] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.756473][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.763726][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.789802][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.801753][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.808908][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.835202][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.848928][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.866483][ T5832] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.873537][ T5832] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.899624][ T5832] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.925370][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.932440][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.958683][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.014462][ T5831] team0: Port device team_slave_0 added [ 89.050270][ T5831] team0: Port device team_slave_1 added [ 89.122431][ T5832] hsr_slave_0: entered promiscuous mode [ 89.129040][ T5832] hsr_slave_1: entered promiscuous mode [ 89.175228][ T5833] hsr_slave_0: entered promiscuous mode [ 89.181628][ T5833] hsr_slave_1: entered promiscuous mode [ 89.188668][ T5833] debugfs: 'hsr0' already exists in 'hsr' [ 89.194732][ T5833] Cannot create hsr debugfs directory [ 89.219503][ T5829] hsr_slave_0: entered promiscuous mode [ 89.226127][ T5829] hsr_slave_1: entered promiscuous mode [ 89.232257][ T5829] debugfs: 'hsr0' already exists in 'hsr' [ 89.238164][ T5829] Cannot create hsr debugfs directory [ 89.249374][ T5838] hsr_slave_0: entered promiscuous mode [ 89.256420][ T5838] hsr_slave_1: entered promiscuous mode [ 89.262524][ T5838] debugfs: 'hsr0' already exists in 'hsr' [ 89.268914][ T5838] Cannot create hsr debugfs directory [ 89.276711][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.284001][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.310050][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.335606][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.342592][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.369233][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.564464][ T5831] hsr_slave_0: entered promiscuous mode [ 89.571114][ T5831] hsr_slave_1: entered promiscuous mode [ 89.577884][ T5831] debugfs: 'hsr0' already exists in 'hsr' [ 89.584119][ T5831] Cannot create hsr debugfs directory [ 90.042723][ T5832] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.057679][ T5832] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.079041][ T5832] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.099428][ T5832] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.150307][ T5829] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.171507][ T5829] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.182046][ T5829] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.199276][ T5829] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.288087][ T5833] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.312353][ T5833] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.327043][ T5833] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.340051][ T5833] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.448503][ T5831] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.464489][ T5831] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.476038][ T5831] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.489069][ T5831] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.504570][ T5835] Bluetooth: hci0: command tx timeout [ 90.510119][ T5846] Bluetooth: hci2: command tx timeout [ 90.583694][ T5835] Bluetooth: hci1: command tx timeout [ 90.589357][ T5846] Bluetooth: hci3: command tx timeout [ 90.594390][ T5153] Bluetooth: hci4: command tx timeout [ 90.617870][ T5838] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.628778][ T5838] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.646977][ T5838] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.666905][ T5838] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.685452][ T5832] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.704707][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.773357][ T5829] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.787495][ T5832] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.808208][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.815509][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.839417][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.846658][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.857012][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.864286][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.897096][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.904318][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.929305][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.005418][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.067234][ T5833] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.092694][ T5831] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.106332][ T1141] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.113524][ T1141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.141358][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.148508][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.196220][ T1100] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.203484][ T1100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.275616][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.296988][ T1100] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.304321][ T1100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.427132][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.472195][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.479342][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.510155][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.517437][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.577288][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.591761][ T5832] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.809995][ T5832] veth0_vlan: entered promiscuous mode [ 91.875429][ T5829] veth0_vlan: entered promiscuous mode [ 91.910183][ T5832] veth1_vlan: entered promiscuous mode [ 91.937529][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.949265][ T9] cfg80211: failed to load regulatory.db [ 91.957244][ T5829] veth1_vlan: entered promiscuous mode [ 92.050222][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.112291][ T5832] veth0_macvtap: entered promiscuous mode [ 92.149419][ T5832] veth1_macvtap: entered promiscuous mode [ 92.162346][ T5829] veth0_macvtap: entered promiscuous mode [ 92.204760][ T5829] veth1_macvtap: entered promiscuous mode [ 92.255852][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.266267][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.286103][ T5832] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.308232][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.331430][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.357576][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.374452][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.393612][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.425009][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.441202][ T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.451784][ T5833] veth0_vlan: entered promiscuous mode [ 92.459928][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.469058][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.489690][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.529287][ T5833] veth1_vlan: entered promiscuous mode [ 92.584132][ T5153] Bluetooth: hci2: command tx timeout [ 92.587199][ T5846] Bluetooth: hci0: command tx timeout [ 92.661096][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.666493][ T5846] Bluetooth: hci3: command tx timeout [ 92.670744][ T5153] Bluetooth: hci1: command tx timeout [ 92.674631][ T5835] Bluetooth: hci4: command tx timeout [ 92.680644][ T5838] veth0_vlan: entered promiscuous mode [ 92.691698][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.737055][ T1157] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.749235][ T1157] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.769230][ T5838] veth1_vlan: entered promiscuous mode [ 92.783514][ T5831] veth0_vlan: entered promiscuous mode [ 92.807859][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.832324][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.841563][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.849722][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.862409][ T5833] veth0_macvtap: entered promiscuous mode [ 92.885706][ T5831] veth1_vlan: entered promiscuous mode [ 92.898140][ T5833] veth1_macvtap: entered promiscuous mode [ 92.939278][ T5829] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 92.966907][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.016917][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.075155][ T5838] veth0_macvtap: entered promiscuous mode [ 93.108916][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.125453][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.147052][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.162676][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.172697][ T5838] veth1_macvtap: entered promiscuous mode [ 93.236607][ T5831] veth0_macvtap: entered promiscuous mode [ 93.277876][ T5831] veth1_macvtap: entered promiscuous mode [ 93.285133][ T5962] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 93.291369][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.307761][ T5960] veth0: entered promiscuous mode [ 93.349963][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.369654][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.404451][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.439383][ T5960] netlink: 'syz.0.1': attribute type 16 has an invalid length. [ 93.456237][ T1141] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.474172][ T5960] netlink: 'syz.0.1': attribute type 17 has an invalid length. [ 93.498577][ T5960] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 93.542146][ T1141] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.568155][ T5965] syz.1.7 uses obsolete (PF_INET,SOCK_PACKET) [ 93.592706][ T1141] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.604041][ T1141] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.630989][ T1141] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.640713][ T1141] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.676895][ T1141] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.686266][ T1141] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.716053][ T5960] veth0: left promiscuous mode [ 93.721157][ T1141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.745047][ T1141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.884410][ T5973] netlink: 45 bytes leftover after parsing attributes in process `syz.0.8'. [ 93.970223][ T1141] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.984015][ T1141] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.068813][ T1141] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.113541][ T1141] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.248228][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.256398][ T1100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.290077][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.304634][ T1100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.307550][ T5983] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3'. [ 94.394309][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.424541][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.666965][ T5835] Bluetooth: hci0: command tx timeout [ 94.667004][ T5846] Bluetooth: hci2: command tx timeout [ 94.744318][ T5846] Bluetooth: hci1: command tx timeout [ 94.744638][ T5153] Bluetooth: hci3: command tx timeout [ 94.755820][ T5835] Bluetooth: hci4: command tx timeout [ 94.846281][ T5999] gre0: entered promiscuous mode [ 94.872937][ T5999] gre0: entered allmulticast mode [ 95.268596][ T5989] netlink: 8 bytes leftover after parsing attributes in process `syz.0.13'. [ 95.479160][ T5989] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -12 [ 95.557655][ T5989] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -12 [ 95.597349][ T5989] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 95.609531][ T6021] netlink: 'syz.1.19': attribute type 4 has an invalid length. [ 95.629827][ T6021] netlink: 3657 bytes leftover after parsing attributes in process `syz.1.19'. [ 95.675227][ T6021] netlink: 4 bytes leftover after parsing attributes in process `syz.1.19'. [ 95.713740][ T6021] Zero length message leads to an empty skb [ 95.752868][ T5989] syz.0.13 (5989) used greatest stack depth: 17144 bytes left [ 95.866517][ T6021] sctp: [Deprecated]: syz.1.19 (pid 6021) Use of struct sctp_assoc_value in delayed_ack socket option. [ 95.866517][ T6021] Use struct sctp_sack_info instead [ 96.496926][ T6051] netlink: 4 bytes leftover after parsing attributes in process `syz.0.28'. [ 96.786236][ T30] audit: type=1800 audit(1765239113.958:2): pid=6035 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.23" name="memory.events" dev="tmpfs" ino=33 res=0 errno=0 [ 96.947546][ T6068] netlink: 'syz.3.31': attribute type 1 has an invalid length. [ 96.988189][ T6068] netlink: 4 bytes leftover after parsing attributes in process `syz.3.31'. [ 97.080804][ T6073] Bluetooth: MGMT ver 1.23 [ 97.610688][ T6094] netlink: 8 bytes leftover after parsing attributes in process `syz.3.39'. [ 97.640785][ T6094] tap0: tun_chr_ioctl cmd 1074025677 [ 97.655376][ T6094] tap0: linktype set to 0 [ 97.739383][ T6101] netlink: 2 bytes leftover after parsing attributes in process `syz.1.40'. [ 98.286154][ T6118] netlink: 'syz.4.45': attribute type 1 has an invalid length. [ 98.558333][ T6128] macvlan2: entered promiscuous mode [ 98.563901][ T6128] macvlan2: entered allmulticast mode [ 98.763817][ T6137] netlink: 16 bytes leftover after parsing attributes in process `syz.0.49'. [ 98.916805][ T6143] x_tables: duplicate underflow at hook 1 [ 98.919276][ T6144] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 99.469385][ T6158] netlink: 104 bytes leftover after parsing attributes in process `syz.1.57'. [ 99.536999][ T6158] netlink: 20 bytes leftover after parsing attributes in process `syz.1.57'. [ 99.567859][ T6163] netlink: 56 bytes leftover after parsing attributes in process `syz.4.60'. [ 99.808808][ T6168] netlink: 84 bytes leftover after parsing attributes in process `syz.1.63'. [ 99.834558][ T6169] netlink: 8 bytes leftover after parsing attributes in process `syz.3.62'. [ 99.974295][ T6176] netlink: 12 bytes leftover after parsing attributes in process `syz.4.65'. [ 100.682366][ T6212] netlink: 16 bytes leftover after parsing attributes in process `syz.2.79'. [ 100.784233][ T6215] Illegal XDP return value 514 on prog (id 90) dev syzkaller1, expect packet loss! [ 101.015434][ T6227] netlink: 216 bytes leftover after parsing attributes in process `syz.4.84'. [ 101.025132][ T6227] netlink: 24 bytes leftover after parsing attributes in process `syz.4.84'. [ 101.034434][ T6227] netlink: 16 bytes leftover after parsing attributes in process `syz.4.84'. [ 103.206496][ T6340] 8021q: adding VLAN 0 to HW filter on device bond1 [ 103.227459][ T6346] netlink: 'syz.0.122': attribute type 2 has an invalid length. [ 103.582831][ T6354] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 104.466485][ T6404] xt_TCPMSS: Only works on TCP SYN packets [ 104.707832][ T6419] syzkaller0: entered promiscuous mode [ 104.723270][ T6419] syzkaller0: entered allmulticast mode [ 104.781295][ T6424] vxlan0: entered promiscuous mode [ 104.790378][ T6424] vxlan0: entered allmulticast mode [ 104.800544][ T6424] netlink: 'syz.0.145': attribute type 21 has an invalid length. [ 104.816091][ T12] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.836947][ T6424] netlink: 'syz.0.145': attribute type 6 has an invalid length. [ 104.849401][ T6424] __nla_validate_parse: 4 callbacks suppressed [ 104.849418][ T6424] netlink: 132 bytes leftover after parsing attributes in process `syz.0.145'. [ 104.877274][ T12] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 104.887960][ T6427] sch_tbf: burst 3 is lower than device syzkaller0 mtu (1514) ! [ 104.947913][ T12] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 105.032077][ T12] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 105.448062][ T6415] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 105.473582][ T6415] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 105.562079][ T6415] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 105.584454][ T6415] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 105.656031][ T6415] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 105.693874][ T6415] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 105.881232][ T6415] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 105.927420][ T6415] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 105.982971][ T6415] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 106.001612][ T6415] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 106.238116][ T6487] netlink: 'syz.4.160': attribute type 3 has an invalid length. [ 107.399084][ T6532] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.170'. [ 107.921512][ T6564] netem: change failed [ 108.014166][ T6572] tipc: Started in network mode [ 108.036199][ T6572] tipc: Node identity ff020000000000000000000000000001, cluster identity 4711 [ 108.070559][ T6572] tipc: Enabling of bearer rejected, failed to enable media [ 108.132305][ T6572] netlink: 4 bytes leftover after parsing attributes in process `syz.1.180'. [ 108.149149][ T6581] netlink: 8 bytes leftover after parsing attributes in process `syz.3.181'. [ 108.195791][ T6572] netlink: 68 bytes leftover after parsing attributes in process `syz.1.180'. [ 108.706320][ T6611] bridge0: entered promiscuous mode [ 108.711973][ T6611] macsec1: entered promiscuous mode [ 108.720332][ T6611] bridge0: port 3(macsec1) entered blocking state [ 108.727359][ T6611] bridge0: port 3(macsec1) entered disabled state [ 108.798755][ T6611] macsec1: entered allmulticast mode [ 108.836383][ T6611] bridge0: entered allmulticast mode [ 108.877578][ T6616] netlink: 72 bytes leftover after parsing attributes in process `syz.4.191'. [ 108.880074][ T6611] macsec1: left allmulticast mode [ 108.961651][ T6611] bridge0: left allmulticast mode [ 108.998247][ T6611] bridge0: left promiscuous mode [ 109.351417][ T6645] netlink: 8 bytes leftover after parsing attributes in process `syz.1.197'. [ 109.601148][ T6655] netlink: 64 bytes leftover after parsing attributes in process `syz.2.201'. [ 110.414755][ T6676] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.517191][ T6702] netlink: 732 bytes leftover after parsing attributes in process `syz.1.213'. [ 110.530855][ T6702] netlink: 732 bytes leftover after parsing attributes in process `syz.1.213'. [ 110.748117][ T6676] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 110.824571][ T6709] netlink: 64 bytes leftover after parsing attributes in process `syz.1.215'. [ 110.928587][ T6713] netlink: 16 bytes leftover after parsing attributes in process `syz.2.217'. [ 110.940620][ T6676] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.046625][ T6676] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 111.200928][ T6727] netlink: 'syz.4.216': attribute type 26 has an invalid length. [ 111.347290][ T4545] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.439217][ T4545] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.515819][ T4545] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.565522][ T6745] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bond, syncid = 1, id = 0 [ 111.576034][ T4545] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.584883][ T6744] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20002 [ 112.018487][ T6764] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.026485][ T6765] netlink: 64 bytes leftover after parsing attributes in process `syz.1.228'. [ 112.074813][ T6767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.229'. [ 112.138240][ T6767] netlink: 'syz.3.229': attribute type 5 has an invalid length. [ 112.152594][ T6769] netlink: 20 bytes leftover after parsing attributes in process `syz.2.230'. [ 112.173982][ T6767] netlink: 48 bytes leftover after parsing attributes in process `syz.3.229'. [ 112.225675][ T6764] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.320273][ T6767] geneve2: entered promiscuous mode [ 112.325956][ T6767] geneve2: entered allmulticast mode [ 112.349016][ T13] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 112.350502][ T6776] FAULT_INJECTION: forcing a failure. [ 112.350502][ T6776] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 112.364235][ T13] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 112.377128][ T6776] CPU: 0 UID: 0 PID: 6776 Comm: syz.4.233 Not tainted syzkaller #0 PREEMPT(full) [ 112.377161][ T6776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 112.377182][ T6776] Call Trace: [ 112.377197][ T6776] [ 112.377207][ T6776] dump_stack_lvl+0x189/0x250 [ 112.377246][ T6776] ? __pfx____ratelimit+0x10/0x10 [ 112.377276][ T6776] ? __pfx_dump_stack_lvl+0x10/0x10 [ 112.377299][ T6776] ? __pfx__printk+0x10/0x10 [ 112.377346][ T6776] should_fail_ex+0x414/0x560 [ 112.377380][ T6776] _copy_to_user+0x31/0xb0 [ 112.377416][ T6776] bpf_test_finish+0x238/0x6d0 [ 112.377451][ T6776] ? __pfx_bpf_test_finish+0x10/0x10 [ 112.377471][ T6776] ? eth_type_trans+0x35e/0x6d0 [ 112.377508][ T6776] bpf_prog_test_run_skb+0x1150/0x1d50 [ 112.377561][ T6776] ? __fget_files+0x2a/0x420 [ 112.377581][ T6776] ? __fget_files+0x3a0/0x420 [ 112.377599][ T6776] ? __fget_files+0x2a/0x420 [ 112.377626][ T6776] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 112.377662][ T6776] bpf_prog_test_run+0x2c7/0x340 [ 112.377701][ T6776] __sys_bpf+0x562/0x860 [ 112.377731][ T6776] ? __pfx___sys_bpf+0x10/0x10 [ 112.377776][ T6776] ? ksys_write+0x22a/0x250 [ 112.377807][ T6776] ? __pfx_ksys_write+0x10/0x10 [ 112.377843][ T6776] __x64_sys_bpf+0x7c/0x90 [ 112.377868][ T6776] do_syscall_64+0xfa/0xf80 [ 112.377899][ T6776] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.377921][ T6776] ? clear_bhb_loop+0x60/0xb0 [ 112.377948][ T6776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 112.377969][ T6776] RIP: 0033:0x7febf298f749 [ 112.377994][ T6776] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 112.378013][ T6776] RSP: 002b:00007febf3907038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 112.378038][ T6776] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298f749 [ 112.378060][ T6776] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 112.378075][ T6776] RBP: 00007febf3907090 R08: 0000000000000000 R09: 0000000000000000 [ 112.378090][ T6776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 112.378102][ T6776] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 112.378140][ T6776] [ 112.608610][ T6780] tipc: Started in network mode [ 112.614955][ T6780] tipc: Node identity ca3517d057d7, cluster identity 4711 [ 112.622458][ T6780] tipc: Enabled bearer , priority 0 [ 112.629862][ T6781] syzkaller0: entered promiscuous mode [ 112.637189][ T6781] syzkaller0: entered allmulticast mode [ 112.650519][ T6764] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.662459][ T6764] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 112.688038][ T6781] tipc: Resetting bearer [ 112.727959][ T6781] tipc: Disabling bearer [ 112.751311][ T6764] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.762025][ T6764] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 112.980310][ T6803] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 113.024546][ T6803] netlink: 56 bytes leftover after parsing attributes in process `syz.4.241'. [ 113.047825][ T6803] netlink: 'syz.4.241': attribute type 1 has an invalid length. [ 113.084655][ T6803] netlink: 'syz.4.241': attribute type 2 has an invalid length. [ 113.101685][ T6810] syzkaller0: entered promiscuous mode [ 113.103965][ T6803] netlink: 4 bytes leftover after parsing attributes in process `syz.4.241'. [ 113.111830][ T6810] syzkaller0: entered allmulticast mode [ 113.126727][ T6813] FAULT_INJECTION: forcing a failure. [ 113.126727][ T6813] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.150052][ T6813] CPU: 1 UID: 0 PID: 6813 Comm: syz.0.245 Not tainted syzkaller #0 PREEMPT(full) [ 113.150078][ T6813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 113.150090][ T6813] Call Trace: [ 113.150097][ T6813] [ 113.150106][ T6813] dump_stack_lvl+0x189/0x250 [ 113.150133][ T6813] ? __pfx____ratelimit+0x10/0x10 [ 113.150158][ T6813] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.150181][ T6813] ? __pfx__printk+0x10/0x10 [ 113.150222][ T6813] should_fail_ex+0x414/0x560 [ 113.150251][ T6813] _copy_to_user+0x31/0xb0 [ 113.150282][ T6813] bpf_test_finish+0x54b/0x6d0 [ 113.150312][ T6813] ? __pfx_bpf_test_finish+0x10/0x10 [ 113.150331][ T6813] ? eth_type_trans+0x35e/0x6d0 [ 113.150364][ T6813] bpf_prog_test_run_skb+0x1150/0x1d50 [ 113.150412][ T6813] ? __fget_files+0x2a/0x420 [ 113.150429][ T6813] ? __fget_files+0x3a0/0x420 [ 113.150446][ T6813] ? __fget_files+0x2a/0x420 [ 113.150469][ T6813] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 113.150502][ T6813] bpf_prog_test_run+0x2c7/0x340 [ 113.150533][ T6813] __sys_bpf+0x562/0x860 [ 113.150559][ T6813] ? __pfx___sys_bpf+0x10/0x10 [ 113.150601][ T6813] ? ksys_write+0x22a/0x250 [ 113.150629][ T6813] ? __pfx_ksys_write+0x10/0x10 [ 113.150661][ T6813] __x64_sys_bpf+0x7c/0x90 [ 113.150684][ T6813] do_syscall_64+0xfa/0xf80 [ 113.150711][ T6813] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.150731][ T6813] ? clear_bhb_loop+0x60/0xb0 [ 113.150756][ T6813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.150775][ T6813] RIP: 0033:0x7ff69c18f749 [ 113.150792][ T6813] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 113.150809][ T6813] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 113.150830][ T6813] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 113.150844][ T6813] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 113.150857][ T6813] RBP: 00007ff69cf59090 R08: 0000000000000000 R09: 0000000000000000 [ 113.150869][ T6813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 113.150880][ T6813] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 113.150914][ T6813] [ 113.636979][ T6829] xt_nat: multiple ranges no longer supported [ 113.981864][ T6855] FAULT_INJECTION: forcing a failure. [ 113.981864][ T6855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 113.997986][ T6855] CPU: 0 UID: 0 PID: 6855 Comm: syz.4.258 Not tainted syzkaller #0 PREEMPT(full) [ 113.998015][ T6855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 113.998028][ T6855] Call Trace: [ 113.998037][ T6855] [ 113.998045][ T6855] dump_stack_lvl+0x189/0x250 [ 113.998073][ T6855] ? __pfx____ratelimit+0x10/0x10 [ 113.998099][ T6855] ? __pfx_dump_stack_lvl+0x10/0x10 [ 113.998121][ T6855] ? __pfx__printk+0x10/0x10 [ 113.998162][ T6855] should_fail_ex+0x414/0x560 [ 113.998192][ T6855] _copy_to_user+0x31/0xb0 [ 113.998224][ T6855] simple_read_from_buffer+0xe1/0x170 [ 113.998260][ T6855] proc_fail_nth_read+0x1b3/0x220 [ 113.998291][ T6855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 113.998322][ T6855] ? rw_verify_area+0x2a6/0x4d0 [ 113.998345][ T6855] ? __fget_files+0x2a/0x420 [ 113.998361][ T6855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 113.998390][ T6855] vfs_read+0x200/0xa30 [ 113.998414][ T6855] ? fdget_pos+0x247/0x320 [ 113.998437][ T6855] ? __pfx___mutex_lock+0x10/0x10 [ 113.998465][ T6855] ? __pfx_vfs_read+0x10/0x10 [ 113.998492][ T6855] ? __fget_files+0x2a/0x420 [ 113.998515][ T6855] ? __fget_files+0x3a0/0x420 [ 113.998532][ T6855] ? __fget_files+0x2a/0x420 [ 113.998560][ T6855] ksys_read+0x145/0x250 [ 113.998589][ T6855] ? __pfx_ksys_read+0x10/0x10 [ 113.998618][ T6855] ? do_syscall_64+0xbe/0xf80 [ 113.998650][ T6855] do_syscall_64+0xfa/0xf80 [ 113.998677][ T6855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.998697][ T6855] ? clear_bhb_loop+0x60/0xb0 [ 113.998722][ T6855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 113.998742][ T6855] RIP: 0033:0x7febf298e15c [ 113.998760][ T6855] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 113.998776][ T6855] RSP: 002b:00007febf3907030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 113.998797][ T6855] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298e15c [ 113.998812][ T6855] RDX: 000000000000000f RSI: 00007febf39070a0 RDI: 0000000000000004 [ 113.998825][ T6855] RBP: 00007febf3907090 R08: 0000000000000000 R09: 0000000000000000 [ 113.998837][ T6855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 113.998849][ T6855] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 113.998885][ T6855] [ 114.231280][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880589cc800: rx timeout, send abort [ 114.683899][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880589cc000: rx timeout, send abort [ 114.740396][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880589cc800: abort rx timeout. Force session deactivation [ 114.972205][ T6893] netlink: 'syz.0.264': attribute type 1 has an invalid length. [ 114.980887][ T6893] NCSI netlink: No device for ifindex 0 [ 115.000434][ T6893] netlink: 'syz.0.264': attribute type 1 has an invalid length. [ 115.008576][ T6893] NCSI netlink: No device for ifindex 0 [ 115.192217][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880589cc000: abort rx timeout. Force session deactivation [ 115.379676][ T6911] netlink: 'syz.0.267': attribute type 10 has an invalid length. [ 115.446512][ T6911] veth0_vlan: left promiscuous mode [ 115.459618][ T6911] veth0_vlan: entered promiscuous mode [ 115.491323][ T6911] team0: Device veth0_vlan failed to register rx_handler [ 115.602036][ T6916] __nla_validate_parse: 4 callbacks suppressed [ 115.602056][ T6916] netlink: 8 bytes leftover after parsing attributes in process `syz.1.269'. [ 115.728263][ T6921] syzkaller1: entered promiscuous mode [ 115.738464][ T6921] syzkaller1: entered allmulticast mode [ 115.813188][ T61] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 115.831624][ T61] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 115.947727][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 115.967969][ T12] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 116.008856][ T12] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 116.021036][ T12] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 116.066176][ T6942] netlink: 12 bytes leftover after parsing attributes in process `syz.1.278'. [ 116.122629][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 116.131694][ T12] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 116.630848][ T6967] ipvlan2: entered promiscuous mode [ 116.636246][ T6967] ipvlan2: entered allmulticast mode [ 116.641564][ T6967] geneve1: entered allmulticast mode [ 116.648982][ T6974] tipc: MTU too low for tipc bearer [ 116.668699][ T6973] tipc: MTU too low for tipc bearer [ 116.811272][ T6983] netlink: 16 bytes leftover after parsing attributes in process `syz.4.291'. [ 116.850150][ T6983] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.291'. [ 116.927219][ T6991] bridge0: entered promiscuous mode [ 116.932758][ T6991] macsec1: entered promiscuous mode [ 117.224279][ T7012] warning: `syz.0.299' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 117.240764][ T7010] netlink: 24 bytes leftover after parsing attributes in process `syz.1.301'. [ 117.289742][ T7014] batadv_slave_1: entered promiscuous mode [ 117.423267][ T7022] netlink: 8 bytes leftover after parsing attributes in process `syz.3.305'. [ 117.459656][ T7023] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 117.632597][ T7038] netlink: 68 bytes leftover after parsing attributes in process `syz.3.307'. [ 117.643720][ T7034] netlink: 8 bytes leftover after parsing attributes in process `syz.4.308'. [ 117.669694][ T7038] netlink: 8 bytes leftover after parsing attributes in process `syz.3.307'. [ 117.689669][ T7034] netlink: 'syz.4.308': attribute type 1 has an invalid length. [ 117.697661][ T7034] netlink: 224 bytes leftover after parsing attributes in process `syz.4.308'. [ 117.809740][ T7031] geneve2: entered promiscuous mode [ 117.818519][ T7031] geneve2: entered allmulticast mode [ 117.945682][ T6999] batadv_slave_1: left promiscuous mode [ 118.240098][ T7058] team1: entered promiscuous mode [ 118.260983][ T7058] team1: entered allmulticast mode [ 118.271340][ T7058] 8021q: adding VLAN 0 to HW filter on device team1 [ 118.308014][ T7060] team2: entered promiscuous mode [ 118.313077][ T7060] team2: entered allmulticast mode [ 118.318995][ T7060] 8021q: adding VLAN 0 to HW filter on device team2 [ 118.472706][ T7062] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.664107][ T7062] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.727618][ T7029] IPVS: starting estimator thread 0... [ 118.834213][ T7087] IPVS: using max 26 ests per chain, 62400 per kthread [ 120.077823][ T7082] syz.3.324: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x404dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_RETRY_MAYFAIL), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 120.098899][ T7082] CPU: 0 UID: 0 PID: 7082 Comm: syz.3.324 Not tainted syzkaller #0 PREEMPT(full) [ 120.098927][ T7082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 120.098940][ T7082] Call Trace: [ 120.098949][ T7082] [ 120.098958][ T7082] dump_stack_lvl+0x189/0x250 [ 120.098990][ T7082] ? __pfx_dump_stack_lvl+0x10/0x10 [ 120.099015][ T7082] ? __pfx__printk+0x10/0x10 [ 120.099044][ T7082] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 120.099079][ T7082] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 120.099116][ T7082] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 120.099153][ T7082] warn_alloc+0x214/0x310 [ 120.099189][ T7082] ? __pfx_warn_alloc+0x10/0x10 [ 120.099229][ T7082] ? __get_vm_area_node+0x28f/0x300 [ 120.099256][ T7082] ? veth_dev_init+0x368/0x570 [ 120.099288][ T7082] __vmalloc_node_range_noprof+0x690/0x12d0 [ 120.099318][ T7082] ? __alloc_frozen_pages_noprof+0x9f/0x370 [ 120.099386][ T7082] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 120.099415][ T7082] ? veth_dev_init+0x368/0x570 [ 120.099452][ T7082] ? rcu_is_watching+0x15/0xb0 [ 120.099479][ T7082] ? veth_dev_init+0x368/0x570 [ 120.099507][ T7082] __kvmalloc_node_noprof+0x670/0x910 [ 120.099536][ T7082] ? veth_dev_init+0x368/0x570 [ 120.099565][ T7082] ? __pfx_netdev_lock_cmp_fn+0x10/0x10 [ 120.099602][ T7082] veth_dev_init+0x368/0x570 [ 120.099638][ T7082] register_netdevice+0x6b1/0x1a70 [ 120.099674][ T7082] ? snprintf+0xda/0x120 [ 120.099698][ T7082] ? __pfx_register_netdevice+0x10/0x10 [ 120.099721][ T7082] ? __pfx_snprintf+0x10/0x10 [ 120.099743][ T7082] ? __asan_memset+0x22/0x50 [ 120.099768][ T7082] ? dev_addr_mod+0x2ce/0x3d0 [ 120.099795][ T7082] veth_newlink+0x5d4/0xa60 [ 120.099825][ T7082] ? __pfx_veth_newlink+0x10/0x10 [ 120.099855][ T7082] ? __pfx_css_rstat_updated+0x10/0x10 [ 120.099936][ T7082] ? validate_linkmsg+0x765/0x950 [ 120.099963][ T7082] ? __pfx_veth_newlink+0x10/0x10 [ 120.099983][ T7082] rtnl_newlink_create+0x310/0xb00 [ 120.100007][ T7082] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 120.100024][ T7082] ? __pfx___mutex_lock+0x10/0x10 [ 120.100053][ T7082] ? ns_capable+0x8a/0xf0 [ 120.100069][ T7082] rtnl_newlink+0x16e7/0x1c90 [ 120.100103][ T7082] ? __pfx_rtnl_newlink+0x10/0x10 [ 120.100123][ T7082] ? do_syscall_64+0xfa/0xf80 [ 120.100142][ T7082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.100212][ T7082] ? __dev_queue_xmit+0x289/0x3140 [ 120.100228][ T7082] ? __dev_queue_xmit+0x289/0x3140 [ 120.100242][ T7082] ? __dev_queue_xmit+0x289/0x3140 [ 120.100279][ T7082] ? __pfx_rtnl_newlink+0x10/0x10 [ 120.100300][ T7082] rtnetlink_rcv_msg+0x7cf/0xb70 [ 120.100325][ T7082] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 120.100346][ T7082] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 120.100372][ T7082] ? ref_tracker_free+0x63a/0x7d0 [ 120.100391][ T7082] ? __asan_memcpy+0x40/0x70 [ 120.100408][ T7082] ? __pfx_ref_tracker_free+0x10/0x10 [ 120.100425][ T7082] ? __skb_clone+0x63/0x7a0 [ 120.100446][ T7082] netlink_rcv_skb+0x208/0x470 [ 120.100462][ T7082] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 120.100485][ T7082] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 120.100508][ T7082] ? netlink_deliver_tap+0x2e/0x1b0 [ 120.100529][ T7082] netlink_unicast+0x82f/0x9e0 [ 120.100559][ T7082] ? __pfx_netlink_unicast+0x10/0x10 [ 120.100583][ T7082] ? netlink_sendmsg+0x642/0xb30 [ 120.100597][ T7082] ? skb_put+0x11b/0x210 [ 120.100623][ T7082] netlink_sendmsg+0x805/0xb30 [ 120.100645][ T7082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.100663][ T7082] ? aa_sock_msg_perm+0xf1/0x1b0 [ 120.100679][ T7082] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 120.100700][ T7082] ? __pfx_netlink_sendmsg+0x10/0x10 [ 120.100716][ T7082] __sock_sendmsg+0x21c/0x270 [ 120.100736][ T7082] ____sys_sendmsg+0x505/0x820 [ 120.100764][ T7082] ? __pfx_____sys_sendmsg+0x10/0x10 [ 120.100795][ T7082] ? import_iovec+0x74/0xa0 [ 120.100819][ T7082] ___sys_sendmsg+0x21f/0x2a0 [ 120.100845][ T7082] ? __pfx____sys_sendmsg+0x10/0x10 [ 120.100874][ T7082] ? futex_wake+0x4b2/0x560 [ 120.100912][ T7082] ? __fget_files+0x2a/0x420 [ 120.100925][ T7082] ? __fget_files+0x3a0/0x420 [ 120.100946][ T7082] __x64_sys_sendmsg+0x19b/0x260 [ 120.100972][ T7082] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 120.101009][ T7082] ? do_syscall_64+0xbe/0xf80 [ 120.101032][ T7082] do_syscall_64+0xfa/0xf80 [ 120.101052][ T7082] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.101066][ T7082] ? clear_bhb_loop+0x60/0xb0 [ 120.101085][ T7082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.101099][ T7082] RIP: 0033:0x7f0b28f8f749 [ 120.101113][ T7082] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 120.101126][ T7082] RSP: 002b:00007f0b29df8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 120.101142][ T7082] RAX: ffffffffffffffda RBX: 00007f0b291e5fa0 RCX: 00007f0b28f8f749 [ 120.101153][ T7082] RDX: 0000000000008000 RSI: 0000200000000280 RDI: 0000000000000006 [ 120.101163][ T7082] RBP: 00007f0b29013f91 R08: 0000000000000000 R09: 0000000000000000 [ 120.101172][ T7082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.101180][ T7082] R13: 00007f0b291e6038 R14: 00007f0b291e5fa0 R15: 00007fff1293c9c8 [ 120.101205][ T7082] [ 120.101320][ T7082] Mem-Info: [ 120.612116][ T7082] active_anon:4773 inactive_anon:0 isolated_anon:0 [ 120.612116][ T7082] active_file:2884 inactive_file:39891 isolated_file:0 [ 120.612116][ T7082] unevictable:768 dirty:24 writeback:0 [ 120.612116][ T7082] slab_reclaimable:10907 slab_unreclaimable:97497 [ 120.612116][ T7082] mapped:29010 shmem:1357 pagetables:1124 [ 120.612116][ T7082] sec_pagetables:0 bounce:0 [ 120.612116][ T7082] kernel_misc_reclaimable:0 [ 120.612116][ T7082] free:1316795 free_pcp:21677 free_cma:0 [ 120.659111][ T7082] Node 0 active_anon:19092kB inactive_anon:0kB active_file:11536kB inactive_file:159364kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116040kB dirty:96kB writeback:0kB shmem:3892kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12016kB pagetables:4344kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 120.691589][ T7082] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 120.721664][ T7082] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 120.754638][ T7082] lowmem_reserve[]: 0 2504 2504 2504 2504 [ 120.760434][ T7082] Node 0 DMA32 free:1357256kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:19092kB inactive_anon:0kB active_file:11536kB inactive_file:159364kB unevictable:1536kB writepending:96kB zspages:0kB present:3129332kB managed:2564516kB mlocked:0kB bounce:0kB free_pcp:67328kB local_pcp:34152kB free_cma:0kB [ 120.793797][ T7082] lowmem_reserve[]: 0 0 0 0 0 [ 120.798557][ T7082] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 120.828091][ T7082] lowmem_reserve[]: 0 0 0 0 0 [ 120.832865][ T7082] Node 1 Normal free:3894564kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:19392kB local_pcp:10944kB free_cma:0kB [ 120.865235][ T7082] lowmem_reserve[]: 0 0 0 0 0 [ 120.869991][ T7082] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 120.883599][ T7082] Node 0 DMA32: 858*4kB (UME) 755*8kB (UME) 341*16kB (UME) 120*32kB (UME) 147*64kB (UME) 69*128kB (UME) 63*256kB (UME) 19*512kB (UM) 6*1024kB (UME) 5*2048kB (UME) 312*4096kB (M) = 1357200kB [ 120.902625][ T7082] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 120.914642][ T7082] Node 1 Normal: 197*4kB (UE) 54*8kB (UME) 42*16kB (UME) 76*32kB (UME) 23*64kB (UME) 15*128kB (UME) 3*256kB (ME) 2*512kB (M) 2*1024kB (ME) 2*2048kB (UE) 947*4096kB (M) = 3894564kB [ 120.933017][ T7082] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 120.942856][ T7082] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 120.952374][ T7082] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 120.962033][ T7082] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 120.971467][ T7082] 44128 total pagecache pages [ 120.976231][ T7082] 0 pages in swap cache [ 120.980401][ T7082] Free swap = 124996kB [ 120.985075][ T7082] Total swap = 124996kB [ 120.989395][ T7082] 2097051 pages RAM [ 120.993267][ T7082] 0 pages HighMem/MovableOnly [ 120.999318][ T7082] 424280 pages reserved [ 121.003808][ T7082] 0 pages cma reserved [ 122.263926][ T7083] __nla_validate_parse: 7 callbacks suppressed [ 122.263947][ T7083] netlink: 4 bytes leftover after parsing attributes in process `syz.2.323'. [ 122.377877][ T7062] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.469389][ T7113] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 122.537407][ T7062] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.615021][ T7124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.334'. [ 122.644126][ T7124] bridge_slave_1: left allmulticast mode [ 122.656400][ T7124] bridge_slave_1: left promiscuous mode [ 122.683740][ T7124] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.713919][ T7124] bridge_slave_0: left allmulticast mode [ 122.719730][ T7124] bridge_slave_0: left promiscuous mode [ 122.730097][ T7124] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.940665][ T7131] syzkaller0: entered promiscuous mode [ 122.946429][ T7131] syzkaller0: entered allmulticast mode [ 123.065296][ T35] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.091888][ T35] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.168705][ T7144] netlink: 'syz.4.340': attribute type 83 has an invalid length. [ 124.008290][ T7155] netlink: zone id is out of range [ 124.014877][ T7155] netlink: zone id is out of range [ 124.020140][ T7155] netlink: zone id is out of range [ 124.029045][ T7155] netlink: zone id is out of range [ 124.034582][ T7155] netlink: get zone limit has 4 unknown bytes [ 124.504499][ T1100] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.568132][ T1157] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 124.767836][ T7169] netlink: 48 bytes leftover after parsing attributes in process `syz.1.348'. [ 124.877677][ T7167] syzkaller0: entered promiscuous mode [ 124.883209][ T7167] syzkaller0: entered allmulticast mode [ 125.043243][ T7181] xt_hashlimit: invalid rate [ 125.344789][ T7206] sctp: [Deprecated]: syz.4.354 (pid 7206) Use of int in max_burst socket option. [ 125.344789][ T7206] Use struct sctp_assoc_value instead [ 125.368589][ T7206] netlink: 56 bytes leftover after parsing attributes in process `syz.4.354'. [ 125.544914][ T7217] tipc: Can't bind to reserved service type 2 [ 125.568702][ T7187] delete_channel: no stack [ 125.662562][ T7225] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.360'. [ 125.682535][ T7225] ksmbd: Unknown IPC event: 1, ignore. [ 125.938033][ T7240] netlink: 'syz.1.362': attribute type 10 has an invalid length. [ 125.998316][ T7240] team0: Failed to send options change via netlink (err -105) [ 126.023243][ T7240] team0: Port device dummy0 added [ 126.038756][ T7244] netlink: 'syz.1.362': attribute type 10 has an invalid length. [ 126.051414][ T7243] netlink: 'syz.4.365': attribute type 1 has an invalid length. [ 126.061339][ T7244] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 126.117008][ T7244] team0: Failed to send options change via netlink (err -105) [ 126.198075][ T7244] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 126.239201][ T7244] team0: Port device dummy0 removed [ 126.280566][ T7244] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 126.317982][ T7247] netlink: 'syz.2.366': attribute type 3 has an invalid length. [ 126.344755][ T7247] netlink: 'syz.2.366': attribute type 3 has an invalid length. [ 126.509043][ T7255] netlink: 'syz.3.367': attribute type 6 has an invalid length. [ 126.534261][ T7255] netlink: 176 bytes leftover after parsing attributes in process `syz.3.367'. [ 126.869961][ T7263] netlink: 128 bytes leftover after parsing attributes in process `syz.2.370'. [ 126.917151][ T7264] netlink: 40 bytes leftover after parsing attributes in process `syz.4.371'. [ 127.004784][ T7263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.370'. [ 127.758606][ T7284] netlink: 8 bytes leftover after parsing attributes in process `syz.2.378'. [ 127.888025][ T7295] netlink: 'syz.4.381': attribute type 29 has an invalid length. [ 127.896759][ T7295] netlink: 'syz.4.381': attribute type 29 has an invalid length. [ 127.905522][ T7295] netlink: 500 bytes leftover after parsing attributes in process `syz.4.381'. [ 128.683865][ T7300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 128.698210][ T7300] bond0: (slave rose0): Enslaving as an active interface with an up link [ 129.550622][ T7340] tipc: Enabled bearer , priority 0 [ 129.645136][ T7340] netlink: 'syz.1.389': attribute type 5 has an invalid length. [ 129.948209][ T7339] tipc: Disabling bearer [ 129.989765][ T7328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.385'. [ 130.025150][ T7365] syzkaller1: entered promiscuous mode [ 130.042050][ T7328] netlink: 'syz.2.385': attribute type 1 has an invalid length. [ 130.051427][ T7365] syzkaller1: entered allmulticast mode [ 130.218035][ T7375] netlink: 364 bytes leftover after parsing attributes in process `syz.1.394'. [ 130.339663][ T7375] netlink: 364 bytes leftover after parsing attributes in process `syz.1.394'. [ 130.351592][ T7362] netlink: 28 bytes leftover after parsing attributes in process `syz.2.385'. [ 130.367874][ T7362] 8021q: adding VLAN 0 to HW filter on device bond2 [ 132.307601][ T7477] netlink: 76 bytes leftover after parsing attributes in process `syz.2.414'. [ 132.436343][ T7489] netlink: 8 bytes leftover after parsing attributes in process `syz.0.418'. [ 132.607961][ T7501] IPVS: Unknown mcast interface: pim6reg0 [ 132.627353][ T7496] netlink: 'syz.3.419': attribute type 10 has an invalid length. [ 132.692419][ T7503] netlink: 32 bytes leftover after parsing attributes in process `syz.1.421'. [ 132.701989][ T7496] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 133.305157][ T7536] FAULT_INJECTION: forcing a failure. [ 133.305157][ T7536] name failslab, interval 1, probability 0, space 0, times 0 [ 133.348810][ T7536] CPU: 0 UID: 0 PID: 7536 Comm: syz.3.429 Not tainted syzkaller #0 PREEMPT(full) [ 133.348839][ T7536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 133.348851][ T7536] Call Trace: [ 133.348860][ T7536] [ 133.348869][ T7536] dump_stack_lvl+0x189/0x250 [ 133.348896][ T7536] ? __pfx____ratelimit+0x10/0x10 [ 133.348922][ T7536] ? __pfx_dump_stack_lvl+0x10/0x10 [ 133.348945][ T7536] ? __pfx__printk+0x10/0x10 [ 133.348974][ T7536] ? __pfx___might_resched+0x10/0x10 [ 133.348995][ T7536] ? fs_reclaim_acquire+0x7d/0x100 [ 133.349030][ T7536] should_fail_ex+0x414/0x560 [ 133.349059][ T7536] should_failslab+0xa8/0x100 [ 133.349091][ T7536] kmem_cache_alloc_node_noprof+0x77/0x710 [ 133.349117][ T7536] ? __alloc_skb+0x255/0x430 [ 133.349144][ T7536] ? napi_skb_cache_get+0x4a5/0x780 [ 133.349180][ T7536] ? napi_skb_cache_get+0x151/0x780 [ 133.349213][ T7536] __alloc_skb+0x255/0x430 [ 133.349243][ T7536] ? __pfx___alloc_skb+0x10/0x10 [ 133.349277][ T7536] ? netlink_ack_tlv_len+0x6c/0x210 [ 133.349300][ T7536] netlink_ack+0x146/0xa50 [ 133.349326][ T7536] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 133.349361][ T7536] nfnetlink_rcv+0x2309/0x2590 [ 133.349428][ T7536] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 133.349475][ T7536] ? ref_tracker_free+0x63a/0x7d0 [ 133.349531][ T7536] ? __netlink_deliver_tap+0x807/0x850 [ 133.349550][ T7536] ? netlink_deliver_tap+0x2e/0x1b0 [ 133.349589][ T7536] netlink_unicast+0x82f/0x9e0 [ 133.349629][ T7536] ? __pfx_netlink_unicast+0x10/0x10 [ 133.349660][ T7536] ? netlink_sendmsg+0x642/0xb30 [ 133.349678][ T7536] ? skb_put+0x11b/0x210 [ 133.349710][ T7536] netlink_sendmsg+0x805/0xb30 [ 133.349739][ T7536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 133.349763][ T7536] ? aa_sock_msg_perm+0xf1/0x1b0 [ 133.349784][ T7536] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 133.349811][ T7536] ? __pfx_netlink_sendmsg+0x10/0x10 [ 133.349833][ T7536] __sock_sendmsg+0x21c/0x270 [ 133.349859][ T7536] ____sys_sendmsg+0x505/0x820 [ 133.349896][ T7536] ? __pfx_____sys_sendmsg+0x10/0x10 [ 133.349937][ T7536] ? import_iovec+0x74/0xa0 [ 133.349970][ T7536] ___sys_sendmsg+0x21f/0x2a0 [ 133.350004][ T7536] ? __pfx____sys_sendmsg+0x10/0x10 [ 133.350042][ T7536] ? rcu_read_lock_any_held+0xb3/0x120 [ 133.350097][ T7536] ? __fget_files+0x2a/0x420 [ 133.350115][ T7536] ? __fget_files+0x3a0/0x420 [ 133.350145][ T7536] __x64_sys_sendmsg+0x19b/0x260 [ 133.350187][ T7536] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 133.350228][ T7536] ? __pfx_ksys_write+0x10/0x10 [ 133.350257][ T7536] ? do_syscall_64+0xbe/0xf80 [ 133.350285][ T7536] do_syscall_64+0xfa/0xf80 [ 133.350309][ T7536] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.350325][ T7536] ? clear_bhb_loop+0x60/0xb0 [ 133.350348][ T7536] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 133.350366][ T7536] RIP: 0033:0x7f0b28f8f749 [ 133.350385][ T7536] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 133.350401][ T7536] RSP: 002b:00007f0b29df8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 133.350423][ T7536] RAX: ffffffffffffffda RBX: 00007f0b291e5fa0 RCX: 00007f0b28f8f749 [ 133.350437][ T7536] RDX: 0000000020000800 RSI: 00002000000004c0 RDI: 0000000000000003 [ 133.350450][ T7536] RBP: 00007f0b29df8090 R08: 0000000000000000 R09: 0000000000000000 [ 133.350462][ T7536] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 133.350474][ T7536] R13: 00007f0b291e6038 R14: 00007f0b291e5fa0 R15: 00007fff1293c9c8 [ 133.350509][ T7536] [ 133.926552][ T7548] FAULT_INJECTION: forcing a failure. [ 133.926552][ T7548] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 133.954436][ T7545] netlink: 8 bytes leftover after parsing attributes in process `syz.2.432'. [ 134.000061][ T7548] CPU: 1 UID: 0 PID: 7548 Comm: syz.1.433 Not tainted syzkaller #0 PREEMPT(full) [ 134.000091][ T7548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 134.000103][ T7548] Call Trace: [ 134.000112][ T7548] [ 134.000121][ T7548] dump_stack_lvl+0x189/0x250 [ 134.000148][ T7548] ? __pfx____ratelimit+0x10/0x10 [ 134.000174][ T7548] ? __pfx_dump_stack_lvl+0x10/0x10 [ 134.000196][ T7548] ? __pfx__printk+0x10/0x10 [ 134.000225][ T7548] ? __might_fault+0xb0/0x130 [ 134.000262][ T7548] should_fail_ex+0x414/0x560 [ 134.000291][ T7548] _copy_from_user+0x2d/0xb0 [ 134.000321][ T7548] ___sys_sendmsg+0x158/0x2a0 [ 134.000356][ T7548] ? __pfx____sys_sendmsg+0x10/0x10 [ 134.000396][ T7548] ? rcu_read_lock_any_held+0xb3/0x120 [ 134.000452][ T7548] ? __fget_files+0x2a/0x420 [ 134.000477][ T7548] ? __fget_files+0x3a0/0x420 [ 134.000507][ T7548] __x64_sys_sendmsg+0x19b/0x260 [ 134.000542][ T7548] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 134.000585][ T7548] ? __pfx_ksys_write+0x10/0x10 [ 134.000615][ T7548] ? do_syscall_64+0xbe/0xf80 [ 134.000646][ T7548] do_syscall_64+0xfa/0xf80 [ 134.000673][ T7548] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.000693][ T7548] ? clear_bhb_loop+0x60/0xb0 [ 134.000718][ T7548] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.000738][ T7548] RIP: 0033:0x7f76dc38f749 [ 134.000756][ T7548] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 134.000773][ T7548] RSP: 002b:00007f76dd300038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 134.000795][ T7548] RAX: ffffffffffffffda RBX: 00007f76dc5e5fa0 RCX: 00007f76dc38f749 [ 134.000809][ T7548] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 134.000822][ T7548] RBP: 00007f76dd300090 R08: 0000000000000000 R09: 0000000000000000 [ 134.000835][ T7548] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.000846][ T7548] R13: 00007f76dc5e6038 R14: 00007f76dc5e5fa0 R15: 00007ffe450592d8 [ 134.000880][ T7548] [ 134.307798][ T7550] netlink: 12 bytes leftover after parsing attributes in process `syz.1.434'. [ 134.518950][ T7561] netlink: 24 bytes leftover after parsing attributes in process `syz.2.436'. [ 134.582330][ T7566] sctp: [Deprecated]: syz.4.440 (pid 7566) Use of int in maxseg socket option. [ 134.582330][ T7566] Use struct sctp_assoc_value instead [ 134.711463][ T7570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.439'. [ 134.763570][ T7570] netlink: 168 bytes leftover after parsing attributes in process `syz.0.439'. [ 134.799538][ T7570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.439'. [ 134.976988][ T7580] FAULT_INJECTION: forcing a failure. [ 134.976988][ T7580] name failslab, interval 1, probability 0, space 0, times 0 [ 134.989964][ T7580] CPU: 0 UID: 0 PID: 7580 Comm: syz.0.444 Not tainted syzkaller #0 PREEMPT(full) [ 134.989990][ T7580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 134.990002][ T7580] Call Trace: [ 134.990010][ T7580] [ 134.990018][ T7580] dump_stack_lvl+0x189/0x250 [ 134.990044][ T7580] ? __pfx____ratelimit+0x10/0x10 [ 134.990068][ T7580] ? __pfx_dump_stack_lvl+0x10/0x10 [ 134.990090][ T7580] ? __pfx__printk+0x10/0x10 [ 134.990119][ T7580] ? __pfx___might_resched+0x10/0x10 [ 134.990139][ T7580] ? fs_reclaim_acquire+0x7d/0x100 [ 134.990171][ T7580] should_fail_ex+0x414/0x560 [ 134.990199][ T7580] should_failslab+0xa8/0x100 [ 134.990230][ T7580] kmem_cache_alloc_node_noprof+0x77/0x710 [ 134.990255][ T7580] ? __alloc_skb+0x255/0x430 [ 134.990281][ T7580] ? napi_skb_cache_get+0x4a5/0x780 [ 134.990306][ T7580] ? napi_skb_cache_get+0x151/0x780 [ 134.990345][ T7580] __alloc_skb+0x255/0x430 [ 134.990375][ T7580] ? __pfx___alloc_skb+0x10/0x10 [ 134.990404][ T7580] ? netlink_autobind+0xdb/0x300 [ 134.990423][ T7580] ? netlink_autobind+0x2c2/0x300 [ 134.990449][ T7580] netlink_sendmsg+0x5c6/0xb30 [ 134.990479][ T7580] ? __pfx_netlink_sendmsg+0x10/0x10 [ 134.990503][ T7580] ? aa_sock_msg_perm+0xf1/0x1b0 [ 134.990525][ T7580] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 134.990552][ T7580] ? __pfx_netlink_sendmsg+0x10/0x10 [ 134.990573][ T7580] __sock_sendmsg+0x21c/0x270 [ 134.990599][ T7580] ____sys_sendmsg+0x505/0x820 [ 134.990635][ T7580] ? __pfx_____sys_sendmsg+0x10/0x10 [ 134.990675][ T7580] ? import_iovec+0x74/0xa0 [ 134.990706][ T7580] ___sys_sendmsg+0x21f/0x2a0 [ 134.990739][ T7580] ? __pfx____sys_sendmsg+0x10/0x10 [ 134.990776][ T7580] ? rcu_read_lock_any_held+0xb3/0x120 [ 134.990830][ T7580] ? __fget_files+0x2a/0x420 [ 134.990847][ T7580] ? __fget_files+0x3a0/0x420 [ 134.990876][ T7580] __x64_sys_sendmsg+0x19b/0x260 [ 134.990910][ T7580] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 134.990951][ T7580] ? __pfx_ksys_write+0x10/0x10 [ 134.990979][ T7580] ? do_syscall_64+0xbe/0xf80 [ 134.991009][ T7580] do_syscall_64+0xfa/0xf80 [ 134.991036][ T7580] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.991055][ T7580] ? clear_bhb_loop+0x60/0xb0 [ 134.991077][ T7580] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 134.991094][ T7580] RIP: 0033:0x7ff69c18f749 [ 134.991112][ T7580] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 134.991128][ T7580] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 134.991148][ T7580] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 134.991162][ T7580] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 134.991174][ T7580] RBP: 00007ff69cf59090 R08: 0000000000000000 R09: 0000000000000000 [ 134.991184][ T7580] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 134.991195][ T7580] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 134.991229][ T7580] [ 135.595301][ T7591] netlink: 8 bytes leftover after parsing attributes in process `syz.0.446'. [ 135.620479][ T7590] netlink: 12 bytes leftover after parsing attributes in process `syz.3.448'. [ 135.694014][ T7590] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 136.486239][ T7646] netlink: 8 bytes leftover after parsing attributes in process `syz.0.462'. [ 136.598550][ T7652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.465'. [ 136.947421][ T7670] netlink: 'syz.2.472': attribute type 21 has an invalid length. [ 136.996130][ T7670] netlink: 'syz.2.472': attribute type 5 has an invalid length. [ 137.016263][ T7670] netlink: 'syz.2.472': attribute type 6 has an invalid length. [ 137.044782][ T7672] nbd: must specify at least one socket [ 137.611412][ T7711] netlink: 'syz.1.485': attribute type 10 has an invalid length. [ 137.818413][ T7718] bridge_slave_1: left allmulticast mode [ 137.825357][ T7718] bridge_slave_1: left promiscuous mode [ 137.838603][ T7718] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.854124][ T7718] bridge_slave_0: left allmulticast mode [ 137.865969][ T7718] bridge_slave_0: left promiscuous mode [ 137.874370][ T7718] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.044899][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.736778][ T7757] netlink: 'syz.1.496': attribute type 11 has an invalid length. [ 139.114215][ T7779] veth1_macvtap: left promiscuous mode [ 139.119964][ T7779] macsec0: entered allmulticast mode [ 139.141871][ T7779] __nla_validate_parse: 7 callbacks suppressed [ 139.141892][ T7779] netlink: 8 bytes leftover after parsing attributes in process `syz.3.502'. [ 139.198802][ T7783] veth1_macvtap: entered promiscuous mode [ 139.221477][ T7783] veth1_macvtap: entered allmulticast mode [ 139.234471][ T7783] macsec0: left allmulticast mode [ 139.247174][ T7783] veth1_macvtap: left allmulticast mode [ 139.315955][ T7786] : renamed from veth0_vlan (while UP) [ 139.680839][ T7812] IPVS: set_ctl: invalid protocol: 136 0.0.0.0:20000 [ 139.955073][ T7823] netlink: 'syz.1.515': attribute type 1 has an invalid length. [ 140.198898][ T7832] netlink: 12 bytes leftover after parsing attributes in process `syz.2.518'. [ 140.220360][ T7841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.517'. [ 140.256807][ T7843] netlink: 8 bytes leftover after parsing attributes in process `syz.3.521'. [ 140.275115][ T7833] netlink: 24 bytes leftover after parsing attributes in process `syz.0.517'. [ 140.315019][ T7846] Bluetooth: MGMT ver 1.23 [ 140.344950][ T7850] netlink: 8 bytes leftover after parsing attributes in process `syz.2.518'. [ 140.406443][ T7850] bond3: entered promiscuous mode [ 140.412052][ T7850] 8021q: adding VLAN 0 to HW filter on device bond3 [ 140.432459][ T7853] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 140.476076][ T7853] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 140.493350][ T7856] netlink: 4 bytes leftover after parsing attributes in process `syz.3.523'. [ 140.573854][ T7853] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 140.584750][ T7853] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 140.651711][ T7853] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 140.672427][ T7853] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 140.742704][ T7853] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 140.758558][ T7853] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 140.807491][ T7865] netdevsim netdevsim2: Direct firmware load for ..€ failed with error -2 [ 140.816893][ T7865] netdevsim netdevsim2: Falling back to sysfs fallback for: ..€ [ 140.929921][ T3478] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 140.950696][ T3478] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 140.976492][ T3478] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 140.990308][ T3478] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 141.048441][ T3478] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 141.078525][ T3478] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 141.087795][ T7874] xt_CT: You must specify a L4 protocol and not use inversions on it [ 141.147351][ T3478] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 141.168065][ T3478] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 141.176967][ T7871] netlink: 76 bytes leftover after parsing attributes in process `syz.1.528'. [ 141.209808][ T7882] tipc: Started in network mode [ 141.215161][ T7882] tipc: Node identity cee262f8cc0e, cluster identity 4711 [ 141.222427][ T7882] tipc: Enabled bearer , priority 0 [ 141.247898][ T7883] syzkaller0: entered promiscuous mode [ 141.253645][ T7883] syzkaller0: entered allmulticast mode [ 141.276695][ T7882] tipc: Resetting bearer [ 141.296070][ T7881] tipc: Resetting bearer [ 141.321463][ T7881] tipc: Disabling bearer [ 141.602740][ T7890] netlink: 24 bytes leftover after parsing attributes in process `syz.4.533'. [ 141.623861][ T7893] xt_hashlimit: size too large, truncated to 1048576 [ 141.960636][ T7904] tipc: Enabled bearer , priority 0 [ 141.976468][ T7904] syzkaller0: entered promiscuous mode [ 141.989471][ T7904] syzkaller0: entered allmulticast mode [ 142.018034][ T7904] tipc: Resetting bearer [ 142.067158][ T7903] tipc: Resetting bearer [ 142.119031][ T7903] tipc: Disabling bearer [ 142.462441][ T7921] bond2: Unable to set up delay as MII monitoring is disabled [ 142.470217][ T7928] netlink: 44 bytes leftover after parsing attributes in process `syz.0.543'. [ 142.506372][ T7921] bond2 (unregistering): Released all slaves [ 142.937405][ T7955] dvmrp12: entered allmulticast mode [ 142.952667][ T7951] syzkaller0: entered promiscuous mode [ 143.003634][ T7951] syzkaller0: entered allmulticast mode [ 143.422350][ T7985] FAULT_INJECTION: forcing a failure. [ 143.422350][ T7985] name failslab, interval 1, probability 0, space 0, times 0 [ 143.456431][ T7985] CPU: 0 UID: 0 PID: 7985 Comm: syz.4.556 Not tainted syzkaller #0 PREEMPT(full) [ 143.456459][ T7985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 143.456471][ T7985] Call Trace: [ 143.456479][ T7985] [ 143.456487][ T7985] dump_stack_lvl+0x189/0x250 [ 143.456515][ T7985] ? __pfx____ratelimit+0x10/0x10 [ 143.456540][ T7985] ? __pfx_dump_stack_lvl+0x10/0x10 [ 143.456563][ T7985] ? __pfx__printk+0x10/0x10 [ 143.456597][ T7985] ? __pfx___might_resched+0x10/0x10 [ 143.456618][ T7985] ? fs_reclaim_acquire+0x7d/0x100 [ 143.456651][ T7985] should_fail_ex+0x414/0x560 [ 143.456680][ T7985] should_failslab+0xa8/0x100 [ 143.456713][ T7985] __kmalloc_noprof+0xcb/0x800 [ 143.456737][ T7985] ? nla_strdup+0x9d/0x140 [ 143.456764][ T7985] ? __kmalloc_cache_noprof+0x3d5/0x6f0 [ 143.456794][ T7985] nla_strdup+0x9d/0x140 [ 143.456823][ T7985] nf_tables_newtable+0x491/0x1890 [ 143.456871][ T7985] nfnetlink_rcv+0x11d9/0x2590 [ 143.456938][ T7985] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 143.456986][ T7985] ? ref_tracker_free+0x63a/0x7d0 [ 143.457054][ T7985] ? __netlink_deliver_tap+0x807/0x850 [ 143.457074][ T7985] ? netlink_deliver_tap+0x2e/0x1b0 [ 143.457112][ T7985] netlink_unicast+0x82f/0x9e0 [ 143.457151][ T7985] ? __pfx_netlink_unicast+0x10/0x10 [ 143.457182][ T7985] ? netlink_sendmsg+0x642/0xb30 [ 143.457200][ T7985] ? skb_put+0x11b/0x210 [ 143.457231][ T7985] netlink_sendmsg+0x805/0xb30 [ 143.457262][ T7985] ? __pfx_netlink_sendmsg+0x10/0x10 [ 143.457286][ T7985] ? aa_sock_msg_perm+0xf1/0x1b0 [ 143.457307][ T7985] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 143.457333][ T7985] ? __pfx_netlink_sendmsg+0x10/0x10 [ 143.457354][ T7985] __sock_sendmsg+0x21c/0x270 [ 143.457380][ T7985] ____sys_sendmsg+0x505/0x820 [ 143.457423][ T7985] ? __pfx_____sys_sendmsg+0x10/0x10 [ 143.457462][ T7985] ? import_iovec+0x74/0xa0 [ 143.457494][ T7985] ___sys_sendmsg+0x21f/0x2a0 [ 143.457525][ T7985] ? __pfx____sys_sendmsg+0x10/0x10 [ 143.457563][ T7985] ? rcu_read_lock_any_held+0xb3/0x120 [ 143.457617][ T7985] ? __fget_files+0x2a/0x420 [ 143.457634][ T7985] ? __fget_files+0x3a0/0x420 [ 143.457662][ T7985] __x64_sys_sendmsg+0x19b/0x260 [ 143.457694][ T7985] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 143.457734][ T7985] ? __pfx_ksys_write+0x10/0x10 [ 143.457763][ T7985] ? do_syscall_64+0xbe/0xf80 [ 143.457793][ T7985] do_syscall_64+0xfa/0xf80 [ 143.457819][ T7985] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.457838][ T7985] ? clear_bhb_loop+0x60/0xb0 [ 143.457859][ T7985] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 143.457878][ T7985] RIP: 0033:0x7febf298f749 [ 143.457896][ T7985] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 143.457911][ T7985] RSP: 002b:00007febf3907038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 143.457931][ T7985] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298f749 [ 143.457944][ T7985] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 143.457955][ T7985] RBP: 00007febf3907090 R08: 0000000000000000 R09: 0000000000000000 [ 143.457965][ T7985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 143.457975][ T7985] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 143.458007][ T7985] [ 144.322108][ T8018] sctp: [Deprecated]: syz.1.564 (pid 8018) Use of int in max_burst socket option deprecated. [ 144.322108][ T8018] Use struct sctp_assoc_value instead [ 144.359397][ T8024] __nla_validate_parse: 3 callbacks suppressed [ 144.359418][ T8024] netlink: 272 bytes leftover after parsing attributes in process `syz.2.565'. [ 144.657013][ T8040] FAULT_INJECTION: forcing a failure. [ 144.657013][ T8040] name failslab, interval 1, probability 0, space 0, times 0 [ 144.715810][ T8040] CPU: 1 UID: 0 PID: 8040 Comm: syz.1.570 Not tainted syzkaller #0 PREEMPT(full) [ 144.715839][ T8040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 144.715851][ T8040] Call Trace: [ 144.715864][ T8040] [ 144.715873][ T8040] dump_stack_lvl+0x189/0x250 [ 144.715899][ T8040] ? __pfx____ratelimit+0x10/0x10 [ 144.715943][ T8040] ? __pfx_dump_stack_lvl+0x10/0x10 [ 144.715966][ T8040] ? __pfx__printk+0x10/0x10 [ 144.716001][ T8040] ? __pfx___might_resched+0x10/0x10 [ 144.716028][ T8040] should_fail_ex+0x414/0x560 [ 144.716057][ T8040] should_failslab+0xa8/0x100 [ 144.716090][ T8040] __kmalloc_cache_noprof+0x6f/0x6f0 [ 144.716118][ T8040] ? nft_trans_table_add+0x56/0x430 [ 144.716153][ T8040] nft_trans_table_add+0x56/0x430 [ 144.716188][ T8040] nf_tables_newtable+0xce3/0x1890 [ 144.716234][ T8040] nfnetlink_rcv+0x11d9/0x2590 [ 144.716304][ T8040] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 144.716352][ T8040] ? ref_tracker_free+0x63a/0x7d0 [ 144.716409][ T8040] ? __netlink_deliver_tap+0x807/0x850 [ 144.716435][ T8040] ? netlink_deliver_tap+0x2e/0x1b0 [ 144.716475][ T8040] netlink_unicast+0x82f/0x9e0 [ 144.716515][ T8040] ? __pfx_netlink_unicast+0x10/0x10 [ 144.716552][ T8040] ? netlink_sendmsg+0x642/0xb30 [ 144.716570][ T8040] ? skb_put+0x11b/0x210 [ 144.716603][ T8040] netlink_sendmsg+0x805/0xb30 [ 144.716632][ T8040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.716656][ T8040] ? aa_sock_msg_perm+0xf1/0x1b0 [ 144.716679][ T8040] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 144.716706][ T8040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 144.716728][ T8040] __sock_sendmsg+0x21c/0x270 [ 144.716756][ T8040] ____sys_sendmsg+0x505/0x820 [ 144.716794][ T8040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 144.716835][ T8040] ? import_iovec+0x74/0xa0 [ 144.716868][ T8040] ___sys_sendmsg+0x21f/0x2a0 [ 144.716902][ T8040] ? __pfx____sys_sendmsg+0x10/0x10 [ 144.716940][ T8040] ? rcu_read_lock_any_held+0xb3/0x120 [ 144.716996][ T8040] ? __fget_files+0x2a/0x420 [ 144.717014][ T8040] ? __fget_files+0x3a0/0x420 [ 144.717055][ T8040] __x64_sys_sendmsg+0x19b/0x260 [ 144.717088][ T8040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 144.717129][ T8040] ? __pfx_ksys_write+0x10/0x10 [ 144.717158][ T8040] ? do_syscall_64+0xbe/0xf80 [ 144.717186][ T8040] do_syscall_64+0xfa/0xf80 [ 144.717212][ T8040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.717231][ T8040] ? clear_bhb_loop+0x60/0xb0 [ 144.717255][ T8040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.717272][ T8040] RIP: 0033:0x7f76dc38f749 [ 144.717290][ T8040] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 144.717306][ T8040] RSP: 002b:00007f76dd300038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 144.717326][ T8040] RAX: ffffffffffffffda RBX: 00007f76dc5e5fa0 RCX: 00007f76dc38f749 [ 144.717340][ T8040] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 144.717352][ T8040] RBP: 00007f76dd300090 R08: 0000000000000000 R09: 0000000000000000 [ 144.717363][ T8040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.717375][ T8040] R13: 00007f76dc5e6038 R14: 00007f76dc5e5fa0 R15: 00007ffe450592d8 [ 144.717407][ T8040] [ 144.734168][ T8043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.573'. [ 144.841093][ T8045] vlan2: entered promiscuous mode [ 145.083381][ T8045] vlan2: entered allmulticast mode [ 145.088624][ T8045] hsr_slave_1: entered allmulticast mode [ 145.167645][ T8048] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.259320][ T8055] netlink: 64 bytes leftover after parsing attributes in process `syz.0.576'. [ 145.499403][ T8048] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.607836][ T8048] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.647295][ T8079] ip6gre1: entered promiscuous mode [ 145.652588][ T8079] ip6gre1: entered allmulticast mode [ 145.679342][ T8081] syzkaller0: entered promiscuous mode [ 145.685313][ T8081] syzkaller0: entered allmulticast mode [ 145.717823][ T8048] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 145.801463][ T8086] Bluetooth: MGMT ver 1.23 [ 145.997024][ T3478] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.123640][ T3478] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.151372][ T3478] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.188229][ T8107] netlink: 28 bytes leftover after parsing attributes in process `syz.2.588'. [ 146.232010][ T3478] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 146.368161][ T8121] tipc: Started in network mode [ 146.373107][ T8121] tipc: Node identity 0000000000000000005885d6a76549cc, cluster identity 4711 [ 146.405783][ T8121] tipc: Enabling of bearer rejected, failed to enable media [ 146.888829][ T8157] netlink: 12 bytes leftover after parsing attributes in process `syz.0.602'. [ 147.000996][ T8162] netlink: 12 bytes leftover after parsing attributes in process `syz.0.602'. [ 147.218917][ T8172] Cannot find set identified by id 0 to match [ 147.260414][ T8173] batadv1: entered promiscuous mode [ 147.386275][ T8178] 8021q: adding VLAN 0 to HW filter on device bond2 [ 147.453708][ T8183] netlink: 32 bytes leftover after parsing attributes in process `syz.1.607'. [ 148.161609][ T8213] tipc: Enabled bearer , priority 0 [ 148.180278][ T8213] syzkaller0: entered promiscuous mode [ 148.194197][ T8213] syzkaller0: entered allmulticast mode [ 148.221693][ T8216] syz.2.619 (8216) used obsolete PPPIOCDETACH ioctl [ 148.263040][ T8216] bridge2: the hash_elasticity option has been deprecated and is always 16 [ 148.311687][ T8216] bridge2: entered allmulticast mode [ 148.487839][ T8210] tipc: Resetting bearer [ 148.538361][ T8210] tipc: Disabling bearer [ 148.595801][ T8225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.621'. [ 148.874577][ T8238] netlink: 336 bytes leftover after parsing attributes in process `syz.0.626'. [ 148.893473][ T8238] netlink: 4 bytes leftover after parsing attributes in process `syz.0.626'. [ 148.936593][ T8240] openvswitch: netlink: Flow key attr not present in new flow. [ 149.704574][ T8274] tipc: Cannot configure node identity twice [ 150.576048][ T8300] FAULT_INJECTION: forcing a failure. [ 150.576048][ T8300] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 150.604393][ T8300] CPU: 1 UID: 0 PID: 8300 Comm: syz.4.641 Not tainted syzkaller #0 PREEMPT(full) [ 150.604423][ T8300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 150.604436][ T8300] Call Trace: [ 150.604444][ T8300] [ 150.604453][ T8300] dump_stack_lvl+0x189/0x250 [ 150.604480][ T8300] ? __pfx____ratelimit+0x10/0x10 [ 150.604505][ T8300] ? __pfx_dump_stack_lvl+0x10/0x10 [ 150.604527][ T8300] ? __pfx__printk+0x10/0x10 [ 150.604555][ T8300] ? __might_fault+0xb0/0x130 [ 150.604592][ T8300] should_fail_ex+0x414/0x560 [ 150.604622][ T8300] _copy_from_user+0x2d/0xb0 [ 150.604653][ T8300] __sys_bpf+0x1e3/0x860 [ 150.604681][ T8300] ? __pfx___sys_bpf+0x10/0x10 [ 150.604731][ T8300] ? ksys_write+0x22a/0x250 [ 150.604760][ T8300] ? __pfx_ksys_write+0x10/0x10 [ 150.604793][ T8300] __x64_sys_bpf+0x7c/0x90 [ 150.604816][ T8300] do_syscall_64+0xfa/0xf80 [ 150.604844][ T8300] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.604864][ T8300] ? clear_bhb_loop+0x60/0xb0 [ 150.604889][ T8300] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 150.604909][ T8300] RIP: 0033:0x7febf298f749 [ 150.604927][ T8300] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 150.604944][ T8300] RSP: 002b:00007febf3907038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 150.604965][ T8300] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298f749 [ 150.604980][ T8300] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 150.604993][ T8300] RBP: 00007febf3907090 R08: 0000000000000000 R09: 0000000000000000 [ 150.605005][ T8300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 150.605017][ T8300] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 150.605051][ T8300] [ 151.079834][ T8312] can: request_module (can-proto-0) failed. [ 151.251412][ T8329] netlink: 20 bytes leftover after parsing attributes in process `syz.4.648'. [ 151.595904][ T8342] netlink: 4 bytes leftover after parsing attributes in process `syz.4.650'. [ 151.607362][ T8342] netlink: 12 bytes leftover after parsing attributes in process `syz.4.650'. [ 151.632667][ T8342] netlink: 28 bytes leftover after parsing attributes in process `syz.4.650'. [ 151.661586][ T8342] bridge0: port 1(veth0_to_bond) entered blocking state [ 151.669430][ T8342] bridge0: port 1(veth0_to_bond) entered disabled state [ 151.679911][ T8344] netlink: 12 bytes leftover after parsing attributes in process `syz.1.651'. [ 151.680123][ T8342] veth0_to_bond: entered allmulticast mode [ 151.698805][ T8345] netlink: 28 bytes leftover after parsing attributes in process `syz.4.650'. [ 151.700994][ T8342] veth0_to_bond: entered promiscuous mode [ 151.717409][ T8344] netlink: 'syz.1.651': attribute type 2 has an invalid length. [ 151.735331][ T8344] netlink: 'syz.1.651': attribute type 1 has an invalid length. [ 151.840016][ T8349] Bluetooth: MGMT ver 1.23 [ 151.852058][ T8349] netlink: 12 bytes leftover after parsing attributes in process `syz.4.652'. [ 151.867434][ T8349] tipc: Enabled bearer , priority 10 [ 151.874778][ T8349] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 151.913146][ T8352] FAULT_INJECTION: forcing a failure. [ 151.913146][ T8352] name failslab, interval 1, probability 0, space 0, times 0 [ 151.945019][ T8352] CPU: 1 UID: 0 PID: 8352 Comm: syz.1.654 Not tainted syzkaller #0 PREEMPT(full) [ 151.945046][ T8352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 151.945059][ T8352] Call Trace: [ 151.945067][ T8352] [ 151.945075][ T8352] dump_stack_lvl+0x189/0x250 [ 151.945100][ T8352] ? __pfx____ratelimit+0x10/0x10 [ 151.945120][ T8352] ? __pfx_dump_stack_lvl+0x10/0x10 [ 151.945137][ T8352] ? __pfx__printk+0x10/0x10 [ 151.945162][ T8352] ? __pfx___might_resched+0x10/0x10 [ 151.945177][ T8352] ? fs_reclaim_acquire+0x7d/0x100 [ 151.945203][ T8352] should_fail_ex+0x414/0x560 [ 151.945224][ T8352] should_failslab+0xa8/0x100 [ 151.945249][ T8352] __kmalloc_noprof+0xcb/0x800 [ 151.945268][ T8352] ? bpf_test_init+0x9f/0x150 [ 151.945286][ T8352] bpf_test_init+0x9f/0x150 [ 151.945304][ T8352] bpf_prog_test_run_skb+0x376/0x1d50 [ 151.945334][ T8352] ? __fget_files+0x2a/0x420 [ 151.945350][ T8352] ? __fget_files+0x2a/0x420 [ 151.945362][ T8352] ? __fget_files+0x3a0/0x420 [ 151.945375][ T8352] ? __fget_files+0x2a/0x420 [ 151.945392][ T8352] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 151.945417][ T8352] bpf_prog_test_run+0x2c7/0x340 [ 151.945440][ T8352] __sys_bpf+0x562/0x860 [ 151.945461][ T8352] ? __pfx___sys_bpf+0x10/0x10 [ 151.945491][ T8352] ? ksys_write+0x22a/0x250 [ 151.945512][ T8352] ? __pfx_ksys_write+0x10/0x10 [ 151.945536][ T8352] __x64_sys_bpf+0x7c/0x90 [ 151.945553][ T8352] do_syscall_64+0xfa/0xf80 [ 151.945576][ T8352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.945591][ T8352] ? clear_bhb_loop+0x60/0xb0 [ 151.945609][ T8352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.945624][ T8352] RIP: 0033:0x7f76dc38f749 [ 151.945638][ T8352] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 151.945650][ T8352] RSP: 002b:00007f76dd300038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 151.945667][ T8352] RAX: ffffffffffffffda RBX: 00007f76dc5e5fa0 RCX: 00007f76dc38f749 [ 151.945678][ T8352] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 000000000000000a [ 151.945688][ T8352] RBP: 00007f76dd300090 R08: 0000000000000000 R09: 0000000000000000 [ 151.945697][ T8352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 151.945706][ T8352] R13: 00007f76dc5e6038 R14: 00007f76dc5e5fa0 R15: 00007ffe450592d8 [ 151.945730][ T8352] [ 152.368321][ T8367] netlink: 8 bytes leftover after parsing attributes in process `syz.3.659'. [ 152.387639][ T8357] IPVS: set_ctl: invalid protocol: 4 172.20.20.27:20004 [ 152.427719][ T8369] sctp: [Deprecated]: syz.0.656 (pid 8369) Use of struct sctp_assoc_value in delayed_ack socket option. [ 152.427719][ T8369] Use struct sctp_sack_info instead [ 152.498800][ T8370] sctp: [Deprecated]: syz.0.656 (pid 8370) Use of struct sctp_assoc_value in delayed_ack socket option. [ 152.498800][ T8370] Use struct sctp_sack_info instead [ 152.573963][ T8374] netlink: 96 bytes leftover after parsing attributes in process `syz.3.660'. [ 152.636209][ T8376] netlink: 'syz.4.661': attribute type 1 has an invalid length. [ 152.690520][ T8382] IPVS: set_ctl: invalid protocol: 11612 1.4.1.1:0 [ 152.711215][ T8376] 8021q: adding VLAN 0 to HW filter on device bond3 [ 152.712922][ T8374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.660'. [ 152.800003][ T8376] netlink: 'syz.4.661': attribute type 1 has an invalid length. [ 153.091973][ T10] tipc: Node number set to 49046264 [ 153.147271][ T8393] tipc: Started in network mode [ 153.152194][ T8393] tipc: Node identity bef6b23ae9fd, cluster identity 4711 [ 153.160965][ T8393] tipc: Enabled bearer , priority 0 [ 153.169792][ T8393] syzkaller0: entered promiscuous mode [ 153.194014][ T8393] syzkaller0: entered allmulticast mode [ 153.237308][ T8392] tipc: Resetting bearer [ 153.279301][ T8392] tipc: Disabling bearer [ 153.457478][ T8402] netlink: 'syz.2.669': attribute type 1 has an invalid length. [ 153.639897][ T8413] IPVS: set_ctl: invalid protocol: 255 100.1.1.2:20000 [ 153.652579][ T8402] 8021q: adding VLAN 0 to HW filter on device bond4 [ 154.029042][ T8419] ip6gretap1: entered promiscuous mode [ 154.051148][ T8419] ip6gretap1: entered allmulticast mode [ 154.601386][ T8452] Cannot find set identified by id 0 to match [ 154.617889][ T8453] xt_connbytes: Forcing CT accounting to be enabled [ 154.885701][ T8469] netlink: 'syz.3.682': attribute type 1 has an invalid length. [ 155.100030][ T8478] netlink: 'syz.4.687': attribute type 1 has an invalid length. [ 155.164406][ T8478] 8021q: adding VLAN 0 to HW filter on device bond4 [ 155.251866][ T8482] macvlan2: entered promiscuous mode [ 155.284056][ T8482] macvlan2: entered allmulticast mode [ 155.290772][ T8482] bond4: entered promiscuous mode [ 155.312734][ T8482] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 155.343863][ T8491] x_tables: duplicate underflow at hook 1 [ 155.375077][ T8482] bond4: left promiscuous mode [ 155.983990][ T8504] syzkaller0: entered promiscuous mode [ 155.997152][ T8504] syzkaller0: entered allmulticast mode [ 156.258020][ T8524] __nla_validate_parse: 6 callbacks suppressed [ 156.258039][ T8524] netlink: 4 bytes leftover after parsing attributes in process `syz.4.697'. [ 156.286587][ T8523] netlink: 'syz.3.700': attribute type 15 has an invalid length. [ 156.365158][ T8532] netlink: 8 bytes leftover after parsing attributes in process `syz.0.701'. [ 157.290739][ T8531] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 157.448158][ T8548] IPVS: set_ctl: invalid protocol: 60 127.0.0.1:20003 [ 157.889982][ T8575] netlink: 60 bytes leftover after parsing attributes in process `syz.0.712'. [ 157.899971][ T8578] netlink: 60 bytes leftover after parsing attributes in process `syz.0.712'. [ 160.752156][ T8580] syzkaller0: entered promiscuous mode [ 160.777490][ T8580] syzkaller0: entered allmulticast mode [ 160.800077][ T8587] netlink: 'syz.2.716': attribute type 6 has an invalid length. [ 160.860177][ T8593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.717'. [ 161.987605][ T8603] veth0: entered promiscuous mode [ 162.106277][ T8603] veth0: left promiscuous mode [ 162.296441][ T8622] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.319056][ T8628] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 162.327299][ T8628] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 162.358714][ T8624] : entered promiscuous mode [ 162.494363][ T8622] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.619009][ T8643] netlink: 8 bytes leftover after parsing attributes in process `syz.3.732'. [ 162.686380][ T8622] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.856145][ T8622] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.051012][ T8665] openvswitch: netlink: Actions may not be safe on all matching packets [ 163.065355][ T8665] netlink: 12 bytes leftover after parsing attributes in process `syz.0.739'. [ 163.082084][ T8665] openvswitch: netlink: Actions may not be safe on all matching packets [ 163.105886][ T8667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.739'. [ 163.246660][ T7455] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.295938][ T7455] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.338521][ T4545] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.365109][ T4545] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.492211][ T8679] FAULT_INJECTION: forcing a failure. [ 163.492211][ T8679] name failslab, interval 1, probability 0, space 0, times 0 [ 163.519116][ T8681] FAULT_INJECTION: forcing a failure. [ 163.519116][ T8681] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 163.532485][ T8679] CPU: 1 UID: 0 PID: 8679 Comm: syz.4.742 Not tainted syzkaller #0 PREEMPT(full) [ 163.532513][ T8679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 163.532526][ T8679] Call Trace: [ 163.532534][ T8679] [ 163.532542][ T8679] dump_stack_lvl+0x189/0x250 [ 163.532569][ T8679] ? __pfx____ratelimit+0x10/0x10 [ 163.532591][ T8679] ? __pfx_dump_stack_lvl+0x10/0x10 [ 163.532613][ T8679] ? __pfx__printk+0x10/0x10 [ 163.532647][ T8679] ? __pfx___might_resched+0x10/0x10 [ 163.532674][ T8679] should_fail_ex+0x414/0x560 [ 163.532702][ T8679] should_failslab+0xa8/0x100 [ 163.532734][ T8679] __kmalloc_cache_noprof+0x6f/0x6f0 [ 163.532762][ T8679] ? sctp_sched_prio_set+0x400/0x9d0 [ 163.532794][ T8679] sctp_sched_prio_set+0x400/0x9d0 [ 163.532850][ T8679] sctp_stream_init_ext+0xd8/0x180 [ 163.532885][ T8679] sctp_sendmsg_to_asoc+0x12f8/0x1810 [ 163.532910][ T8679] ? __asan_memcpy+0x40/0x70 [ 163.532941][ T8679] ? sctp_assoc_add_peer+0xce8/0x1390 [ 163.532993][ T8679] ? sctp_connect_new_asoc+0x3f0/0x690 [ 163.533037][ T8679] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 163.533063][ T8679] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 163.533091][ T8679] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 163.533118][ T8679] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 163.533143][ T8679] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 163.533170][ T8679] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 163.533200][ T8679] ? security_sctp_bind_connect+0x7e/0x2e0 [ 163.533230][ T8679] sctp_sendmsg+0x1941/0x2810 [ 163.533270][ T8679] ? __pfx_sctp_sendmsg+0x10/0x10 [ 163.533293][ T8679] ? aa_sk_perm+0x15f/0x920 [ 163.533327][ T8679] ? aa_sk_perm+0x7ee/0x920 [ 163.533363][ T8679] ? __pfx_aa_sk_perm+0x10/0x10 [ 163.533398][ T8679] ? sock_rps_record_flow+0x19/0x410 [ 163.533426][ T8679] ? inet_sendmsg+0x2f4/0x370 [ 163.533446][ T8679] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 163.533483][ T8679] __sock_sendmsg+0x19c/0x270 [ 163.533511][ T8679] __sys_sendto+0x3bd/0x520 [ 163.533543][ T8679] ? __pfx___sys_sendto+0x10/0x10 [ 163.533569][ T8679] ? __mutex_unlock_slowpath+0x1a1/0x730 [ 163.533611][ T8679] ? __fget_files+0x3a0/0x420 [ 163.533642][ T8679] ? ksys_write+0x22a/0x250 [ 163.533670][ T8679] ? __pfx_ksys_write+0x10/0x10 [ 163.533700][ T8679] __x64_sys_sendto+0xde/0x100 [ 163.533732][ T8679] do_syscall_64+0xfa/0xf80 [ 163.533761][ T8679] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.533779][ T8679] ? clear_bhb_loop+0x60/0xb0 [ 163.533805][ T8679] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.533830][ T8679] RIP: 0033:0x7febf298f749 [ 163.533848][ T8679] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 163.533865][ T8679] RSP: 002b:00007febf3907038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 163.533887][ T8679] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298f749 [ 163.533908][ T8679] RDX: 0000000000000001 RSI: 0000200000000100 RDI: 0000000000000003 [ 163.533919][ T8679] RBP: 00007febf3907090 R08: 00002000000000c0 R09: 0000000000000010 [ 163.533942][ T8679] R10: 000000002000c8d4 R11: 0000000000000246 R12: 0000000000000002 [ 163.533955][ T8679] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 163.534003][ T8679] [ 163.723297][ T8687] FAULT_INJECTION: forcing a failure. [ 163.723297][ T8687] name failslab, interval 1, probability 0, space 0, times 0 [ 163.759381][ T8681] CPU: 0 UID: 0 PID: 8681 Comm: syz.2.744 Not tainted syzkaller #0 PREEMPT(full) [ 163.759411][ T8681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 163.759426][ T8681] Call Trace: [ 163.759435][ T8681] [ 163.759445][ T8681] dump_stack_lvl+0x189/0x250 [ 163.759475][ T8681] ? __pfx____ratelimit+0x10/0x10 [ 163.759505][ T8681] ? __pfx_dump_stack_lvl+0x10/0x10 [ 163.759529][ T8681] ? __pfx__printk+0x10/0x10 [ 163.759560][ T8681] ? __might_fault+0xb0/0x130 [ 163.759599][ T8681] should_fail_ex+0x414/0x560 [ 163.759632][ T8681] _copy_from_user+0x2d/0xb0 [ 163.759666][ T8681] kvmemdup_bpfptr_noprof+0x86/0xf0 [ 163.759700][ T8681] map_update_elem+0x453/0x6a0 [ 163.759740][ T8681] __sys_bpf+0x619/0x860 [ 163.759770][ T8681] ? __pfx___sys_bpf+0x10/0x10 [ 163.759827][ T8681] ? ksys_write+0x22a/0x250 [ 163.759868][ T8681] ? __pfx_ksys_write+0x10/0x10 [ 163.759902][ T8681] __x64_sys_bpf+0x7c/0x90 [ 163.759927][ T8681] do_syscall_64+0xfa/0xf80 [ 163.759959][ T8681] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.759981][ T8681] ? clear_bhb_loop+0x60/0xb0 [ 163.760009][ T8681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.760031][ T8681] RIP: 0033:0x7fcc9898f749 [ 163.760051][ T8681] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 163.760069][ T8681] RSP: 002b:00007fcc99779038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 163.760094][ T8681] RAX: ffffffffffffffda RBX: 00007fcc98be5fa0 RCX: 00007fcc9898f749 [ 163.760109][ T8681] RDX: 0000000000000020 RSI: 00002000000048c0 RDI: 0000000000000002 [ 163.760124][ T8681] RBP: 00007fcc99779090 R08: 0000000000000000 R09: 0000000000000000 [ 163.760137][ T8681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 163.760150][ T8681] R13: 00007fcc98be6038 R14: 00007fcc98be5fa0 R15: 00007ffc51823dc8 [ 163.760187][ T8681] [ 164.103662][ T8687] CPU: 1 UID: 0 PID: 8687 Comm: syz.1.747 Not tainted syzkaller #0 PREEMPT(full) [ 164.103689][ T8687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 164.103701][ T8687] Call Trace: [ 164.103709][ T8687] [ 164.103753][ T8687] dump_stack_lvl+0x189/0x250 [ 164.103780][ T8687] ? __pfx____ratelimit+0x10/0x10 [ 164.103806][ T8687] ? __pfx_dump_stack_lvl+0x10/0x10 [ 164.103827][ T8687] ? __pfx__printk+0x10/0x10 [ 164.103857][ T8687] ? __pfx___might_resched+0x10/0x10 [ 164.103877][ T8687] ? fs_reclaim_acquire+0x7d/0x100 [ 164.103911][ T8687] should_fail_ex+0x414/0x560 [ 164.103940][ T8687] should_failslab+0xa8/0x100 [ 164.103970][ T8687] __kvmalloc_node_noprof+0x158/0x910 [ 164.103994][ T8687] ? __nf_register_net_hook+0x232/0x930 [ 164.104015][ T8687] ? nf_hook_entries_grow+0x281/0x720 [ 164.104042][ T8687] nf_hook_entries_grow+0x281/0x720 [ 164.104079][ T8687] __nf_register_net_hook+0x2c9/0x930 [ 164.104111][ T8687] nf_register_net_hook+0xb2/0x190 [ 164.104133][ T8687] nf_register_net_hooks+0x44/0x1b0 [ 164.104158][ T8687] nf_ct_netns_do_get+0x3bf/0x5a0 [ 164.104180][ T8687] ? __pfx_nf_ct_tcp_fixup+0x10/0x10 [ 164.104206][ T8687] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 164.104227][ T8687] ? nf_ct_netns_do_get+0x4da/0x5a0 [ 164.104253][ T8687] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 164.104287][ T8687] nf_ct_netns_inet_get+0x1f/0x150 [ 164.104314][ T8687] nf_ct_netns_get+0x5b/0xb0 [ 164.104336][ T8687] nft_connlimit_do_init+0x1de/0x2e0 [ 164.104364][ T8687] nft_set_elem_expr_alloc+0x1db/0x590 [ 164.104400][ T8687] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 164.104451][ T8687] ? kasan_quarantine_put+0xdd/0x220 [ 164.104486][ T8687] nft_set_expr_alloc+0x397/0x760 [ 164.104513][ T8687] nf_tables_newset+0x1c4c/0x2540 [ 164.104562][ T8687] ? __pfx_nf_tables_newset+0x10/0x10 [ 164.104612][ T8687] ? __nla_parse+0x40/0x60 [ 164.104644][ T8687] nfnetlink_rcv+0x11d9/0x2590 [ 164.104714][ T8687] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 164.104762][ T8687] ? ref_tracker_free+0x63a/0x7d0 [ 164.104820][ T8687] ? __netlink_deliver_tap+0x807/0x850 [ 164.104841][ T8687] ? netlink_deliver_tap+0x2e/0x1b0 [ 164.104880][ T8687] netlink_unicast+0x82f/0x9e0 [ 164.104920][ T8687] ? __pfx_netlink_unicast+0x10/0x10 [ 164.104951][ T8687] ? netlink_sendmsg+0x642/0xb30 [ 164.104969][ T8687] ? skb_put+0x11b/0x210 [ 164.105003][ T8687] netlink_sendmsg+0x805/0xb30 [ 164.105035][ T8687] ? __pfx_netlink_sendmsg+0x10/0x10 [ 164.105060][ T8687] ? aa_sock_msg_perm+0xf1/0x1b0 [ 164.105082][ T8687] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 164.105109][ T8687] ? __pfx_netlink_sendmsg+0x10/0x10 [ 164.105131][ T8687] __sock_sendmsg+0x21c/0x270 [ 164.105159][ T8687] ____sys_sendmsg+0x505/0x820 [ 164.105196][ T8687] ? __pfx_____sys_sendmsg+0x10/0x10 [ 164.105238][ T8687] ? import_iovec+0x74/0xa0 [ 164.105271][ T8687] ___sys_sendmsg+0x21f/0x2a0 [ 164.105302][ T8687] ? __pfx____sys_sendmsg+0x10/0x10 [ 164.105341][ T8687] ? rcu_read_lock_any_held+0xb3/0x120 [ 164.105397][ T8687] ? __fget_files+0x2a/0x420 [ 164.105414][ T8687] ? __fget_files+0x3a0/0x420 [ 164.105444][ T8687] __x64_sys_sendmsg+0x19b/0x260 [ 164.105479][ T8687] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 164.105523][ T8687] ? __pfx_ksys_write+0x10/0x10 [ 164.105563][ T8687] ? do_syscall_64+0xbe/0xf80 [ 164.105593][ T8687] do_syscall_64+0xfa/0xf80 [ 164.105620][ T8687] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.105640][ T8687] ? clear_bhb_loop+0x60/0xb0 [ 164.105664][ T8687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.105683][ T8687] RIP: 0033:0x7f76dc38f749 [ 164.105701][ T8687] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 164.105717][ T8687] RSP: 002b:00007f76dd300038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 164.105738][ T8687] RAX: ffffffffffffffda RBX: 00007f76dc5e5fa0 RCX: 00007f76dc38f749 [ 164.105753][ T8687] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 164.105765][ T8687] RBP: 00007f76dd300090 R08: 0000000000000000 R09: 0000000000000000 [ 164.105778][ T8687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 164.105789][ T8687] R13: 00007f76dc5e6038 R14: 00007f76dc5e5fa0 R15: 00007ffe450592d8 [ 164.105823][ T8687] [ 164.819944][ T8714] netlink: 348 bytes leftover after parsing attributes in process `syz.4.753'. [ 165.021050][ T8728] x_tables: duplicate underflow at hook 1 [ 165.251476][ T8742] FAULT_INJECTION: forcing a failure. [ 165.251476][ T8742] name failslab, interval 1, probability 0, space 0, times 0 [ 165.300579][ T8742] CPU: 0 UID: 0 PID: 8742 Comm: syz.4.760 Not tainted syzkaller #0 PREEMPT(full) [ 165.300608][ T8742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 165.300621][ T8742] Call Trace: [ 165.300629][ T8742] [ 165.300637][ T8742] dump_stack_lvl+0x189/0x250 [ 165.300665][ T8742] ? __pfx____ratelimit+0x10/0x10 [ 165.300692][ T8742] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.300714][ T8742] ? __pfx__printk+0x10/0x10 [ 165.300745][ T8742] ? __pfx___might_resched+0x10/0x10 [ 165.300767][ T8742] ? fs_reclaim_acquire+0x7d/0x100 [ 165.300801][ T8742] should_fail_ex+0x414/0x560 [ 165.300830][ T8742] should_failslab+0xa8/0x100 [ 165.300863][ T8742] __kvmalloc_node_noprof+0x158/0x910 [ 165.300889][ T8742] ? __nf_register_net_hook+0x232/0x930 [ 165.300913][ T8742] ? nf_hook_entries_grow+0x281/0x720 [ 165.300943][ T8742] nf_hook_entries_grow+0x281/0x720 [ 165.300981][ T8742] __nf_register_net_hook+0x2c9/0x930 [ 165.301015][ T8742] nf_register_net_hook+0xb2/0x190 [ 165.301040][ T8742] nf_register_net_hooks+0x44/0x1b0 [ 165.301066][ T8742] nf_ct_netns_do_get+0x3bf/0x5a0 [ 165.301089][ T8742] ? nf_ct_iterate_cleanup_net+0x9f/0xd0 [ 165.301119][ T8742] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 165.301139][ T8742] ? nf_ct_netns_do_get+0x4da/0x5a0 [ 165.301166][ T8742] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 165.301200][ T8742] nf_ct_netns_inet_get+0x1f/0x150 [ 165.301227][ T8742] nf_ct_netns_get+0x5b/0xb0 [ 165.301250][ T8742] nft_connlimit_do_init+0x1de/0x2e0 [ 165.301278][ T8742] nft_set_elem_expr_alloc+0x1db/0x590 [ 165.301314][ T8742] ? __pfx_nft_set_elem_expr_alloc+0x10/0x10 [ 165.301367][ T8742] ? kasan_quarantine_put+0xdd/0x220 [ 165.301413][ T8742] nft_set_expr_alloc+0x397/0x760 [ 165.301441][ T8742] nf_tables_newset+0x1c4c/0x2540 [ 165.301483][ T8742] ? __pfx_nf_tables_newset+0x10/0x10 [ 165.301535][ T8742] ? __nla_parse+0x40/0x60 [ 165.301571][ T8742] nfnetlink_rcv+0x11d9/0x2590 [ 165.301641][ T8742] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 165.301728][ T8742] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 165.301760][ T8742] ? netlink_deliver_tap+0x2e/0x1b0 [ 165.301800][ T8742] netlink_unicast+0x82f/0x9e0 [ 165.301839][ T8742] ? __pfx_netlink_unicast+0x10/0x10 [ 165.301872][ T8742] ? netlink_sendmsg+0x642/0xb30 [ 165.301890][ T8742] ? skb_put+0x11b/0x210 [ 165.301922][ T8742] netlink_sendmsg+0x805/0xb30 [ 165.301953][ T8742] ? __pfx_netlink_sendmsg+0x10/0x10 [ 165.301978][ T8742] ? aa_sock_msg_perm+0xf1/0x1b0 [ 165.302001][ T8742] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 165.302029][ T8742] ? __pfx_netlink_sendmsg+0x10/0x10 [ 165.302049][ T8742] __sock_sendmsg+0x21c/0x270 [ 165.302077][ T8742] ____sys_sendmsg+0x505/0x820 [ 165.302115][ T8742] ? __pfx_____sys_sendmsg+0x10/0x10 [ 165.302156][ T8742] ? import_iovec+0x74/0xa0 [ 165.302190][ T8742] ___sys_sendmsg+0x21f/0x2a0 [ 165.302223][ T8742] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.302259][ T8742] ? rcu_read_lock_any_held+0xb3/0x120 [ 165.302314][ T8742] ? __fget_files+0x2a/0x420 [ 165.302333][ T8742] ? __fget_files+0x3a0/0x420 [ 165.302363][ T8742] __x64_sys_sendmsg+0x19b/0x260 [ 165.302408][ T8742] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 165.302450][ T8742] ? __pfx_ksys_write+0x10/0x10 [ 165.302481][ T8742] ? do_syscall_64+0xbe/0xf80 [ 165.302512][ T8742] do_syscall_64+0xfa/0xf80 [ 165.302540][ T8742] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.302561][ T8742] ? clear_bhb_loop+0x60/0xb0 [ 165.302585][ T8742] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.302605][ T8742] RIP: 0033:0x7febf298f749 [ 165.302623][ T8742] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.302640][ T8742] RSP: 002b:00007febf3907038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 165.302662][ T8742] RAX: ffffffffffffffda RBX: 00007febf2be5fa0 RCX: 00007febf298f749 [ 165.302676][ T8742] RDX: 0000000020050800 RSI: 00002000000000c0 RDI: 0000000000000003 [ 165.302689][ T8742] RBP: 00007febf3907090 R08: 0000000000000000 R09: 0000000000000000 [ 165.302701][ T8742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 165.302713][ T8742] R13: 00007febf2be6038 R14: 00007febf2be5fa0 R15: 00007ffebc91e378 [ 165.302748][ T8742] [ 165.909980][ T8752] netlink: 'syz.0.762': attribute type 11 has an invalid length. [ 165.934326][ T8752] netlink: 'syz.0.762': attribute type 4 has an invalid length. [ 165.942027][ T8752] netlink: 199768 bytes leftover after parsing attributes in process `syz.0.762'. [ 165.953895][ T8754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.763'. [ 166.013322][ T8754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.763'. [ 166.047088][ T8754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.763'. [ 166.061524][ T8762] netlink: 4 bytes leftover after parsing attributes in process `syz.4.764'. [ 166.095212][ T8754] netlink: 8 bytes leftover after parsing attributes in process `syz.2.763'. [ 166.388234][ T8773] bond2: (slave veth3): Enslaving as an active interface with a down link [ 166.425394][ T8773] bond2: (slave ip6gretap2): making interface the new active one [ 166.434797][ T8773] bond2: (slave ip6gretap2): Enslaving as an active interface with an up link [ 166.615036][ T8790] tipc: Invalid UDP bearer configuration [ 166.615091][ T8790] tipc: Enabling of bearer rejected, failed to enable media [ 166.639919][ T8790] tipc: Invalid UDP bearer configuration [ 166.639971][ T8790] tipc: Enabling of bearer rejected, failed to enable media [ 166.832822][ T8806] tipc: Enabling of bearer rejected, failed to enable media [ 166.977579][ T8816] netlink: 'syz.1.782': attribute type 6 has an invalid length. [ 166.989326][ T8816] netlink: 'syz.1.782': attribute type 6 has an invalid length. [ 167.140936][ T8821] unsupported nla_type 29115 [ 167.351991][ T8829] netlink: 'syz.4.787': attribute type 1 has an invalid length. [ 167.711838][ T8839] syzkaller0: entered promiscuous mode [ 167.719749][ T8839] syzkaller0: entered allmulticast mode [ 167.780729][ T8841] __nla_validate_parse: 33 callbacks suppressed [ 167.780749][ T8841] netlink: 28 bytes leftover after parsing attributes in process `syz.2.790'. [ 167.828329][ T8855] IPv6: Can't replace route, no match found [ 168.424880][ T8875] netlink: 'syz.3.801': attribute type 1 has an invalid length. [ 168.440238][ T8877] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 169.942640][ T8898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.805'. [ 170.025504][ T8914] netlink: 16 bytes leftover after parsing attributes in process `syz.4.808'. [ 170.098578][ T8915] FAULT_INJECTION: forcing a failure. [ 170.098578][ T8915] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 170.112640][ T8915] CPU: 1 UID: 0 PID: 8915 Comm: syz.0.810 Not tainted syzkaller #0 PREEMPT(full) [ 170.112667][ T8915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 170.112680][ T8915] Call Trace: [ 170.112688][ T8915] [ 170.112696][ T8915] dump_stack_lvl+0x189/0x250 [ 170.112722][ T8915] ? __pfx____ratelimit+0x10/0x10 [ 170.112748][ T8915] ? __pfx_dump_stack_lvl+0x10/0x10 [ 170.112770][ T8915] ? __pfx__printk+0x10/0x10 [ 170.112798][ T8915] ? __might_fault+0xb0/0x130 [ 170.112834][ T8915] should_fail_ex+0x414/0x560 [ 170.112863][ T8915] _copy_from_iter+0x1cd/0x1630 [ 170.112893][ T8915] ? __build_skb_around+0x22d/0x3c0 [ 170.112927][ T8915] ? __pfx__copy_from_iter+0x10/0x10 [ 170.112950][ T8915] ? __alloc_skb+0x2f1/0x430 [ 170.112988][ T8915] ? __pfx___alloc_skb+0x10/0x10 [ 170.113019][ T8915] ? netlink_sendmsg+0x642/0xb30 [ 170.113038][ T8915] ? skb_put+0x11b/0x210 [ 170.113070][ T8915] netlink_sendmsg+0x6b2/0xb30 [ 170.113101][ T8915] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.113125][ T8915] ? aa_sock_msg_perm+0xf1/0x1b0 [ 170.113151][ T8915] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 170.113179][ T8915] ? __pfx_netlink_sendmsg+0x10/0x10 [ 170.113199][ T8915] __sock_sendmsg+0x21c/0x270 [ 170.113226][ T8915] ____sys_sendmsg+0x505/0x820 [ 170.113264][ T8915] ? __pfx_____sys_sendmsg+0x10/0x10 [ 170.113305][ T8915] ? import_iovec+0x74/0xa0 [ 170.113337][ T8915] ___sys_sendmsg+0x21f/0x2a0 [ 170.113371][ T8915] ? __pfx____sys_sendmsg+0x10/0x10 [ 170.113408][ T8915] ? rcu_read_lock_any_held+0xb3/0x120 [ 170.113461][ T8915] ? __fget_files+0x2a/0x420 [ 170.113479][ T8915] ? __fget_files+0x3a0/0x420 [ 170.113508][ T8915] __x64_sys_sendmsg+0x19b/0x260 [ 170.113542][ T8915] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 170.113583][ T8915] ? __pfx_ksys_write+0x10/0x10 [ 170.113613][ T8915] ? do_syscall_64+0xbe/0xf80 [ 170.113643][ T8915] do_syscall_64+0xfa/0xf80 [ 170.113670][ T8915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.113690][ T8915] ? clear_bhb_loop+0x60/0xb0 [ 170.113714][ T8915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.113733][ T8915] RIP: 0033:0x7ff69c18f749 [ 170.113753][ T8915] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 170.113769][ T8915] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 170.113790][ T8915] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 170.113804][ T8915] RDX: 00000000240000a0 RSI: 0000200000001200 RDI: 0000000000000007 [ 170.113816][ T8915] RBP: 00007ff69cf59090 R08: 0000000000000000 R09: 0000000000000000 [ 170.113828][ T8915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 170.113839][ T8915] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 170.113872][ T8915] [ 170.547980][ T8925] tipc: Enabled bearer , priority 0 [ 170.572861][ T8925] syzkaller0: entered promiscuous mode [ 170.593764][ T8925] syzkaller0: entered allmulticast mode [ 170.636673][ T8925] tipc: Resetting bearer [ 170.663708][ T8924] tipc: Resetting bearer [ 170.706550][ T8924] tipc: Disabling bearer [ 170.893847][ T8936] netlink: 'syz.2.816': attribute type 1 has an invalid length. [ 171.039332][ T8936] bond5: entered promiscuous mode [ 171.046528][ T8936] bond5: entered allmulticast mode [ 171.052223][ T8936] 8021q: adding VLAN 0 to HW filter on device bond5 [ 171.075209][ T8941] macvlan2: entered promiscuous mode [ 171.080798][ T8941] macvlan2: entered allmulticast mode [ 171.094453][ T8941] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 171.290007][ T8960] syzkaller0: entered promiscuous mode [ 171.304687][ T8960] syzkaller0: entered allmulticast mode [ 171.386721][ T8964] netlink: 12 bytes leftover after parsing attributes in process `syz.3.821'. [ 171.432186][ T8968] tipc: Enabling of bearer rejected, failed to enable media [ 171.603599][ T8978] netlink: 'syz.4.826': attribute type 10 has an invalid length. [ 171.628686][ T8978] team0: Device veth0_macvtap failed to register rx_handler [ 171.749904][ T8982] netlink: 'syz.0.828': attribute type 4 has an invalid length. [ 171.942860][ T5974] IPVS: starting estimator thread 0... [ 171.978709][ T8994] netlink: 'syz.3.833': attribute type 1 has an invalid length. [ 172.004265][ T8998] tipc: Enabled bearer , priority 0 [ 172.022665][ T8998] syzkaller0: entered promiscuous mode [ 172.031274][ T8998] syzkaller0: entered allmulticast mode [ 172.053521][ T8996] IPVS: using max 29 ests per chain, 69600 per kthread [ 172.458315][ T8997] tipc: Resetting bearer [ 172.542175][ T8997] tipc: Disabling bearer [ 172.672130][ T9022] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 172.713041][ T9027] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 172.720535][ T9028] netlink: 'syz.2.840': attribute type 4 has an invalid length. [ 172.782013][ T9031] netlink: 12 bytes leftover after parsing attributes in process `syz.1.841'. [ 172.836791][ T9033] netlink: 8 bytes leftover after parsing attributes in process `syz.3.842'. [ 172.852265][ T9031] netlink: 56 bytes leftover after parsing attributes in process `syz.1.841'. [ 172.868207][ T9033] netlink: 24 bytes leftover after parsing attributes in process `syz.3.842'. [ 172.885484][ T9033] netlink: 8 bytes leftover after parsing attributes in process `syz.3.842'. [ 172.894854][ T9033] netlink: 24 bytes leftover after parsing attributes in process `syz.3.842'. [ 172.912405][ T9035] netlink: 28 bytes leftover after parsing attributes in process `syz.0.843'. [ 172.925090][ T9037] delete_channel: no stack [ 172.928835][ T9035] netlink: 36 bytes leftover after parsing attributes in process `syz.0.843'. [ 172.953789][ T9037] delete_channel: no stack [ 173.015939][ T9031] bond3 (unregistering): Released all slaves [ 173.049640][ T9043] netlink: 4 bytes leftover after parsing attributes in process `syz.3.845'. [ 173.108848][ T9047] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 173.332031][ T9055] netlink: 'syz.2.848': attribute type 13 has an invalid length. [ 173.340258][ T9055] netlink: 'syz.2.848': attribute type 17 has an invalid length. [ 173.378394][ T9060] netlink: 'syz.0.851': attribute type 13 has an invalid length. [ 173.447807][ T9065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.848'. [ 173.491033][ T9065] netlink: 20 bytes leftover after parsing attributes in process `syz.2.848'. [ 174.025483][ T9060] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 174.040892][ T9060] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 174.404796][ T3422] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.415434][ T3422] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.489770][ T3422] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.535894][ T3422] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.564336][ T3422] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.573242][ T3422] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.616511][ T3422] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 174.638570][ T3422] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.693316][ T9106] netlink: 'syz.0.856': attribute type 1 has an invalid length. [ 174.704254][ T9106] FAULT_INJECTION: forcing a failure. [ 174.704254][ T9106] name failslab, interval 1, probability 0, space 0, times 0 [ 174.720219][ T9106] CPU: 0 UID: 0 PID: 9106 Comm: syz.0.856 Not tainted syzkaller #0 PREEMPT(full) [ 174.720246][ T9106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 174.720258][ T9106] Call Trace: [ 174.720266][ T9106] [ 174.720274][ T9106] dump_stack_lvl+0x189/0x250 [ 174.720300][ T9106] ? __pfx____ratelimit+0x10/0x10 [ 174.720325][ T9106] ? __pfx_dump_stack_lvl+0x10/0x10 [ 174.720347][ T9106] ? __pfx__printk+0x10/0x10 [ 174.720376][ T9106] ? __pfx___might_resched+0x10/0x10 [ 174.720397][ T9106] ? fs_reclaim_acquire+0x7d/0x100 [ 174.720430][ T9106] should_fail_ex+0x414/0x560 [ 174.720459][ T9106] should_failslab+0xa8/0x100 [ 174.720490][ T9106] __kmalloc_cache_noprof+0x6f/0x6f0 [ 174.720516][ T9106] ? qfq_change_class+0x9ea/0xea0 [ 174.720551][ T9106] qfq_change_class+0x9ea/0xea0 [ 174.720598][ T9106] ? __pfx_qfq_change_class+0x10/0x10 [ 174.720631][ T9106] ? lockdep_rtnl_is_held+0x26/0x40 [ 174.720651][ T9106] ? qdisc_lookup+0x179/0x6d0 [ 174.720675][ T9106] tc_ctl_tclass+0xaa0/0x1500 [ 174.720712][ T9106] ? is_bpf_text_address+0x292/0x2b0 [ 174.720739][ T9106] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 174.720761][ T9106] ? rcu_is_watching+0x15/0xb0 [ 174.720785][ T9106] ? trace_contention_end+0x39/0x100 [ 174.720810][ T9106] ? __mutex_lock+0x335/0x1350 [ 174.720839][ T9106] ? arch_stack_walk+0xfc/0x150 [ 174.720899][ T9106] ? __pfx_tc_ctl_tclass+0x10/0x10 [ 174.720923][ T9106] rtnetlink_rcv_msg+0x77c/0xb70 [ 174.720956][ T9106] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 174.720984][ T9106] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 174.721011][ T9106] ? __lock_acquire+0x6b6/0x2cf0 [ 174.721047][ T9106] netlink_rcv_skb+0x208/0x470 [ 174.721068][ T9106] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 174.721099][ T9106] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 174.721131][ T9106] ? netlink_deliver_tap+0x2e/0x1b0 [ 174.721160][ T9106] netlink_unicast+0x82f/0x9e0 [ 174.721200][ T9106] ? __pfx_netlink_unicast+0x10/0x10 [ 174.721231][ T9106] ? netlink_sendmsg+0x642/0xb30 [ 174.721249][ T9106] ? skb_put+0x11b/0x210 [ 174.721281][ T9106] netlink_sendmsg+0x805/0xb30 [ 174.721312][ T9106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 174.721337][ T9106] ? aa_sock_msg_perm+0xf1/0x1b0 [ 174.721359][ T9106] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 174.721386][ T9106] ? __pfx_netlink_sendmsg+0x10/0x10 [ 174.721407][ T9106] __sock_sendmsg+0x21c/0x270 [ 174.721435][ T9106] ____sys_sendmsg+0x505/0x820 [ 174.721472][ T9106] ? __pfx_____sys_sendmsg+0x10/0x10 [ 174.721513][ T9106] ? import_iovec+0x74/0xa0 [ 174.721544][ T9106] ___sys_sendmsg+0x21f/0x2a0 [ 174.721584][ T9106] ? __pfx____sys_sendmsg+0x10/0x10 [ 174.721623][ T9106] ? rcu_read_lock_any_held+0xb3/0x120 [ 174.721678][ T9106] ? __fget_files+0x2a/0x420 [ 174.721695][ T9106] ? __fget_files+0x3a0/0x420 [ 174.721724][ T9106] __x64_sys_sendmsg+0x19b/0x260 [ 174.721759][ T9106] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 174.721801][ T9106] ? __pfx_ksys_write+0x10/0x10 [ 174.721831][ T9106] ? do_syscall_64+0xbe/0xf80 [ 174.721861][ T9106] do_syscall_64+0xfa/0xf80 [ 174.721888][ T9106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.721909][ T9106] ? clear_bhb_loop+0x60/0xb0 [ 174.721933][ T9106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.721952][ T9106] RIP: 0033:0x7ff69c18f749 [ 174.721971][ T9106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 174.721988][ T9106] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 174.722009][ T9106] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 174.722023][ T9106] RDX: 00000000240000a0 RSI: 0000200000001200 RDI: 0000000000000007 [ 174.722036][ T9106] RBP: 00007ff69cf59090 R08: 0000000000000000 R09: 0000000000000000 [ 174.722049][ T9106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 174.722060][ T9106] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 174.722112][ T9106] [ 175.162391][ T9112] x_tables: duplicate underflow at hook 1 [ 175.170705][ T9112] No such timeout policy "syz1" [ 175.478482][ T9125] IPVS: Scheduler module ip_vs_sip not found [ 175.663141][ T9138] tipc: Enabled bearer , priority 0 [ 175.686997][ T9138] syzkaller0: entered promiscuous mode [ 175.692531][ T9138] syzkaller0: entered allmulticast mode [ 175.973215][ T9137] tipc: Resetting bearer [ 176.025182][ T9137] tipc: Disabling bearer [ 176.211509][ T30] audit: type=1107 audit(1765239193.388:3): pid=9159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 176.682858][ T9208] team0: entered promiscuous mode [ 176.697216][ T9208] team_slave_0: entered promiscuous mode [ 176.708169][ T9208] team_slave_1: entered promiscuous mode [ 176.726916][ T9208] bond0: entered promiscuous mode [ 176.731996][ T9208] bond_slave_0: entered promiscuous mode [ 176.756357][ T9208] bond_slave_1: entered promiscuous mode [ 176.776693][ T9208] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 176.901234][ T9224] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 177.042368][ T9223] 8021q: VLANs not supported on ip6gre0 [ 177.103596][ T9237] sctp: [Deprecated]: syz.2.891 (pid 9237) Use of struct sctp_assoc_value in delayed_ack socket option. [ 177.103596][ T9237] Use struct sctp_sack_info instead [ 177.121589][ T9237] sctp: [Deprecated]: syz.2.891 (pid 9237) Use of struct sctp_assoc_value in delayed_ack socket option. [ 177.121589][ T9237] Use struct sctp_sack_info instead [ 177.151327][ T9237] syz_tun: entered promiscuous mode [ 177.301811][ T9245] ================================================================== [ 177.309921][ T9245] BUG: KASAN: slab-use-after-free in qfq_reset_qdisc+0xf9/0x240 [ 177.317591][ T9245] Read of size 8 at addr ffff8880563ef750 by task syz.0.894/9245 [ 177.325312][ T9245] [ 177.327649][ T9245] CPU: 1 UID: 0 PID: 9245 Comm: syz.0.894 Not tainted syzkaller #0 PREEMPT(full) [ 177.327669][ T9245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 177.327680][ T9245] Call Trace: [ 177.327688][ T9245] [ 177.327694][ T9245] dump_stack_lvl+0x189/0x250 [ 177.327713][ T9245] ? __virt_addr_valid+0x1c8/0x5c0 [ 177.327732][ T9245] ? rcu_is_watching+0x15/0xb0 [ 177.327749][ T9245] ? __kasan_check_byte+0x12/0x40 [ 177.327770][ T9245] ? __pfx_dump_stack_lvl+0x10/0x10 [ 177.327786][ T9245] ? rcu_is_watching+0x15/0xb0 [ 177.327812][ T9245] ? lock_release+0x4b/0x3b0 [ 177.327834][ T9245] ? __virt_addr_valid+0x1c8/0x5c0 [ 177.327860][ T9245] ? __virt_addr_valid+0x4a5/0x5c0 [ 177.327888][ T9245] print_report+0xca/0x240 [ 177.327908][ T9245] ? qfq_reset_qdisc+0xf9/0x240 [ 177.327929][ T9245] kasan_report+0x118/0x150 [ 177.327951][ T9245] ? qfq_reset_qdisc+0xf9/0x240 [ 177.327975][ T9245] qfq_reset_qdisc+0xf9/0x240 [ 177.327997][ T9245] ? __pfx_qfq_reset_qdisc+0x10/0x10 [ 177.328018][ T9245] qdisc_reset+0xff/0x560 [ 177.328042][ T9245] __qdisc_destroy+0x120/0x400 [ 177.328065][ T9245] qdisc_graft+0x111f/0x1590 [ 177.328083][ T9245] ? qdisc_alloc+0x6a4/0x900 [ 177.328110][ T9245] ? __pfx_qdisc_graft+0x10/0x10 [ 177.328131][ T9245] ? qdisc_create+0xa52/0xea0 [ 177.328152][ T9245] tc_modify_qdisc+0x16d3/0x2020 [ 177.328177][ T9245] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 177.328208][ T9245] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 177.328225][ T9245] rtnetlink_rcv_msg+0x77c/0xb70 [ 177.328250][ T9245] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 177.328280][ T9245] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 177.328309][ T9245] ? __lock_acquire+0x6b6/0x2cf0 [ 177.328343][ T9245] netlink_rcv_skb+0x208/0x470 [ 177.328358][ T9245] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 177.328380][ T9245] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 177.328399][ T9245] ? netlink_deliver_tap+0x2e/0x1b0 [ 177.328416][ T9245] netlink_unicast+0x82f/0x9e0 [ 177.328441][ T9245] ? __pfx_netlink_unicast+0x10/0x10 [ 177.328465][ T9245] ? netlink_sendmsg+0x642/0xb30 [ 177.328479][ T9245] ? skb_put+0x11b/0x210 [ 177.328501][ T9245] netlink_sendmsg+0x805/0xb30 [ 177.328519][ T9245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 177.328535][ T9245] ? aa_sock_msg_perm+0xf1/0x1b0 [ 177.328551][ T9245] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 177.328571][ T9245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 177.328587][ T9245] __sock_sendmsg+0x21c/0x270 [ 177.328606][ T9245] ____sys_sendmsg+0x505/0x820 [ 177.328631][ T9245] ? __pfx_____sys_sendmsg+0x10/0x10 [ 177.328657][ T9245] ? import_iovec+0x74/0xa0 [ 177.328679][ T9245] ___sys_sendmsg+0x21f/0x2a0 [ 177.328703][ T9245] ? __pfx____sys_sendmsg+0x10/0x10 [ 177.328728][ T9245] ? futex_wake+0x4b2/0x560 [ 177.328757][ T9245] ? __fget_files+0x2a/0x420 [ 177.328769][ T9245] ? __fget_files+0x3a0/0x420 [ 177.328786][ T9245] __x64_sys_sendmsg+0x19b/0x260 [ 177.328810][ T9245] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 177.328840][ T9245] ? do_syscall_64+0xbe/0xf80 [ 177.328862][ T9245] do_syscall_64+0xfa/0xf80 [ 177.328882][ T9245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.328897][ T9245] ? clear_bhb_loop+0x60/0xb0 [ 177.328921][ T9245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.328943][ T9245] RIP: 0033:0x7ff69c18f749 [ 177.328962][ T9245] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 177.328981][ T9245] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 177.329005][ T9245] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 177.329022][ T9245] RDX: 0000000020008850 RSI: 00002000000012c0 RDI: 0000000000000004 [ 177.329031][ T9245] RBP: 00007ff69c213f91 R08: 0000000000000000 R09: 0000000000000000 [ 177.329041][ T9245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 177.329050][ T9245] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 177.329069][ T9245] [ 177.329074][ T9245] [ 177.712929][ T9245] Allocated by task 8915: [ 177.717268][ T9245] kasan_save_track+0x3e/0x80 [ 177.721964][ T9245] __kasan_kmalloc+0x93/0xb0 [ 177.726563][ T9245] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 177.731946][ T9245] qfq_change_class+0x5c4/0xea0 [ 177.736808][ T9245] tc_ctl_tclass+0xaa0/0x1500 [ 177.741513][ T9245] rtnetlink_rcv_msg+0x77c/0xb70 [ 177.746463][ T9245] netlink_rcv_skb+0x208/0x470 [ 177.751240][ T9245] netlink_unicast+0x82f/0x9e0 [ 177.756018][ T9245] netlink_sendmsg+0x805/0xb30 [ 177.760787][ T9245] __sock_sendmsg+0x21c/0x270 [ 177.765496][ T9245] ____sys_sendmsg+0x505/0x820 [ 177.770274][ T9245] ___sys_sendmsg+0x21f/0x2a0 [ 177.774959][ T9245] __x64_sys_sendmsg+0x19b/0x260 [ 177.779908][ T9245] do_syscall_64+0xfa/0xf80 [ 177.784425][ T9245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.790320][ T9245] [ 177.792648][ T9245] Freed by task 9106: [ 177.796624][ T9245] kasan_save_track+0x3e/0x80 [ 177.801311][ T9245] __kasan_save_free_info+0x46/0x50 [ 177.806513][ T9245] __kasan_slab_free+0x5c/0x80 [ 177.811450][ T9245] kfree+0x1c0/0x660 [ 177.815397][ T9245] qfq_change_class+0xb0c/0xea0 [ 177.820293][ T9245] tc_ctl_tclass+0xaa0/0x1500 [ 177.824982][ T9245] rtnetlink_rcv_msg+0x77c/0xb70 [ 177.829940][ T9245] netlink_rcv_skb+0x208/0x470 [ 177.834709][ T9245] netlink_unicast+0x82f/0x9e0 [ 177.839490][ T9245] netlink_sendmsg+0x805/0xb30 [ 177.844271][ T9245] __sock_sendmsg+0x21c/0x270 [ 177.848964][ T9245] ____sys_sendmsg+0x505/0x820 [ 177.853747][ T9245] ___sys_sendmsg+0x21f/0x2a0 [ 177.858443][ T9245] __x64_sys_sendmsg+0x19b/0x260 [ 177.863400][ T9245] do_syscall_64+0xfa/0xf80 [ 177.867924][ T9245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 177.873825][ T9245] [ 177.876157][ T9245] The buggy address belongs to the object at ffff8880563ef700 [ 177.876157][ T9245] which belongs to the cache kmalloc-128 of size 128 [ 177.890212][ T9245] The buggy address is located 80 bytes inside of [ 177.890212][ T9245] freed 128-byte region [ffff8880563ef700, ffff8880563ef780) [ 177.903929][ T9245] [ 177.906258][ T9245] The buggy address belongs to the physical page: [ 177.912688][ T9245] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x563ef [ 177.921456][ T9245] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 177.929001][ T9245] page_type: f5(slab) [ 177.932989][ T9245] raw: 00fff00000000000 ffff88801a026a00 0000000000000000 dead000000000001 [ 177.941582][ T9245] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 177.950175][ T9245] page dumped because: kasan: bad access detected [ 177.956602][ T9245] page_owner tracks the page as allocated [ 177.962315][ T9245] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 7533, tgid 7530 (syz.4.428), ts 134009789394, free_ts 128825570112 [ 177.981769][ T9245] post_alloc_hook+0x234/0x290 [ 177.986566][ T9245] get_page_from_freelist+0x2365/0x2440 [ 177.992127][ T9245] __alloc_frozen_pages_noprof+0x181/0x370 [ 177.997945][ T9245] allocate_slab+0x7a/0x3b0 [ 178.002470][ T9245] ___slab_alloc+0xf2b/0x1960 [ 178.007157][ T9245] __slab_alloc+0x65/0x100 [ 178.011590][ T9245] __kmalloc_node_noprof+0x5d0/0x810 [ 178.016885][ T9245] alloc_slab_obj_exts+0x3e/0x100 [ 178.021917][ T9245] allocate_slab+0x1cc/0x3b0 [ 178.026514][ T9245] ___slab_alloc+0xf2b/0x1960 [ 178.031204][ T9245] __slab_alloc+0x65/0x100 [ 178.035630][ T9245] __kmalloc_cache_noprof+0x411/0x6f0 [ 178.041010][ T9245] push_stack+0x80/0x3a0 [ 178.045283][ T9245] check_cond_jmp_op+0x1840/0x2e20 [ 178.050442][ T9245] do_check+0x58f5/0xeba0 [ 178.054805][ T9245] do_check_common+0x19cc/0x25b0 [ 178.059770][ T9245] page last free pid 7316 tgid 7315 stack trace: [ 178.066107][ T9245] __free_frozen_pages+0xbc4/0xd30 [ 178.071231][ T9245] __put_partials+0x146/0x170 [ 178.075915][ T9245] put_cpu_partial+0x1f2/0x2d0 [ 178.080686][ T9245] __slab_free+0x288/0x2a0 [ 178.085114][ T9245] qlist_free_all+0x97/0x100 [ 178.089712][ T9245] kasan_quarantine_reduce+0x148/0x160 [ 178.095180][ T9245] __kasan_slab_alloc+0x22/0x80 [ 178.100041][ T9245] __kmalloc_cache_noprof+0x36f/0x6f0 [ 178.105423][ T9245] bpf_int_jit_compile+0x1e8/0x14b0 [ 178.110632][ T9245] bpf_prog_select_runtime+0x4a3/0x820 [ 178.116104][ T9245] bpf_prog_load+0x13e9/0x1a10 [ 178.120872][ T9245] __sys_bpf+0x507/0x860 [ 178.125122][ T9245] __x64_sys_bpf+0x7c/0x90 [ 178.129558][ T9245] do_syscall_64+0xfa/0xf80 [ 178.134079][ T9245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.139995][ T9245] [ 178.142334][ T9245] Memory state around the buggy address: [ 178.148061][ T9245] ffff8880563ef600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 178.156131][ T9245] ffff8880563ef680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 178.164228][ T9245] >ffff8880563ef700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 178.172286][ T9245] ^ [ 178.178957][ T9245] ffff8880563ef780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 178.187049][ T9245] ffff8880563ef800: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc [ 178.195112][ T9245] ================================================================== [ 178.253605][ T9245] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 178.260871][ T9245] CPU: 0 UID: 0 PID: 9245 Comm: syz.0.894 Not tainted syzkaller #0 PREEMPT(full) [ 178.270094][ T9245] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 178.280250][ T9245] Call Trace: [ 178.283542][ T9245] [ 178.286501][ T9245] dump_stack_lvl+0x99/0x250 [ 178.291106][ T9245] ? __asan_memcpy+0x40/0x70 [ 178.295726][ T9245] ? __pfx_dump_stack_lvl+0x10/0x10 [ 178.300945][ T9245] ? __pfx__printk+0x10/0x10 [ 178.305550][ T9245] vpanic+0x237/0x6d0 [ 178.309540][ T9245] ? __pfx_vpanic+0x10/0x10 [ 178.314048][ T9245] ? preempt_schedule_common+0x83/0xd0 [ 178.319519][ T9245] ? preempt_schedule+0xae/0xc0 [ 178.324386][ T9245] panic+0xb9/0xc0 [ 178.328118][ T9245] ? __pfx_panic+0x10/0x10 [ 178.332542][ T9245] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 178.338880][ T9245] ? qfq_reset_qdisc+0xf9/0x240 [ 178.343744][ T9245] check_panic_on_warn+0x89/0xb0 [ 178.348696][ T9245] ? qfq_reset_qdisc+0xf9/0x240 [ 178.353558][ T9245] end_report+0x6f/0x140 [ 178.357818][ T9245] kasan_report+0x129/0x150 [ 178.362333][ T9245] ? qfq_reset_qdisc+0xf9/0x240 [ 178.367202][ T9245] qfq_reset_qdisc+0xf9/0x240 [ 178.371897][ T9245] ? __pfx_qfq_reset_qdisc+0x10/0x10 [ 178.377189][ T9245] qdisc_reset+0xff/0x560 [ 178.381535][ T9245] __qdisc_destroy+0x120/0x400 [ 178.386323][ T9245] qdisc_graft+0x111f/0x1590 [ 178.390922][ T9245] ? qdisc_alloc+0x6a4/0x900 [ 178.395533][ T9245] ? __pfx_qdisc_graft+0x10/0x10 [ 178.400485][ T9245] ? qdisc_create+0xa52/0xea0 [ 178.405189][ T9245] tc_modify_qdisc+0x16d3/0x2020 [ 178.410145][ T9245] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 178.415455][ T9245] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 178.420748][ T9245] rtnetlink_rcv_msg+0x77c/0xb70 [ 178.425702][ T9245] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 178.430826][ T9245] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 178.436298][ T9245] ? __lock_acquire+0x6b6/0x2cf0 [ 178.441251][ T9245] netlink_rcv_skb+0x208/0x470 [ 178.446028][ T9245] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 178.451501][ T9245] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 178.456798][ T9245] ? netlink_deliver_tap+0x2e/0x1b0 [ 178.462006][ T9245] netlink_unicast+0x82f/0x9e0 [ 178.466790][ T9245] ? __pfx_netlink_unicast+0x10/0x10 [ 178.472085][ T9245] ? netlink_sendmsg+0x642/0xb30 [ 178.477023][ T9245] ? skb_put+0x11b/0x210 [ 178.481277][ T9245] netlink_sendmsg+0x805/0xb30 [ 178.486054][ T9245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.491387][ T9245] ? aa_sock_msg_perm+0xf1/0x1b0 [ 178.496334][ T9245] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 178.501633][ T9245] ? __pfx_netlink_sendmsg+0x10/0x10 [ 178.506925][ T9245] __sock_sendmsg+0x21c/0x270 [ 178.511614][ T9245] ____sys_sendmsg+0x505/0x820 [ 178.516395][ T9245] ? __pfx_____sys_sendmsg+0x10/0x10 [ 178.521697][ T9245] ? import_iovec+0x74/0xa0 [ 178.526213][ T9245] ___sys_sendmsg+0x21f/0x2a0 [ 178.530907][ T9245] ? __pfx____sys_sendmsg+0x10/0x10 [ 178.536121][ T9245] ? futex_wake+0x4b2/0x560 [ 178.540642][ T9245] ? __fget_files+0x2a/0x420 [ 178.545236][ T9245] ? __fget_files+0x3a0/0x420 [ 178.549922][ T9245] __x64_sys_sendmsg+0x19b/0x260 [ 178.554877][ T9245] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 178.560360][ T9245] ? do_syscall_64+0xbe/0xf80 [ 178.565076][ T9245] do_syscall_64+0xfa/0xf80 [ 178.569593][ T9245] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.575665][ T9245] ? clear_bhb_loop+0x60/0xb0 [ 178.580345][ T9245] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 178.586241][ T9245] RIP: 0033:0x7ff69c18f749 [ 178.590668][ T9245] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 178.610284][ T9245] RSP: 002b:00007ff69cf59038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 178.618709][ T9245] RAX: ffffffffffffffda RBX: 00007ff69c3e5fa0 RCX: 00007ff69c18f749 [ 178.626685][ T9245] RDX: 0000000020008850 RSI: 00002000000012c0 RDI: 0000000000000004 [ 178.634664][ T9245] RBP: 00007ff69c213f91 R08: 0000000000000000 R09: 0000000000000000 [ 178.642640][ T9245] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 178.650612][ T9245] R13: 00007ff69c3e6038 R14: 00007ff69c3e5fa0 R15: 00007fff6534eac8 [ 178.658597][ T9245] [ 178.661941][ T9245] Kernel Offset: disabled [ 178.666269][ T9245] Rebooting in 86400 seconds..