last executing test programs: 5.569744166s ago: executing program 3 (id=8623): unshare(0x68040200) (async) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) unshare(0x40000000) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000000)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f00000000c0)=0x28) (async) getsockopt$IP_SET_OP_GET_BYINDEX(0xffffffffffffffff, 0x1, 0x53, &(0x7f0000000000)={0x7, 0x7, 0xffffffffffffffff}, &(0x7f00000000c0)=0x28) syz_emit_ethernet(0x88, &(0x7f00000000c0)={@local, @empty, @void, {@ipv6={0x86dd, @gre_packet={0x1, 0x6, '1\x00', 0x52, 0x2f, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x6, 0x1, [], "bf3f030b7d27"}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8100, [0x6, 0xb, 0x3e]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x9]}, {0x8, 0x88be, 0x3, {{0xc, 0x1, 0x9, 0x1, 0x1, 0x0, 0x4, 0x9}, 0x1, {0x89a0}}}, {0x8, 0x22eb, 0x2, {{0x3, 0x2, 0x2, 0x3, 0x0, 0x0, 0x1, 0x9}, 0x2, {0x5, 0xeb, 0x0, 0xd, 0x1, 0x1, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x5, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x2000, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000080)={0x4, 0x4}, 0x2) pselect6(0x40, &(0x7f0000000240)={0x2, 0xcc, 0x4, 0x7, 0x6, 0x0, 0x100, 0x5}, &(0x7f0000000040)={0x1d, 0x8, 0x40, 0x7eff, 0x0, 0xfffffffffffffffe, 0x71e7, 0x8}, 0x0, 0x0, 0x0) 5.569362158s ago: executing program 4 (id=8624): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg$can_bcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000680)=""/112, 0xfffffef2}], 0x2}, 0x10150) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) getpeername$l2tp(r2, &(0x7f00000001c0)={0x2, 0x0, @empty}, &(0x7f0000000200)=0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0x3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0xfbee}, 0x1, 0x1, 0x3, 0x5, 0xe, 0x4, 0xf, 0x18, 0x4, 0x2, {0x6, 0x8, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r6, &(0x7f0000000280)="05ac2d814e83ea34af2c63a528e9a1a201019a86d63e4169e2d99357c73e5cd0a506462420b097d21e4420966e8ef2848e7577043ac0e5770000000020347d2d11b4eaa017c7b52ceeb6ed3d86505ea0", 0x50, 0x4009, &(0x7f0000000140)={0x11, 0x86dd, r7, 0x1, 0x3, 0x6, @local}, 0x14) 3.936514542s ago: executing program 2 (id=8638): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff}) ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000080)='\x00', 0x20000, &(0x7f00000000c0)={@_ha_fsid={[0x5, 0x5]}, {0x9, 0x7, 0x0, 0xae3}}, 0x401, &(0x7f0000000140), &(0x7f0000000180)=0x1}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x4, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x4, 0xd}, {}, {0x3, 0xfff1}}}, 0x24}}, 0x40004) r7 = bpf$ITER_CREATE(0x21, &(0x7f0000000300), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1d, 0x10, &(0x7f0000000200)=@raw=[@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @cb_func={0x18, 0x9, 0x4, 0x0, 0xfffffffffffffff8}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}}], &(0x7f0000000280)='syzkaller\x00', 0x1, 0x14, &(0x7f00000002c0)=""/20, 0x41100, 0x10, '\x00', r5, @fallback=0x9, r7, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x2, 0x7, 0x3111, 0x784e}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r8, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r8, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) sendto$inet6(r8, &(0x7f0000000000)="826bb66f", 0x5ac, 0x0, 0x0, 0xfffffffffffffec8) 3.820101235s ago: executing program 4 (id=8639): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'team_slave_0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [], [0xff], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010023010000360200000600000000000e00420000000828bb1b8019d8d5000d00a600000000000d001000000000"], 0x2c}}, 0x0) listen(0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x5) sendmsg$inet6(r3, &(0x7f0000001300)={0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001040)="7d262dc1afc8f2576495e566be6d9f11f9533f4cc5a92970a675ccf217aca9c38175687a194503ad2f75a5bcae7f73f30f77569198dec82698d767626378fca0d0a74cdf96db0e9c9938dcc2389fbb1996fa01ab1b2368b76e5ba8788891693ca4", 0x61}, {&(0x7f00000010c0)="8f27a9c53b4163525e8508453d6087c4b1a5a8b8e4a49835a7885b10244463918ced470f875d7f14680e6c1b426e61566749da51cb81e2ecde80f6cdb15cef72e756396c30eaeabf14a4410e29de09aae9c5daacb9378e00ebe8d366c1fccc892bc426907dc9e18a148ab7852a12df501c911604e2f1af63ba1c1a4aa70fc62cee077dbebe", 0x85}, {&(0x7f0000001180)="8a77cdf7baa6f4696206c7e5bb2747905f478470d3fecaea317dc0c4e5c13edc314565ef5fdc9432c459222dd73faf5e2e76e351d278e4af8d4997fb52554d1b4195fa8218f6505f15e07cf1", 0x4c}, {&(0x7f0000001200)="436ecef505c07ad45e09f6c5f1ba8a6295f8d8e991eef92cf0131107169d85d116270fe31dba5567ea6a03d6ea198e9105b410a236f74ea87543de18e37852114dde8a0ca13a8f0b2890b82004fec6c5421fe04930891dcfff00c4a1c51146f778d2f8ae3cfac6a03cd38297c1f9a44a41fe11ef13bb70c04f9411e217d36341ed33", 0x82}], 0x4}, 0x4000041) bpf$MAP_LOOKUP_ELEM(0x2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r4, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000000), 0xffffff6a) r6 = socket$unix(0x1, 0x2, 0x0) bind$unix(r5, &(0x7f0000000200)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r6, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r6, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x800) sendfile(r4, r5, 0x0, 0xffffffff000) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x8000) setsockopt$packet_int(r4, 0x107, 0xf, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r7, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r7, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) connect$llc(r7, &(0x7f0000000040)={0x1a, 0x300, 0x6, 0x2, 0x9, 0xd5, @random="0d0728c880c3"}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) close(0x3) 3.466969894s ago: executing program 2 (id=8642): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) setsockopt$inet_udp_int(r0, 0x11, 0x67, &(0x7f00000001c0)=0x8, 0x4) sendmmsg$inet(r0, &(0x7f00000051c0)=[{{&(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000050c0)=[{&(0x7f0000000340)="67d628c20f6a631cc7", 0x9}], 0x1}}], 0x1, 0x4000004) (fail_nth: 10) 2.571795628s ago: executing program 0 (id=8643): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0xcc, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0xf5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x38, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MAXIP={0x14, 0x5, @remote}, @CTA_NAT_PROTO={0x0, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x0, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MAX={0x0, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x0, 0x2, 0x4e24}]}, @CTA_NAT_PROTO={0xc, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0xffffff6b, 0x1, 0x4e24}]}]}]}, 0xcc}}, 0x0) 2.570562359s ago: executing program 2 (id=8644): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @empty}, 0x10) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) listen(r0, 0x0) syz_extract_tcp_res(&(0x7f0000000000), 0x6, 0xe) syz_emit_ethernet(0xd2, &(0x7f00000000c0)={@local, @broadcast, @void, {@ipv4={0x800, @tipc={{0xb, 0x4, 0x2, 0x8, 0xc4, 0x65, 0x0, 0x7f, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@rr={0x7, 0x17, 0x1f, [@loopback, @loopback, @multicast1, @empty, @loopback]}]}}, @name_distributor={{0x98, 0x0, 0x0, 0x0, 0x1, 0xa, 0xb, 0x2, 0x76d5, 0x0, 0x1, 0xfe00, 0x1, 0x0, 0x4e24, 0x4e22, 0x2, 0x1}, [{0xb, 0xbc83, 0x6, 0x80000001, 0x3, 0x5, 0x7}, {0x9, 0x6, 0x80000000, 0x7fff, 0xfffffffa, 0x800, 0x4, 0x5}, {0x9, 0x0, 0x2, 0xfff, 0xffffff80, 0x9, 0x1, 0x7ff}, {0x8, 0xc73b, 0x642, 0x6, 0x4, 0xfffffff8, 0x3, 0x4}]}}}}}, 0x0) 2.06053276s ago: executing program 2 (id=8646): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x1c}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d300", 0x38}], 0x1}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/32, 0x20}, {&(0x7f00000000c0)=""/81, 0x51}], 0x2}, 0x60) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x4008054) sendmsg$kcm(r1, &(0x7f0000001800)={&(0x7f0000000080)=@nfc_llcp={0x27, r5, 0x0, 0x4, 0x4, 0x0, "7a5af02f0b64fd2bbb8687cb12deb1f5ebf24cbe48fdba554eb865dcef10d0a3ec98386b14e65c9bbfc3d0b55e7e4ffe574ce8c528b04780db869b4fbb3ebb", 0x1c}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000200)="a656d17caa5d72149af89613a77794464b72727d7937484475c21e574c", 0x1d}], 0x1, &(0x7f0000000280)=[{0x98, 0x111, 0xfffffe00, "dd78a96a1768fbb2e038653b66b5e121126beefeb26a199083f05dcd849833fcec4d1291c38b0161d0d48b419d12ea2dfaf6b3a94e41734c324a6102e1fd42e02d0cdd5a22d5f2d5afcb7ebde4ca9b84b28e926205994c0b5d96ffd4377912f83ea3c522eadd87c583260f7c488392545d49eb0df3fe903bf1128c595480c9c2c1ea9a"}, {0xd0, 0x109, 0x0, "20d90a1ddcaa34f0d3237dfbde2a175f91ae9b44a7b8e3624e5d3f89f4812c8125b1e102fe89a6e1494551f45496081ea1aab40e2e00f10ad2b01e79f7662b00e401a406a633b176b2ef21f7c15ea45b3dc4609056e13603480441c0a51a0e35a17e97513a8548dd7866371b1a09fc67093fc31d87f9d92252a6bb482f92f206cf31454ef52206d8a379d455786ddaf4ea6fa30888cb5f8c71c0a108b10efdd7132531e3baf75452a0fc285079f55f207f09fec79d9f4ba02737"}, {0x70, 0x10d, 0xeb9, "4070c350f78f0e812843eb975fb4c4e6dac53acd677a76ba0b1e285d83b5eb271070040220c9e8247dbe8661a265ef386b728355968d45d795f439f3b039bbbc31c8ddcf384bbb09091f17112f816efbfd04e3890d699233590a7f"}, {0xb0, 0x0, 0xfff, "ed5876ef200c22f4dd6ff60868f2bc98f173240982a1a38126764c53d7b5cb9ceddaa310a7ab1b25b97b842d4a1127ccc3a286f84be75b69c0e7f934f68e7eed17c98af036fd2d2a95188064ff6f862fef5902c80294d2e5782921aaf3a40e58423a86abb8e19eb161c2a2a4c3439df89393dbfcb8c9262f2230091c1d141c4b0793ebba9dc62a0669c7cf1a347095efb87e78cc8bee37dc7eb719"}, {0x80, 0x113, 0x200, "d614c43b23a4885cca74370965fd034db27651f355bebec448fb533f1a15aa9646afb312d2d5d6ab0a863767eb8057560e3e79dfbeb59ff79026d5d8d567ff8e94de92239e8c9bb708a0d4a4a3ca9fc2e373954a1040200d3dcaad6c02bedda27882ed54925195d2ffe470ebca4d6af7"}, {0x100, 0x118, 0x5, "713ce6cb6d3b7c29dbe90a9e785367560eb4ae2e835550158d9f0129283c3f2c5550213df39f3fcb0f4539bdeb0fab6e3d7a6cf23587d30bdf5ed25854058e4d9103b7d63194c3ef4ad93f23ea0a3958263b2bb15e15502713b2c49b84a24154d1573b8d0faa5c336b344bddc22e2b80a812830bd74b72e3e12e06354f7a9156c1bd3bea12e810fed05ed4aad70fe4b37fee7fdfc3f677aeb83d0f781cf637bf5fa6ac6e86cfac3fe811955e6fccc2200e7970fed0a2eb9850b03a224ecc0b2a054166b31ef7a1af65b14e1f89a59bcb33c5349bd3fbe9d44f5673951ca93931e4bf3c037e63a8be38d01877bb"}, {0x108, 0x117, 0xf, "f257b31a7ef77ca2f74c6db259309b5a5f55c888bf56abe1ab2f960529f7adf1b8b943e9345c707626c5deaff1514d1a70280e92bb6f9937d58bfe938bb00c98ddb4fc3f86fd04e52c9b78152a654201e7c6c415ecf702719a86587ab2bb3a3c9db1f4ef86f714fc37e3d6cd83cfccab41fdd6c35066e3dac9a323e9796b442d9f2bd95cb045f40a9848813901e18b64462e76bc7e6aea598ac0d0bcf86039207a5179b92f521e3a2aa6617d745739515c0153151589cb9a5b5f7695b5f2dd48052faa7bbad3550bc9173729d60bb3686ae5aab73d8489a3d2cc54eafa7559c9c859cc1136555804c393080caa10ae0f72fa"}, {0x60, 0x112, 0x1, "31daf9b28e8ed63c04921c8803eb731db9797d9bc5c72e5e25042ee48e78a4c3c197a97b1815f5bf19e62c84b7122f2599078ad08f4554fbf2d430141af064a09265e7972ab1481cd0861d05399368a0"}, {0x1010, 0xd8eb380da364e632, 0x7fffffff, "efb079056f4511414233e240432ada683e5766f393f7db9624473b294856dd06c8ab65662c1d985c6bac6a2612027dbb34fc0797c228457a8a665c16e9081f836f768a7e080c0dc0e9379f827c4bccfbee1061f16580e8aa13609e3b83f288785a65dc0576cd9c6bec15f885f556695a23d6e96f21f1e85d1194e2f2d8a63a7c688ed5ee829bb9ede16f9f342549944647debcdf3dfbf946b79e7231dcf5e9d54784a257ff8358c8ec1fea17f22aa67c17e7b8430ffd70c20b47ecfda3fe24a196f902bb150852c92ed5e716fa6950096f4b41969b6570fd5bca389f9a5be419f1b853e62a0f6d57e0442561fd3423b8f0511d6fc849509db7afa16de0e4196ff2cec007326a950091b8de48c8c6bc0d653c1d2c5e9fe16ba198fb6a0099d5bc146eee6b1c8ba4cd4fde8a255ea5c6542c8d8914587d6bb3cd94bbfce2829bb491bffa9b227335de573f639c9de60c04b00aeea0a86d4f0fa8b0fbb46f734d3e967469dca420bb2448c4548dc27b0685af3d3ba988459a47ace9ecbbd65b3a4424c6f9d2e98c3615fc3d6d3fa21e9b4514b00f0ef063271e330fe65cb28f34edd008af79d79d3419c009172c612e142400ede520cc57bcaa24ed72ff2c7cf541d8775d4df801dab9c73af167b877532f6bad302b9121bbbb3313809f537ff3f3dc3c9f2b9010be3ac5b5964ad5f0b3e9dc85c15f903abd7dc9db4117481ba55d02ac906ea0a243032c4686dd717200a272de42dec0ace830c559e63d6eccf5a09bdde0e1edf6495c84b68dbb83e7c55a73279d13042416755c9432861732d6db6e1cf229a7bd6403dd7eddd7cd689fa0ee25289ba730119609858933dc0855fbb4290f5ee5baaf92428bf13ede49dc8b95fc68fdd37fb7e06c84ee9de39f81ce3014a468c721a205f41610febe54176e402c5dbcfb2e06c07c59545747c1a10abb9f2f181bfd241055d29262a77e8b23fe31f914f9c048487a5f449a1eeaa76f89dcf25bee68c2a9c01d73675696d71818c1e67e3ee15eec4daa2cca0ef2f3bcbe409bb3c64b0f9d2ad347a5e8e7c53bd2981cdc278a5676d838e7733fbfc5fa6d7fddc0e2e903a99cb3f23441ef97bc45baf09f6c10654e4a184429db9614969c749958e613751606ad6fe1a7bfd665ebdd747c475ef4a526bd5527166800b712c60ec723727cf6b982f530ba3bebc62c8c8bba73f85b1cb37fecbdbce6d7926faf2c5a063d30a24fe8ce52fa9816bb37d2566efec725502a3ef5f1d8b405f1f984688589774d06bef7a94d42aaf4ae5cba29fce532d56f99b013f2815a08a82d3bc7802f300c5effe0f5f13d53c65114aa3fd7866b0cccc1518601d6f4bd2198670d9e35b5e5900cceec0716256f56adc5857ba188b06f93acd849c290dafcdf1194cf0b75f75a2abbe9cfe8a937086cce4f8b17ed6943ad102ffa351dd496438211f37a5ba4177fef6448a254e3c5e8539fa9189f9328960eb31eb036306f33a208e8a147ca2d893c80fca12fc57f43cc9f2a7aa2cea92a864cc2609ab3b3a18b09058c0698ba5abd072b17ca51dd3dd4259e02e0ef45d1fb993e4b6098ee73bdfb2c5db6fb8762395d5d30bc894a70b28ded06ee6df6fb36253d1fef38b29818b443654723aa06b7fa79d99d0e791996986caa9feca99bf17dc080188662cb4ee3d0ba4a35b2ee7788e05a20fbf7cd55d76fb040c716e48913d1fa934f7b7b2309259135fd4f58b28f654ab280521e0064e11dec965114fb6cd0a698f4a06b512d4d9d438ea486a3aa979dd9ff1b283dcd8ffe113574b37e1231918ab3f3a79be66b893bfebf163f73d679c040d2c73c960bb4c2a41e76c48a833249c36da2dbaf8e11db48534509760ab4884f48311a2147caff3318d7b6078eef94eb84c0df8066758940f97d722c35aa26d5854cbd68308fe37c70f3423046eaddc4be5d1a940788068a8bf9c32fda2de31cdea9635d673dc20446a0a66339f3445225bf0a0a74007c0573a36a18cdfcf654248f0d94fba259ed4a675cdf10e1d955213f275ebbdf2695a62b902238fb6bdeb3ef570957c81567e931da3444c732b36aa6fab0ddace1e317ffb2dc0d6a114e874dd19207ecb785288d4da4681950a479d78686ed586bf35548be48ae7a9a46505a944e137f73b328559a952cf1a6822d57f0bdfdc00a703454a96f508557dcc89ee7736cd69508bf109d4049cb36e2d83ad5dbccc19953b1ed63cba0a8a2a0703227575016c24adcff1d53389b8f842e5ac5e92cbcc15a5dd3c185f038279c5852106b9754dfcced09ac6c62527fbc19085db1e28c34fbfc60588ad29acda2ad11fdc3ada71b2e219aade2e0115d524f80b14cfeae07f08e8220a30568b9c496f25f348416cf252ffaef2d7867b0aaf6b0991221013a1447076e87f7db33b792f564c6619cce6c67a1c5cf6e98945a5170ea83660dc39dca228f386400517c241c34e7b7cb1ad7df4d25f0fcfda2c3e7a00215f74f10618ce087c77d0628c9bd1070f3318d45148e46c57fc8c600fd119f3e64095eb525a19fdd7bf04cec9d4f822e5f6e3e872154be687b6ae3d5d357eca70c04a1d3e46071a0028bfc4b8900d99eb6f9b857ea68ac593372389d420cc16074f494a566d17faab4f1129aaaac6b2855e73ef1350edce6f3177aec1a44f4387bf4d2539fe32d7d83e623935284569e6966a5305272c1eadbbd1c5e3a4488c18bd588f06f732b10b7976860a68469a2f816fee21fc7448aaf9299543d857572c5aa0d56c8a2a12725d89f3d35f6b418c9a1057eaa078938b572d4a0f214ac8a6c4e682659652bd1a0fc51b47203b4ce52c02912093d7086c82ca953763b2e27a8e833d08d7a4a66f2ecf252c753f434fdb7513c5ac9e9bf98a9575b4908e46f2bd25723eb401f69fd7a34a5b4ed68a8952d1fc59e577cd42142230056444a330b0c4f219f20069a76e57b315c21297eaef9bc27fc72ae16091cdba0c561875f8c0f64abac3226f507ae0d7fed9da01073f46847cdbc6b15d6a59794c7019d282515f2ae268ab84c36786f56b4b92b68a5518ada12af806dc64f1c056b8c59316a2bfff8e13fd58d8b845fbcce6d6cdf11a297d2cc6f917e495226ec8e014953ceb5d85840f389ca7ae8b936ad9096e0091a8ada44d24f0e8a78575b563e5466fb55d5007b0a5f140b5040774d03117037146a9647f4120db1b15aa404f3b501cd01c719a08c5e148b31e56eea689a63abbeb75900886a77de5a9c9c4877ec0656fff16684623770b773dc0eee3e6daad1c8a1c48a8d06eed7960f8ff624d8eb0fa2f0bc8fc1e6b4382293a024737831ead6262700ec45f69673883e19fc233e76fd091db4dcfa75930f44a55dd6d17b901954783af3f8a5beceaf0b908ddb0519d2aa8de96c99e606239235e44a30fc97639d1402e4f333b61a4d42aea060386d47256f3b845083f9c39ba606452b102a2382e9618e9909ffc421a2c890cde1d4a647fea34c1a46705cedd199fa299e3b0ca60e671cda7de1f5d4d47ba2c811d5dc6d29bd714fd3f4ad0ba9dfaddcbdcca08628723cf53bd127ae7abcd5c59d45bf04d90a7205c9a5191201286e95ae17cbe4e7e1e5160da6258523f45fda600eb9157ffba2b0904f7d98d293fd90b5a85b7e9c6d0d9bede38b14ce229ac9daf839eefb29b65ea6ea294a8293abf32bac38b5f9fa0048aee0e2760adb539a201a1da7b4a24b5338e389c550920d3121f6c83963e79d9c921fea6b8dad4246fc4de83c40b9595df520f37363f8f9357032389748e56640ba292924e97a2e7d3b08e7843c35097f6919314caa63d71e0f31296e21e1e99b599fd46360078da4b7208ecf2f1c8783a0b70d430f3f69a141d63cee14ba0f62f0ec07f0b4d336224eb42ebbcd991f6811f5504c888da60a6e635fb680d93edf162211b2773539de47e8cb99676748c980c031e47de829b5d63fdc92d0499bf14e1ccc06a10272c16463f02424db6baf91f65f5c33b38a40e47b98945a524bb03a08a7d9ee11e7638b0b7d5cf9a7cd22a63d230361d2340b00ee62d035ef3bc40f5844cd4f7648adc02c745155855814d4dfc651607276b646dfd177a73c0dc3329280260ec77e138820e82ebdc61e0e5306fcf859cc1bec17c4eeadc7cec048348b30826a88d1e4441323f5270acc1a79ddbcc9485cf26068122e0e85297b0015dda27065a78616950d3a4722fedb5f2e68e479c137d80835d175070922142d426f6718d49c1b6fba1380cad78153f568147e3dd5fe0333b9b15142bdb18c531f2b4392fa29eede78b588cef2052ac1d8d9bdb8b8bc6049086b6bb5faf50152c945e1d4ac0db60b897c87da361d63e161aa099e9f9b2b11fd710aff8b41b5e89186ca34d7d67c9c15c0e8c251cca11ea5e71450b89beda5302b91a6cf359d08f4ceec9ec03797d150c0f33cdaa7f40569296b45f6bd0bf7c58c115b333b9c66bbf965e946c04dd7c4fff551734aed9d13b02a53b90c5734bbe39e859ccb610cf1df1acb1bf496f6e551b3e9d67d2d66325ed6b215167bfc917cc91cef28527bfb5c53c7a59bf7137a86bae3b0d07cb3e49ea3f20372d8a70c5d469e2ec09a6e7f19d37227037dd5561e0eb6c1637f094d35e2ca11cdd28ca2f3abc9af3ec20e1e923867b7047c3f3ca0368d77c730f56c5177eef5d247fd0fa124aaafdba08460ad3c1ebf4661186a963a9ad18279a109d688f11416aef7e1c66a9c94457f54cd689bbd71d6be7ac62b2cd798abaac6dde2d253c17ee1eaff7477689c90abb741b79a8b86f17a358efcc5f90e17ff1dc825b26986e9ed6e112c52c48675994321352f0c48697f705bb5b135379eeb2d5c1a56999dd10032525d934fa3befa27a5ba891964a070e33f3940972c69ee084914e27c9e50ff96e54821e8d912413cbf772c25295ec33c2905ce1fa2473c265bc1aeb3391c523df34cfd621fbe94ae4565c5b1ba818660c7f58c04644dceed747b112d3f43ef959a45cbd68481abb4957db84d53e2b216a0c5e8d2d37c583cebdb5c81c3aa65e4526bafbcb7f2c846d20ec1dd957ce8dd0a4ae946a88b3aceed4527fe55974f97eadf9d43bde5afbc1071ef5c8e2f85690b6290421de73ae7684ba671bc750a782c176eea8924fec9f22174cd7caf5c59a08843696dc7518490fe6f5248e63b82a1f9b1bfef0f69c862aafa5f773cf576eb980688e1e956faee2bd3cfa8737a7ce166b43d77ed867cb4264f2d6f1a6d16f23a20e51b45dda00eba0a41b55245a00ed1df0fcdc972e2d635b2a3b436214f56d885fb90cd17ab662abd22e3355688c93a61025a3fadf820c1abf47387f4163de89d70ac0d5ba75e70b87ebe12b54244667a28d0c559bfcc8f472d21d539d5e64d2fa254b1e7de126c30ce63cedf439369e2d7fa26f754983ea2021dbbbddf6b0c4e608d33a6ace57501c4506e23f53a51e8170742f9bae7c1b74e01d36da5b6f9955ea73deffcf2f33c002a60bb275db62b4081e0f6597aa1b35e7539b5461963a5e6b1ba1a6a1a6a0f6a9fc4ad6cfac432f3440d4bb231cd1d2f99a9ffa518db94834169b1739feb9c0e752634d63d56349bcd603d24638ae845a666ee41a80d3d4de822b3645e877a10ab50046d8b69a3bc75c7fd1e57a94590332f88d39cd3caed27cde73b08899f388ca1a5327ca99c0b71291139e09537058c62a5b13e7a7098a0456c0a13765a49c574b94674d038412fa6340161e7891d1f2ef5f57c84fea792becda3d3af0ce57d206b1e1d083608b496eea6563e925a2c270b"}], 0x1580}, 0x40008005) 2.04752224s ago: executing program 0 (id=8647): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x12, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xd, 0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_BUCKETS_LOG={0x8, 0x8, 0x7ffffffe}]}}]}, 0x38}}, 0x0) 1.99573779s ago: executing program 1 (id=8648): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x20, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x8}, @NL80211_ATTR_REG_RULES={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20044050}, 0x4000080) 1.912528189s ago: executing program 4 (id=8649): r0 = socket$inet6(0xa, 0x2, 0x3a) r1 = socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='gre0\x00', 0x10) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d00001000000000000000000000000800120002000200feffffff000000003000320009000000000000000000000002000000000000000000000000000000fc020000000000000000000000000004030005000000000002000000ac1414aa0000000000000000030006000000000002"], 0x80}}, 0x0) connect$inet6(r0, &(0x7f00000005c0)={0xa, 0x4e1e, 0x47, @local, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000400)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000600)=0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000001700)={"3f94b8dd5df7d3c518f041d434864da8", r4, r5, {0xde06, 0x4}, {0x2, 0x80}, 0x3, [0x8, 0x0, 0x4, 0x2, 0x1, 0x5, 0x5, 0x89d, 0x4, 0x3, 0x29e1, 0x4, 0xa, 0x0, 0xfffffffffffff801, 0x8]}) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, &(0x7f0000000340)={0x3, &(0x7f0000000200)=[{0x0, 0x0, 0x0, @local}, {0x0, 0x0, 0x0, @random}, {0x0, 0x0, 0x0, @link_local}]}) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r6, 0x107, 0x7, 0x0, 0x0) setsockopt$packet_rx_ring(r6, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) setsockopt$packet_int(r6, 0x107, 0x7, &(0x7f00000001c0)=0x7, 0x4) r7 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r6, &(0x7f0000000300)={0x8000000c}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001140)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}, {0x0, @struct, 0x0}}) ioctl$BTRFS_IOC_DEV_REPLACE(0xffffffffffffffff, 0xca289435, &(0x7f0000000700)={0x2, 0x2, @start={r8, 0x1, "fe3e7aa1a212b4082e17ac34a6fa566a06bd6892484e326659b38ada8037e82dd26f1820e3ddb6dc5c6be4bf15923a2b9b3d1609dcbb9d3ec86301771eb43fe7cf7634fbf13028722a53eddad33e4f973798a04342072f3d8ae33bade310332f2edf0f8901304d6a27afe27d4ec4275721e4a85026dbf403a0dd0b7050744601502cc663e5b07478db218f6ce53b564fbfbbd0c2912d704b8b344ff4200d5dadbbe4e8dfa8409b852b16db7454b1d3bbc1def23d9b5c1bba1a1adc5e9d2bfdfd6b86fe5af73a69947223d827041fde660434712dfeba7eb39d8e14a5ad47b7ed08a903df021c8511e3c750ed4546d94fa2e4072c38e4495f098269b907b77a5c97fe6c6c9b01b8a2e74c2100560f08e9c0a74550eebb69b2c36d9e474c2e0eaa5de84c2a40d171b2a31f4a91c44cd5f7e3515e10a9adb9f053490c0850987c0904a01d76f254bddbd1133fae8c351bc1f7e6d5f407eeab5a9d562418a058c97a6c34948e0832eb311f94089ccce4f745810888f75cce608574911f7c10440e4c4c4165aa0404f7d1dce0112765ecfe00c9c98ff7bdca41a852db239cf249d232a020a29aeea16504b5312d3230f821a47e02d07ca820099364a4f7a9958c899ed94a56eda3b8e8f780750092415a140ef68a53baa338b03d510d9c10b7294fff6b80c374809e522c6400e09008e7667c0e4764d4c4d87037a35487e7409919975b657d1a69adee08d1f70160bad163a57a5ea2d1463e92aa9d1982962c7c19f58542f53eeb08b31910f7c218b4ec29405c98382850b04bb73afc1f9e9fc1ae60c96eb7db3b1cd57e178c7e6369ae6f91c09cb4128e4774fea2146bff3ad93d19ff72877707bbf7da72498bcb12f7c2d037d4c6dcdd3a9944e4a96e88d4b511cab59a296bd513abbdf05850340f4a6fa98a634a4265a142bf35dd582fdba5d4ce77fdc58127e63c6bfc3fb6f7db42e10aca4163e4a11ddff0e8f0de1042632850838e8cd2adf68b31424721466ebde3ab83829b7dc897bb89d48be55106885b653abcee386b18b18c5ee079814b0d780eba3b4354a2f1eade61b4f5019d65952161f6270c155f5e9c4e7fc9db991355da764ea3197784670923ad569f8cb7cecf2b79b9990bb0d304cd764187b60ae21d29f66ff4f96abb51a7259c70606cda32e95f773a44d5c22e7f8aea65e479105144d09aefbf857bdf008045851be30b06902d084f1446ea5c4bc415c20f42c2fdc144c27533706eba471091d7fa21a120b984fe06ae4fed3c642f3b32d5a9adf51b13aad3198f03fe07fd60a1cd8b537349a8da3c96237c13d3758ce565f666ccb44cf2cc70d340dac221585750a5bd4d3e5fcf6c178c4efe84f08cabf539a9aa580c85e9a10e7bffc261c3328a7c0930ece92ca081c069976ae6b34b3d0589252ecab4ab03acc10367827d6ccb1e3f182e", "f608f59f0f8ee625fabf0914243273d02c1ef2c24146285e6822b12f25cd3c46d1607ce87e244098f9a0c5c5597e335cd2bbed25116a86f8b005094d9eec6bf0934b96205188b6a458c7e9e8794d343b13b50d668306712afefe116cb6c2eb039dad8d4dd602e1ff577f88866532ff4e8da6f18876cd5b413e28374740b683ae7de68a7fb20a2945c42362fdb8f1ad4fb7fa07273983cddaf483097663d3eee6efee0d1b8a8561c9503c1d1410fdba68840b221f283f74c7bea210663e3cc3f98867aeb2234dec6b4e1375f421053cada7b1d133a7f379616006035e4482775afc4ccb6c571396d27cfa259394362b9242c37f9f75c2158ef012d30023f34bdb914017bd421e7959aeac2909599241774fd6f9dd8fed9f288922108da2b10420c7b84f350a628c971b4bcd35b1c14a04de8dea5173647546215506008247b79e7583474c068bebd2052814c489e1410ee17d29f8d4468a530aede94adfa15a499b72525ce54ce20a3e54d988bb59db638804b6b1fb2da16db7264eb4ff1ecc0bff61aabefeb754124c2045613eafab7c18393732a44f7a8ab29e554b5d302cf1247a2886b223e8b15404d44e47fdc3ae6b6acd0d9cd00b7cad5c43ad42184ccfae6f686de43d01830a80a0d1ab01b2f66af722f6c3b525e68cf0332e79200ceafc94ee3562e2264e0a0efc1f72ee5590e9004ad269b8b5635ed06d6e3b6e73c2b6bfd7531402a87b8557de884c15c0bbafd11adade9b75cafe6bf9686829ff59049ed47ece1c98946232cc6899289aa52f42b71297cd951613247cba1ede61cbc54725543726b0b24caa7a34ca36f3bb4a3686afce84f7b6f1444143215f123817d61d3886bb6c851314020e7c527287688e3493a20eaa4a2df084fe55f79fadc404ec35d53bc69b0d7deba832327b9ec7ec87bc2885af0417566ee44eaa9f3ec8af5a89bb5af3d2519b86cf99926c40a732e0ac8c244ee7b065718b103301605cf9b8a4107dd063fb36e2a8e04167da759ff7de3b407f40ac42c8e0882eaf30dcf476d400edfbe90aefedec20266fc4e403bc27b930bd1ad1138560f261d4447ff71bd558ca8105a07ce47d6cf6d6f8cdd9dfff9289c9661d95bd1cc40f0e48225e843e28cb06c3dd73601b6da4d6a60bd6d17c71477df99b669111eb118396f1faae0f252da0111038b710f04971a38f44e79a174db5a1c420aa9e28151284fb62f4c9cd48dda6621a4e9bd663d6610e10b4ac2626e3f5a823a2a4bf8173393fb7c43ef62ea5c596fb2536c09ffc7e3aae56609a4a82e7f0137d6df0ead1f0220f398d471457b52d2c1af7c590b980bcf1a72fd045aefec03ae66571f4dc08b2fa8ec6f86f2e8c3c89ed2de4ec97896413aab3d2b2ea87894aeae1c7ac4d663c1f5ef6968f52cb61f2a3079034aac86a14261b237b78ad875f3a4b1d4d18943e"}, [0x0, 0x3, 0x3, 0x2, 0x2, 0xb859, 0x8, 0x5, 0x4, 0x5, 0x6, 0x2000003, 0x86, 0x0, 0x8, 0x37, 0x0, 0x5, 0x8, 0x3, 0x80000000, 0x0, 0x8, 0x9, 0xccfb, 0x6, 0xa8f3, 0x0, 0x100000001, 0x6, 0x0, 0xff, 0x3, 0x0, 0x9081, 0x400, 0x6, 0x7e, 0x3, 0x5, 0x40, 0xfffffffffffffffc, 0x100000001, 0x10000000, 0x5, 0x3, 0xd, 0x6375, 0x7, 0x4, 0x6f39, 0xfffffffffffffc00, 0x6, 0x7, 0x3, 0x7, 0x4, 0x3, 0x5, 0x6, 0x7, 0xe93, 0x100000000, 0xffffffffffffff9b]}) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) ioctl$TUNSETQUEUE(r9, 0x400454d9, &(0x7f0000000000)={'geneve1\x00', 0x400}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNSETQUEUE(r9, 0x400454d9, &(0x7f0000000740)={'veth0\x00', 0x600}) ioctl$BTRFS_IOC_DEV_INFO(r7, 0xd000941e, &(0x7f0000000740)={r8, "81dcd6030d800b0499d2aebbaee94030"}) socket$inet_tcp(0x2, 0x1, 0x0) 1.768977416s ago: executing program 0 (id=8650): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350073797a5f74756e00000000000000000008000a00", @ANYRES32=r2], 0x3c}}, 0x8000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x4c, 0x10, 0x403, 0x300, 0x0, {0x0, 0x0, 0x0, 0x0, 0xfe0f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0xffe}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x4c}}, 0x8000) 1.700704958s ago: executing program 1 (id=8651): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c0002800500010000000000080007"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007"], 0x138}}, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c00000047000701feffffffffffffff017c0000380004802c2c"], 0x4c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d400000000010104000000fffffff500020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000030000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0xe70}]}}]}, 0x3c}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000880)={0x0, @broadcast, @broadcast}, &(0x7f00000008c0)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000980)={'ip6tnl0\x00', &(0x7f0000000900)={'syztnl1\x00', 0x0, 0x6, 0x5, 0x0, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, 0x7800, 0x8, 0x7ff, 0x8}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000ac0)={'tunl0\x00', &(0x7f00000009c0)={'sit0\x00', 0x0, 0x7840, 0x7, 0x6, 0x7ff, {{0x35, 0x4, 0x0, 0x0, 0xd4, 0x66, 0x0, 0x4, 0x2f, 0x0, @empty, @private=0xa010102, {[@timestamp_prespec={0x44, 0x1c, 0xec, 0x3, 0x8, [{@local, 0x9}, {@rand_addr=0x64010100, 0x9}, {@remote, 0xbf}]}, @rr={0x7, 0x7, 0xfd, [@multicast2]}, @timestamp_prespec={0x44, 0x2c, 0x15, 0x3, 0x4, [{@multicast2, 0x52}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x10000000}, {@broadcast, 0xff}, {@remote, 0xfffffff7}, {@empty, 0x2}]}, @ssrr={0x89, 0xf, 0x17, [@private=0xa010102, @empty, @broadcast]}, @ssrr={0x89, 0x1f, 0x70, [@dev={0xac, 0x14, 0x14, 0xe}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x22}, @remote, @private=0xa010101]}, @timestamp_prespec={0x44, 0x1c, 0x44, 0x3, 0x3, [{@multicast2, 0xa}, {@dev={0xac, 0x14, 0x14, 0x36}, 0x3}, {@multicast1, 0x800}]}, @timestamp_prespec={0x44, 0x24, 0xc2, 0x3, 0x0, [{@empty, 0x3}, {@private=0xa010100, 0xffff}, {@broadcast}, {@local, 0x9}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000b80)={'syztnl2\x00', &(0x7f0000000b00)={'syztnl2\x00', 0x0, 0x380, 0x10, 0xffffa48a, 0x3, {{0x15, 0x4, 0x0, 0x33, 0x54, 0x65, 0x0, 0x6b, 0x4, 0x0, @local, @multicast2, {[@timestamp_addr={0x44, 0x24, 0x56, 0x1, 0x8, [{@empty, 0xfffffffb}, {@private=0xa010102, 0xeff}, {@loopback, 0x7a}, {@private=0xa010101, 0x2}]}, @end, @timestamp_prespec={0x44, 0x14, 0xe7, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0x41}, 0x1}, {@multicast1, 0xffff}]}, @ssrr={0x89, 0x7, 0x84, [@initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000c40)={'ip6tnl0\x00', &(0x7f0000000bc0)={'ip6gre0\x00', 0x0, 0x4, 0xa, 0x10, 0x2400000, 0x0, @remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}, 0x8000, 0x8, 0xffffffff, 0xf}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000d00)={'erspan0\x00', &(0x7f0000000c80)={'erspan0\x00', 0x0, 0x700, 0x8000, 0x0, 0x81, {{0xd, 0x4, 0x2, 0x1f, 0x34, 0x65, 0x0, 0x5, 0x4, 0x0, @empty, @multicast1, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x1c, 0x46, 0x1, 0x3, [{@private=0xa010102, 0x1000}, {@private=0xa010102, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x400}]}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f0000000f80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000f40)={&(0x7f0000000d40)={0x1a8, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}]}, @HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, r10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000680), r10) sendmsg$TIPC_NL_LINK_GET(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000700)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="0100000000000000a7"], 0x2c}}, 0x0) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r13 = accept4(r12, 0x0, 0x0, 0x80800) recvmsg(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/74, 0x4a}], 0x2}, 0x0) setsockopt$inet_tcp_TLS_TX(r13, 0x11a, 0x1, &(0x7f00000006c0)=@gcm_256={{0x303}, "83991e506ab64aa3", "d0e28596bdf5a605f295eb3b2e962b6a7e1b57658ebbad476dddf4e54c263147", "21c3abf0", "a4cd979259b2162e"}, 0x38) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r10, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, 0x0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x10}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000001}, 0x20004804) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x12, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000008000000001a000001000000185000000000000040000000000000009500000000001200281579a9a3c9132cc1d6557c845b8b5de0ba3d5e5fb70e32ece1ad8d760100000000000000000000000000000000000000000000000000000000008653db2b14cb137a51e319b722d1c170ca3c6e759b28b31ed021ce9c1eb1ae250f2958eda30901af4fc066ea7d"], &(0x7f0000000080)='GPL\x00', 0x3, 0x68, &(0x7f0000000100)=""/104, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x7, 0x1, 0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000003c0)=[r3, r3], 0x0, 0x10, 0x2}, 0x94) r15 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x13, &(0x7f0000000740)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r14, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r15, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 1.559888581s ago: executing program 1 (id=8652): r0 = socket$inet6(0xa, 0x3, 0x94) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000280)={{{@in=@multicast2, @in6=@ipv4={'\x00', '\xff\xff', @loopback}, 0x4e20, 0x56, 0x4e23, 0x7ff, 0x2}, {0x0, 0x8, 0x4, 0x5751a3bf, 0xfffffffffffffff6, 0x2000000, 0x1, 0xfffffffffffffffd}, {0x1ff, 0x800000000000, 0x4, 0xffffffffffffff7f}, 0x3, 0x0, 0x1, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x37}, 0x0, 0x2b}, 0x2, @in=@remote, 0x3504, 0x4, 0x0, 0x0, 0xffffffff, 0x6, 0x4}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xff}}}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x20242, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0xa, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmsg(r0, &(0x7f0000000cc0)={&(0x7f0000000500)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000600)=""/229, 0xe5}, {&(0x7f0000000700)=""/96, 0x60}, {&(0x7f0000000780)=""/74, 0x4a}, {&(0x7f0000000800)=""/199, 0xc7}, {&(0x7f0000000900)=""/210, 0xd2}, {&(0x7f0000000a00)=""/55, 0x37}, {&(0x7f0000000a40)=""/58, 0x3a}, {&(0x7f0000000a80)=""/63, 0x3f}, {&(0x7f0000000ac0)=""/59, 0x3b}, {&(0x7f0000000b00)=""/107, 0x6b}], 0xa, &(0x7f0000000c40)=""/108, 0x6c}, 0x10000) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b0000008000000001000000ffff000001"], 0x50) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="190000001e"], 0x1c}, 0x1, 0x0, 0x0, 0x10048000}, 0x20000050) sendmsg$ETHTOOL_MSG_RINGS_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x0, 0x2, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x24004000}, 0x20000831) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x200000ca, r7}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000005c0)={r7, &(0x7f0000000080), &(0x7f0000000280)=""/250}, 0x20) setsockopt$inet6_int(r6, 0x29, 0x43, &(0x7f0000000000)=0x3b5, 0x4) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x4e23, 0x6654, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x1c) bind$bt_hci(r2, &(0x7f0000000180)={0x1f, 0xffff, 0x3}, 0x6) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r8, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, 0x2, 0x8, 0x801, 0x0, 0x0, {0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4001}, 0x20000000) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff000035000000000000000000000008001c00c9"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x9, 0x7, 0x0, 0x3}, {0x4, 0x3, 0x5, 0x2}, {0xfffe, 0x9, 0x6, 0x7}, {0x3, 0x6, 0x95, 0x80}, {0x1, 0x6, 0xa, 0xe56}]}) syz_emit_ethernet(0x36, &(0x7f0000000440)=ANY=[@ANYBLOB="aa061f7953aaaaaaaaaaaa2908f94400002800000000002c90780000", @ANYRES32=0x41424344, @ANYBLOB], 0x0) 1.375719402s ago: executing program 2 (id=8653): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000080)=@framed={{}, [@jmp={0x6, 0x0, 0x5, 0x0, 0x0, 0x2}, @generic={0x5, 0x0, 0x0, 0x2}, @jmp={0x5, 0x0, 0xa}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000440)='GPL\x00'}, 0x94) syz_emit_ethernet(0x2a, &(0x7f00000003c0)={@link_local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0xfffe, 0x0, 0xa0, 0x2f, 0x0, @loopback, @multicast1}, {0x2001, 0x880b, 0x8}}}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000380)=@mangle={'mangle\x00', 0x2, 0x6, 0x640, 0x4a0, 0x4a0, 0x3b0, 0x3b0, 0x2e0, 0x570, 0x570, 0x570, 0x570, 0x570, 0x6, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, [0xff, 0xffffffff, 0x0, 0x1fe000000], [0xffffff00, 0xff000000, 0xffffffff, 0xffffff00], 'ip6erspan0\x00', 'veth0_to_team\x00', {0xff}, {0xff}, 0x11, 0x2, 0x4}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x2f, 0x4, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [], 0x0, 0x10}}, @common=@inet=@multiport={{0x50}, {0x0, 0xc, [0x0, 0x0, 0x0, 0x4e21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [0x0, 0x0, 0x0, 0xff], [], 'bridge0\x00', 'veth1_vlan\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {0x0, 0x2}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @dev={0xfe, 0x80, '\x00', 0x32}, [], [], 'nicvf0\x00', 'bond_slave_0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0xa8, 0xd0, 0x48000000}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x0, 0x1, 0x7ff}}}, {{@ipv6={@loopback, @local, [0xffffff00, 0x0, 0xff, 0xff000000], [0xff000000, 0xff000000, 0xffffffff, 0xffffff00], 'macvlan0\x00', 'veth1_to_bridge\x00', {0xff}, {0xff}, 0x8, 0x81, 0x1, 0x36}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@rand_addr=0x8, @ipv6=@private1, 0x1d, 0x35}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6a0) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000001c0)={'veth1_virt_wifi\x00', {0x2, 0x0, @multicast2}}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x53}]}, &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f}, 0x50) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0xffff, 0x70bd2c, 0x25dfdbfb, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x23, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xaf, 0x1, 0x2e3fa6bf2c47fb38, 0x1000, 0x10}, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000580)={@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, @loopback, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2000002, 0x0, 0x7d, 0x200, 0x68a, 0x9b0318}) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000200)={@private1={0xfc, 0x1, '\x00', 0x1}, @local, @loopback, 0x10000006, 0x0, 0x4, 0x100, 0x4000000010000009, 0x10200}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r5, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x48, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_FRAME={0x20, 0x33, @data_frame={@msdu=@type10={{0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, @from_mac=@device_b, @device_a, @broadcast, {0x0, 0x6}, "", @void, @value=@ver_80211n={0x0, 0x0, 0x1, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1}}}}]}, 0x48}}, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x38, 0x18, 0x300, 0x70bd25, 0x25dfdbff, {0x0, 0x7c, 0x3f}, [@nested={0x4, 0x2}, @nested={0x20, 0x11d, 0x0, 0x1, [@nested={0x1c, 0x68, 0x0, 0x1, [@nested={0x4, 0x40}, @generic="b1b09a987f678770a35e093190b19dea", @typed={0x4, 0x12f}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x24044895}, 0x4) 1.267647446s ago: executing program 2 (id=8654): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x4, 0x25dfdbfe, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040801}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r6}, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002f000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000000000085000000a500000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf99017019b42da6b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000040)=r7, 0x4) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001cc0)=ANY=[@ANYBLOB="3c0000001000030500000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001400128009000100626f6e64000000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r10 = socket(0x10, 0x803, 0x8) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000980)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000940)={&(0x7f0000000840)={0xc4, 0x1, 0x1, 0x801, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_SEQ_ADJ_ORIG={0x24, 0xf, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x6}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7fff}, @CTA_SEQADJ_OFFSET_AFTER={0x8, 0x3, 0x1, 0x0, 0x7ff}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x9}]}, @CTA_TUPLE_ORIG={0x2c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x44}}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0xb}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_LABELS_MASK={0x4}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x2}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2004}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x400}, @CTA_FILTER={0x3c, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x82}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x2}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x80}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x685}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x989}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x2}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x400}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2000}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4010}, 0x4000000) sendmsg$IPVS_CMD_SET_INFO(r10, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r10, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001a00)={r9, r11, 0x25, 0x0, @val=@netkit={@void, @value=r9}}, 0x1c) 1.243894088s ago: executing program 4 (id=8655): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_SET(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r1, 0x300, 0x70bd28, 0x25dfdbff, {}, [@ETHTOOL_A_EEE_TX_LPI_ENABLED={0x5, 0x6, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) setsockopt$inet_udp_int(r2, 0x11, 0x67, &(0x7f00000001c0)=0x8, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000080)={0x5, &(0x7f0000000000)=[{0x7, 0x60, 0x75, 0x2}, {0xfff8, 0x6, 0x4, 0x1}, {0x6, 0x36, 0x9, 0x10}, {0x0, 0x7, 0x3}, {0x60f, 0x4, 0x3, 0x5}]}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000340)={0x1d, r5, 0x0, {0x2, 0xff, 0x6}, 0x1}, 0x18) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r4, &(0x7f0000005a00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000240)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) connect$can_j1939(r4, &(0x7f00000000c0)={0x1d, r5, 0x2000000000, {0x0, 0x0, 0x3}, 0x1}, 0x18) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r5, {0xb}, {0xfff1, 0xffff}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x20000010}, 0x20000050) sendmmsg$inet(r2, &(0x7f00000051c0)=[{{&(0x7f0000000280)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f00000050c0)=[{&(0x7f0000000340)="67d628c20f6a631cc7", 0x9}], 0x1}}], 0x1, 0x4000004) 1.117905518s ago: executing program 3 (id=8656): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x10, &(0x7f0000000880)=ANY=[@ANYBLOB="180000008a002018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000086000000bf09200000000000550901000000000095000000000000002d99ffff00000000bf91000000000000b702000003000000850000002a000000b7000000000000009500000000000000"], &(0x7f0000000480)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xff}, 0x94) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0xc, [@struct={0x4, 0x1, 0x0, 0x4, 0x1, 0x1, [{0xa, 0x3}]}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @decl_tag={0x5, 0x0, 0x0, 0x11, 0x5, 0x6}]}, {0x0, [0x61, 0x0, 0x30, 0x2e, 0x61, 0x61, 0x61, 0x61, 0x0, 0x61]}}, 0x0, 0x5c}, 0x28) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="6400000002060103000000000000000000000000050001000700000016000300686173683a6e65742c706f72742c6e65740000000900020073797a30000000000500040000000000050005000a00000014000780080012400000000005001500", @ANYRES16=r3], 0x64}, 0x1, 0x0, 0x0, 0x24008801}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @rand_addr=0x64010102}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @mcast2}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @remote}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8001}, 0x20000000) 1.064524468s ago: executing program 4 (id=8657): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000280)=@gcm_128={{0x304}, "010000080100", "2e41b0129edad6b541a905c7ecd5a31a", "0100", "fe8eb1c20500"}, 0x28) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)="c800b66cf7e6", 0x6}], 0x1) readv(r0, &(0x7f00000006c0)=[{&(0x7f0000001980)=""/4099, 0x1003}], 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0x15}], 0x3}, 0x4000084) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendfile(r3, r4, 0x0, 0xffffffff000) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000000700)={0xfffffffffffffffe, 0x0, &(0x7f0000000680)={&(0x7f00000004c0)={0x17c, r6, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@void, @val={0x8}, @void}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x5b}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x4}, @NL80211_ATTR_VENDOR_DATA={0x76, 0xc5, "b43883be92b9052929aa0a65f3146c58ef4bae0ab0ab1972193b659fdfbffe4326a6497e99b535a98752f99ce85f4c0c0747359c8b8308860b7ccc93794984f5bf28185851da8970beeca1ffb7e5d39f9bf56a7d8dbee86c615dd14b77ec94e2e073980f171971ce6f003c7e4bd074e45cee"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xe}, @NL80211_ATTR_VENDOR_DATA={0xb, 0xc5, "7b688903a52045"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x5}, @NL80211_ATTR_VENDOR_DATA={0xbb, 0xc5, "3262601e72c4e5bbe044ff272bf4b0a70356054221c36bff4808d2aab391dd9f07db890f6050271908d483ad9e6bb020477a3513e68c52454a1c8b1634b1f55de915b06d61ca2c4dae9cc88531a2638242188c8cbbd3089e70a9428dada7c805b1ebdf8e2add711bf08957ba645d2d3eed6afec50a499b57b34ba36da4ac02206d9adc98d975684f55ff970b85ede70eee58efab7794b2249c00b96eaf5142b1808bc4abc16ee04976a9b2294ccf5d113edb7ec8aba4c3"}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8008000}, 0x4081) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8804}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r8, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(r8, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 1.034722092s ago: executing program 0 (id=8658): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000001c0)={0x2, &(0x7f0000000280)=[{0x28, 0x8, 0x0, 0xbfffdffe}, {0x80000006, 0x9, 0x9, 0x5}]}, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@delchain={0x34, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) openat$pidfd(0xffffffffffffff9c, &(0x7f00000005c0), 0x80503, 0x0) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="09000300010000", 0x7) r5 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000300)={'team0\x00', &(0x7f0000000100)=@ethtool_channels={0x1, 0x0, 0xd8a, 0x0, 0x2, 0x8, 0x5, 0x3, 0x80000001}}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000088000000240000007f00000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r6}, 0x38) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) setsockopt$inet6_int(r7, 0x29, 0x46, 0x0, 0x0) getsockopt$XDP_MMAP_OFFSETS(r7, 0x11b, 0x1, &(0x7f0000000140), &(0x7f0000000580)=0x80) r8 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000001800)=ANY=[@ANYBLOB="0a00000016000000b30000007f"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000e445e20f93ec1368280badeb00"/28, @ANYRES32=r8, @ANYBLOB="0000000000000000250000000100000018000000000000000000000000000000950000000000000057030000000000009500000000000000"], &(0x7f0000000300)='syzkaller\x00'}, 0x94) ioctl$XFS_IOC_BULKSTAT(r0, 0x8040587f, &(0x7f0000000500)={{0x9, 0x6, 0x40, 0x8001, 0x3}, &(0x7f0000000380)=[{}, {}]}) 971.716408ms ago: executing program 3 (id=8659): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000000d08000640ffffff000800034000000038340300000c0a01010000000000000000070000000900020073"], 0x3c8}, 0x1, 0x0, 0x0, 0x4}, 0x50) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="640100001900010000000000040000001d0100001500040001000080fe02000031171e44b2b50e8f040000001e010600f800fd0000ec058cdecf0fa4f69652b23bf9968d372a0ddfe196faa30f83514813d0527685407bc8366e2838397d6abc25357799ac708b65efffdb10e1376a4f6d4ab9949102000036dbf30bf928c37695658578feb8f3cce47f43a42919c288f7d5430ffc0226139916866a978312dd970e64629d7cd799c5e08b64de41458eb8951a54a7cf29a810823e869f5c087d15d9d3bae1c089701f970f8e7ce853654222f07959e7cdcfcf27332cb82016ccd91be54e588f6ea7b5c35a62c0ceaa4e90b29c3edc16f20db3d7fb4d6236232de07ccd7d7301f46a287dd296abe9baba499721311e1597853a2d0c7e1e64f827d31e6917175792398e0edaa900000000000000000002c900c08ac1d7b606000000000000000000000000000008000900", @ANYRES32, @ANYBLOB="080005"], 0x164}}, 0x0) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r1, &(0x7f0000000240)={&(0x7f0000000180)={0xa, 0x4e20, 0x1, @local, 0x388}, 0x1c, &(0x7f0000000b00)=[{&(0x7f0000000400)="80004b77efe55463", 0x8}], 0x1, &(0x7f0000000b80)=[@flowinfo={{0x14, 0x29, 0xb, 0x9}}, @flowinfo={{0x11, 0x29, 0xb, 0x6}}], 0x30}, 0x4) 728.201307ms ago: executing program 3 (id=8660): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000200)={0x1f, 0x1, @any, 0x6}, 0xe) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, 0x0, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r3, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) unshare(0x22020600) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r6 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r4, r5, 0x26, 0x0, @void}, 0x10) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000040)={r6, r4, 0x4, r4}, 0x6) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='h'], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r7, 0x800448d2, &(0x7f00000003c0)={0x2, &(0x7f0000000240)=[{@none}, {@none}]}) sendmmsg(r7, &(0x7f0000000000), 0x4000000000001f2, 0xfc) setsockopt$packet_int(r1, 0x107, 0xc, &(0x7f00000000c0)=0xffffffee, 0x4) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000980)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="18080000ddf7ffff00000000000000d7c5fe993b", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bca9000000000000350901000000000095000000000000008500000019000000bf9800000000000056080000010000008500000007000000b7000000000000009500000000000000"], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) 727.851684ms ago: executing program 0 (id=8661): pselect6(0x40, &(0x7f0000000000)={0x5e8, 0x6ff, 0x0, 0x9aa2, 0x5, 0xfffffffffffffff7, 0x6, 0x100}, &(0x7f0000000080)={0x9, 0xfffffffffffffffd, 0x5, 0x7, 0xfffffffffffeffff, 0x22, 0x8000, 0x1400000000}, &(0x7f00000000c0)={0xa, 0x3, 0x832, 0x7fff, 0x15b2ca9e, 0x8, 0x1, 0x10004}, &(0x7f0000000200), &(0x7f0000000280)={&(0x7f0000000240)={[0x3]}, 0x8}) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x2, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x5e21, @empty}, 0x10) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @dev={0xfe, 0x80, '\x00', 0x44}, 0xfffffffe}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@bridge_newvlan={0x24, 0x70, 0x1, 0x70bd25, 0x25dfdbfb, {0x7, 0x0, 0x0, r3}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_MCAST_ROUTER={0x5, 0x6, 0x8}}]}, 0x24}, 0x1, 0x0, 0x0, 0x8c4}, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x107}, 0x1c) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f00000002c0)=0x9, 0x4) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x24, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x24}, 0x1, 0x0, 0x0, 0x40080}, 0x4000004) ioctl$sock_SIOCBRDELBR(r5, 0x89a2, &(0x7f0000000000)='bridge0\x00') r6 = socket$inet(0x2, 0x3, 0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0) sendmsg$inet(r6, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0xffff, @private=0xa010100}, 0x10, &(0x7f00000000c0)=[{&(0x7f00000001c0)="080032427e15a330", 0x8}], 0x1, &(0x7f0000000540)=ANY=[@ANYBLOB="1c000000000000000000000007000000890b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0xfffe) bind$inet(r4, &(0x7f0000000000)={0x2, 0x5e21, @empty}, 0x10) connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10) setsockopt$inet_tcp_TLS_RX(r0, 0x11a, 0x2, &(0x7f0000000300)=@ccm_128={{0x303}, "320e019f0232037d", "192c4caaf37af3d00fa4a95922e05c94", "0222dc88", "c01217caf77d0e49"}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000ae83f8ecd5764cb7c97f6d444641d8fd003e00000018270000", @ANYRES32, @ANYBLOB="00000000c50200009500000700000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x22}, 0x94) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) close(r7) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NET_DM_CMD_START(r8, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r9, 0x389366ac6fb80697, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x14}, 0x880) 645.643314ms ago: executing program 1 (id=8662): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c0002800500010000000000080007"], 0x64}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007"], 0x138}}, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c00000047000701feffffffffffffff017c0000380004802c2c"], 0x4c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d400000000010104000000fffffff500020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000030000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_TARGET={0x8, 0x8, 0xe70}]}}]}, 0x3c}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000880)={0x0, @broadcast, @broadcast}, &(0x7f00000008c0)=0xc) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000980)={'ip6tnl0\x00', &(0x7f0000000900)={'syztnl1\x00', 0x0, 0x6, 0x5, 0x0, 0x6, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, 0x7800, 0x8, 0x7ff, 0x8}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000ac0)={'tunl0\x00', &(0x7f00000009c0)={'sit0\x00', 0x0, 0x7840, 0x7, 0x6, 0x7ff, {{0x35, 0x4, 0x0, 0x0, 0xd4, 0x66, 0x0, 0x4, 0x2f, 0x0, @empty, @private=0xa010102, {[@timestamp_prespec={0x44, 0x1c, 0xec, 0x3, 0x8, [{@local, 0x9}, {@rand_addr=0x64010100, 0x9}, {@remote, 0xbf}]}, @rr={0x7, 0x7, 0xfd, [@multicast2]}, @timestamp_prespec={0x44, 0x2c, 0x15, 0x3, 0x4, [{@multicast2, 0x52}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x10000000}, {@broadcast, 0xff}, {@remote, 0xfffffff7}, {@empty, 0x2}]}, @ssrr={0x89, 0xf, 0x17, [@private=0xa010102, @empty, @broadcast]}, @ssrr={0x89, 0x1f, 0x70, [@dev={0xac, 0x14, 0x14, 0xe}, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x22}, @remote, @private=0xa010101]}, @timestamp_prespec={0x44, 0x1c, 0x44, 0x3, 0x3, [{@multicast2, 0xa}, {@dev={0xac, 0x14, 0x14, 0x36}, 0x3}, {@multicast1, 0x800}]}, @timestamp_prespec={0x44, 0x24, 0xc2, 0x3, 0x0, [{@empty, 0x3}, {@private=0xa010100, 0xffff}, {@broadcast}, {@local, 0x9}]}]}}}}}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000b80)={'syztnl2\x00', &(0x7f0000000b00)={'syztnl2\x00', 0x0, 0x380, 0x10, 0xffffa48a, 0x3, {{0x15, 0x4, 0x0, 0x33, 0x54, 0x65, 0x0, 0x6b, 0x4, 0x0, @local, @multicast2, {[@timestamp_addr={0x44, 0x24, 0x56, 0x1, 0x8, [{@empty, 0xfffffffb}, {@private=0xa010102, 0xeff}, {@loopback, 0x7a}, {@private=0xa010101, 0x2}]}, @end, @timestamp_prespec={0x44, 0x14, 0xe7, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0x41}, 0x1}, {@multicast1, 0xffff}]}, @ssrr={0x89, 0x7, 0x84, [@initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000c40)={'ip6tnl0\x00', &(0x7f0000000bc0)={'ip6gre0\x00', 0x0, 0x4, 0xa, 0x10, 0x2400000, 0x0, @remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}, 0x8000, 0x8, 0xffffffff, 0xf}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000d00)={'erspan0\x00', &(0x7f0000000c80)={'erspan0\x00', 0x0, 0x700, 0x8000, 0x0, 0x81, {{0xd, 0x4, 0x2, 0x1f, 0x34, 0x65, 0x0, 0x5, 0x4, 0x0, @empty, @multicast1, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x1c, 0x46, 0x1, 0x3, [{@private=0xa010102, 0x1000}, {@private=0xa010102, 0x6}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x400}]}]}}}}}) sendmsg$ETHTOOL_MSG_EEE_GET(r2, &(0x7f0000000f80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000f40)={&(0x7f0000000d40)={0x1a8, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}]}, @HEADER={0x84, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}]}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x1}, 0x40000) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, r10) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000680), r10) sendmsg$TIPC_NL_LINK_GET(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000700)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="0100000000000000a7"], 0x2c}}, 0x0) r12 = socket$alg(0x26, 0x5, 0x0) bind$alg(r12, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(anubis)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r12, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r13 = accept4(r12, 0x0, 0x0, 0x80800) recvmsg(r13, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/74, 0x4a}], 0x2}, 0x0) setsockopt$inet_tcp_TLS_TX(r13, 0x11a, 0x1, &(0x7f00000006c0)=@gcm_256={{0x303}, "83991e506ab64aa3", "d0e28596bdf5a605f295eb3b2e962b6a7e1b57658ebbad476dddf4e54c263147", "21c3abf0", "a4cd979259b2162e"}, 0x38) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r10, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x5c, 0x0, 0x0, 0x70bd2a, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x5}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x10}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000001}, 0x20004804) r14 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x12, 0x5, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000008000000001a000001000000185000000000000040000000000000009500000000001200281579a9a3c9132cc1d6557c845b8b5de0ba3d5e5fb70e32ece1ad8d760100000000000000000000000000000000000000000000000000000000008653db2b14cb137a51e319b722d1c170ca3c6e759b28b31ed021ce9c1eb1ae250f2958eda30901af4fc066ea7d"], &(0x7f0000000080)='GPL\x00', 0x3, 0x68, &(0x7f0000000100)=""/104, 0x40f00, 0x20, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x7, 0x1, 0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000003c0)=[r3, r3], 0x0, 0x10, 0x2}, 0x94) r15 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x13, &(0x7f0000000740)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r14, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r15, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 410.122182ms ago: executing program 1 (id=8663): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f00000001c0)={'wg2\x00', {0x2, 0x4e20, @local}}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x4, 0x8, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8008, 0x0, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x27}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r2, 0x0, 0xe, 0x0, &(0x7f0000000040)="0000100000000300000a6e000000", 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 296.497874ms ago: executing program 0 (id=8664): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000002600), 0xffffffffffffffff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) r2 = socket$netlink(0x10, 0x3, 0xf) bind$netlink(r2, &(0x7f0000000a40)={0x10, 0x0, 0x25dfdbfb, 0x2ffffffff}, 0xc) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000003c0)=0x6, 0xdc) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0x40d, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x99ffef750d96a51f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0600000004000000000400000f00000000000000", @ANYRES32=0x1, @ANYBLOB="730b1607000005e82d9359000000638260a6bb0f", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088008000c8004000780"], 0x34}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fffffff8850000002d00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r9, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) syz_emit_ethernet(0x7c, &(0x7f0000000000)={@broadcast, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x46, 0x2f, 0xff, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100, 0x0, 0x892f, [0x80]}, {}, {}, {0xa888}}}}}}}, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r10}, 0xc) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c, r1, 0xf21, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4044085}, 0x24008840) r11 = socket$unix(0x1, 0x1, 0x0) r12 = gettid() ioctl$sock_SIOCSPGRP(r11, 0x8902, &(0x7f0000000000)=r12) ioctl$sock_SIOCSPGRP(r11, 0x8902, &(0x7f00000000c0)) r13 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r13, &(0x7f0000000280), 0x9) 295.862245ms ago: executing program 3 (id=8665): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000000)={0xa4, 0x2, 0x1, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x1}, @CTA_NAT_SRC={0x80, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @multicast1}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @CTA_NAT_PROTO={0x4}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @local}, @CTA_NAT_V6_MINIP={0x14, 0x4, @private0}, @CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e20}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e20}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e24}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40}, 0x8080) 160.54332ms ago: executing program 1 (id=8666): unshare(0x2c020400) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) unshare(0x60600) close(0x3) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x288840, 0x0) (async, rerun: 64) accept(r0, 0x0, 0x0) (rerun: 64) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) (async) listen(r1, 0x0) (async, rerun: 64) ppoll(&(0x7f0000000000)=[{r1, 0x228}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000540)={'dummy0\x00', &(0x7f0000000200)=@ethtool_perm_addr={0x1c}}) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r2, 0x40086e81, &(0x7f00000000c0)=0x2) (async) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$sock_int(r3, 0x1, 0x22, 0x0, &(0x7f0000000040)) (async) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000200)="a10100001500add427323b470c45b4560a067fffffff81004e22000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee00000000000000000200000000", 0x1a1}], 0x1) 57.492603ms ago: executing program 4 (id=8667): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect(r0, &(0x7f0000000000)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'gcm-aes-ce\x00'}, 0x80) (async) ioctl$sock_bt_hci(r1, 0x800448d3, &(0x7f00000000c0)) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, &(0x7f0000000840)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000003c0)='\x00', 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="20000000000000008400000002000000020035007fffffff00000000d9583560b564b75d1cf429223a3564dd6eae02cfdb825e1891ab908b122ca8b5bed1a2f7f1afd4048fcb0203999e9a8a7da88716bab011350eeead4170a71c77e8ac419f00"/109, @ANYRES32=0x0], 0x20, 0x4048800}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000700)=ANY=[], 0xfc}}, 0x0) (async, rerun: 32) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000020000000000000002000000850000002000000085000000070095000000000000000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) (rerun: 32) r4 = socket$netlink(0x10, 0x3, 0x1) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r6 = epoll_create1(0x0) poll(&(0x7f0000000040)=[{r6, 0x200}], 0x1, 0xdb3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000100)) (async) shutdown(r7, 0x0) epoll_wait(r6, &(0x7f0000000000)=[{}], 0x1, 0x101) (async, rerun: 32) r8 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r8, 0x6, 0x25, &(0x7f0000000000)={0x200, 0x0, 0x4bb8, 0x965f, 0x8}, 0x14) (async) epoll_ctl$EPOLL_CTL_MOD(r6, 0x3, r7, &(0x7f0000000140)={0x2000200b}) r9 = socket$packet(0x11, 0x2, 0x300) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r5) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f00000000c0)={0xfffe, 0x2}, 0x4) (async, rerun: 32) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000380080018"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async, rerun: 32) writev(r4, &(0x7f0000000400)=[{&(0x7f00000000c0)="390000001000111867090707a640400f0021ff3f30000000170a001700000000040037000900030001632564b758b9a64411f6bb744dc48f57", 0x39}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001100)=ANY=[@ANYBLOB="ec000000210001000000000000000000fc020000000000000000000000000001fe80000000000000000000000000002000000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB], 0xec}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) connect$netlink(0xffffffffffffffff, &(0x7f00000001c0)=@unspec, 0xc) 0s ago: executing program 3 (id=8668): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000080)={r0, &(0x7f0000000100)='Ut_\xf3\xa3\xea\xee\xf7\x8c\xdb~U{$\xe2\xa9\x10\bq\x19\x88\xa6=\x1a^\x9c\xd7\t)&\xf2]\x86\xc6\xb5', 0x5a9b40, 0x0, 0xf, 0x0, 0x0}) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_int(r2, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=@newlink={0x4c, 0x10, 0x401, 0x800000, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x32d26, 0x1cdb5}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @empty}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4040014}, 0x200440c4) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xde29a62f97de33b, 0x30, r5, 0x0) r6 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') read(r6, &(0x7f0000006b80)=""/207, 0xcf) write$cgroup_int(r3, &(0x7f0000000380)=0xffffffffffff8001, 0x12) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'macvlan1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINK={0x8, 0x5, r7}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x48}}, 0x8004042) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) kernel console output (not intermixed with test programs): Q 0x0 after dequeue, screwing up backlog [ 902.408546][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.422034][ T8996] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.430272][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.518639][T25093] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.739658][T31552] nbd2: detected capacity change from 0 to 63 [ 902.746330][T31563] block nbd2: NBD_DISCONNECT [ 902.756795][T31563] block nbd2: Disconnected due to user request. [ 902.768000][T31563] block nbd2: shutting down sockets [ 902.821934][ C1] blk_print_req_error: 91 callbacks suppressed [ 902.821960][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 902.837315][ C1] buffer_io_error: 138 callbacks suppressed [ 902.837416][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 902.851136][ C1] Buffer I/O error on dev nbd2, logical block 1, async page read [ 902.858901][ C1] Buffer I/O error on dev nbd2, logical block 2, async page read [ 902.866705][ C1] Buffer I/O error on dev nbd2, logical block 3, async page read [ 902.896020][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 902.905510][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 902.931367][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 902.940994][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 902.950379][ T25] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 902.960383][ T25] Buffer I/O error on dev nbd2, logical block 2, async page read [ 902.968289][ T25] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 902.977768][ T25] Buffer I/O error on dev nbd2, logical block 3, async page read [ 902.985971][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 902.995342][ T25] Buffer I/O error on dev nbd2, logical block 0, async page read [ 903.003643][ T25] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 903.013122][ T25] Buffer I/O error on dev nbd2, logical block 1, async page read [ 903.021318][ T25] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 903.030697][T31581] xt_HMARK: spi-set and port-set can't be combined [ 903.030784][ T25] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 903.050215][ T25] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 903.062275][T26728] ldm_validate_partition_table(): Disk read failed. [ 903.081101][T26728] Dev nbd2: unable to read RDB block 0 [ 903.090055][T26728] nbd2: unable to read partition table [ 903.157479][T26728] ldm_validate_partition_table(): Disk read failed. [ 903.164775][T31588] netlink: 'syz.2.7549': attribute type 1 has an invalid length. [ 903.186651][T26728] Dev nbd2: unable to read RDB block 0 [ 903.194466][T26728] nbd2: unable to read partition table [ 903.248066][T31588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 903.329097][T31593] bond0: (slave veth0_to_bond): making interface the new active one [ 903.384850][T31593] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 903.500418][T31588] bond0: entered promiscuous mode [ 903.511886][T31588] veth0_to_bond: entered promiscuous mode [ 903.518720][T31594] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7550'. [ 903.524427][T31588] bond0: entered allmulticast mode [ 903.533346][T31588] veth0_to_bond: entered allmulticast mode [ 904.278307][T31630] netlink: 236 bytes leftover after parsing attributes in process `syz.1.7560'. [ 904.313819][T31630] netlink: 236 bytes leftover after parsing attributes in process `syz.1.7560'. [ 904.505397][T31638] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7561'. [ 904.506563][T31641] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7562'. [ 904.601341][T31644] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7563'. [ 904.617334][T31644] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7563'. [ 904.637912][T31648] FAULT_INJECTION: forcing a failure. [ 904.637912][T31648] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 904.640033][T31644] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 904.650954][T31648] CPU: 0 UID: 0 PID: 31648 Comm: syz.1.7564 Not tainted syzkaller #0 PREEMPT(full) [ 904.650977][T31648] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 904.650988][T31648] Call Trace: [ 904.650997][T31648] [ 904.651005][T31648] dump_stack_lvl+0xe8/0x150 [ 904.651037][T31648] should_fail_ex+0x40c/0x560 [ 904.651069][T31648] strncpy_from_user+0x36/0x2c0 [ 904.651099][T31648] strncpy_from_user_nofault+0x71/0x150 [ 904.651125][T31648] bpf_probe_read_user_str+0x2a/0x70 [ 904.651153][T31648] ? bpf_test_run+0x1d1/0x830 [ 904.651176][T31648] bpf_prog_87cec7ba8eab3a61+0x46/0x4c [ 904.651196][T31648] bpf_test_run+0x354/0x830 [ 904.651238][T31648] ? __pfx_bpf_test_run+0x10/0x10 [ 904.651284][T31648] ? convert___skb_to_skb+0x3d/0x5b0 [ 904.651310][T31648] bpf_prog_test_run_skb+0xe35/0x2230 [ 904.651352][T31648] ? __fget_files+0x3a2/0x420 [ 904.651375][T31648] ? __fget_files+0x2a/0x420 [ 904.651401][T31648] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 904.651425][T31648] bpf_prog_test_run+0x2c5/0x340 [ 904.651454][T31648] __sys_bpf+0xa22/0xd90 [ 904.651486][T31648] ? __pfx___sys_bpf+0x10/0x10 [ 904.651519][T31648] ? __fget_files+0x2a/0x420 [ 904.651558][T31648] ? ksys_write+0x242/0x270 [ 904.651588][T31648] ? __pfx_ksys_write+0x10/0x10 [ 904.651619][T31648] __x64_sys_bpf+0xba/0xd0 [ 904.651641][T31648] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.651662][T31648] do_syscall_64+0x174/0x580 [ 904.651682][T31648] ? trace_irq_disable+0x3b/0x140 [ 904.651704][T31648] ? clear_bhb_loop+0x40/0x90 [ 904.651727][T31648] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 904.651745][T31648] RIP: 0033:0x7fd9c4d9de59 [ 904.651763][T31648] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 904.651787][T31648] RSP: 002b:00007fd9c5c24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 904.651806][T31648] RAX: ffffffffffffffda RBX: 00007fd9c5025fa0 RCX: 00007fd9c4d9de59 [ 904.651820][T31648] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 904.651832][T31648] RBP: 00007fd9c5c24090 R08: 0000000000000000 R09: 0000000000000000 [ 904.651844][T31648] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 904.651855][T31648] R13: 00007fd9c5026038 R14: 00007fd9c5025fa0 R15: 00007ffdd00db6b8 [ 904.651885][T31648] [ 904.736109][T31653] netlink: 112 bytes leftover after parsing attributes in process `syz.1.7566'. [ 904.907854][T31658] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7567'. [ 905.580188][T25093] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 906.873450][T31615] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 907.177211][T31665] syzkaller1: entered promiscuous mode [ 907.189270][T31665] syzkaller1: entered allmulticast mode [ 907.222677][T31665] syzkaller1: left promiscuous mode [ 907.238943][T31665] syzkaller1: left allmulticast mode [ 907.247835][ T9004] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 907.266066][ T9004] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 907.982384][ T8990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.990799][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.000492][T17374] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.010458][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 908.247156][T31699] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 908.261474][T30582] IPVS: starting estimator thread 0... [ 908.276797][T31697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7578'. [ 908.360307][T31706] netlink: 'syz.2.7579': attribute type 1 has an invalid length. [ 908.384234][T31697] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 908.399964][T31701] IPVS: using max 31 ests per chain, 74400 per kthread [ 908.501225][T31706] 8021q: adding VLAN 0 to HW filter on device bond1 [ 908.553777][T31714] netlink: 'syz.0.7581': attribute type 10 has an invalid length. [ 908.565423][T31714] team0: Port device dummy0 added [ 909.033523][T31745] netlink: 'syz.4.7588': attribute type 7 has an invalid length. [ 909.045964][T31744] syzkaller0: entered promiscuous mode [ 909.073808][T31744] syzkaller0: entered allmulticast mode [ 909.085607][T31744] __nla_validate_parse: 1 callbacks suppressed [ 909.085622][T31744] netlink: 96 bytes leftover after parsing attributes in process `syz.1.7591'. [ 909.222898][T31756] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7595'. [ 909.643206][T31772] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7595'. [ 909.769466][T31779] netlink: 'syz.4.7601': attribute type 2 has an invalid length. [ 909.805015][T31779] netlink: 14 bytes leftover after parsing attributes in process `syz.4.7601'. [ 909.848744][T31779] bridge0: port 3(dummy0) entered disabled state [ 909.859338][T31779] bridge0: port 3(dummy0) entered disabled state [ 909.991190][ T9002] wlan1: Trigger new scan to find an IBSS to join [ 910.338058][T31798] openvswitch: netlink: Duplicate key (type 6). [ 910.354098][T31798] netlink: 240 bytes leftover after parsing attributes in process `syz.4.7608'. [ 910.364012][T31798] netlink: 'syz.4.7608': attribute type 9 has an invalid length. [ 910.542504][T31800] netlink: 76 bytes leftover after parsing attributes in process `syz.2.7610'. [ 910.550459][ T1669] block nbd3: Possible stuck request ffff888028750000: control (read@0,1024B). Runtime 180 seconds [ 910.643491][T31802] syzkaller1: entered promiscuous mode [ 910.668108][T31802] syzkaller1: entered allmulticast mode [ 911.009275][T31807] sock: sock_timestamping_bind_phc: sock not bind to device [ 911.054039][T31810] netlink: 260 bytes leftover after parsing attributes in process `syz.1.7617'. [ 911.117666][T31814] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7616'. [ 911.191596][T31816] IPVS: Unknown mcast interface: vcan0 [ 911.205325][T31816] netlink: 220 bytes leftover after parsing attributes in process `syz.4.7618'. [ 911.282623][T31819] ipt_REJECT: TCP_RESET invalid for non-tcp [ 912.035270][T31841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7625'. [ 912.037481][T31837] bridge0: port 1(vlan2) entered blocking state [ 912.051655][T31837] bridge0: port 1(vlan2) entered disabled state [ 912.058052][T31837] vlan2: entered allmulticast mode [ 912.065367][T31837] dummy0: entered allmulticast mode [ 912.072468][T31837] vlan2: entered promiscuous mode [ 912.077513][T31837] dummy0: entered promiscuous mode [ 912.612358][ T4992] udevd[4992]: worker [26098] /devices/virtual/block/nbd3 timeout; kill it [ 912.621079][ T4992] udevd[4992]: seq 31471 '/devices/virtual/block/nbd3' killed [ 912.954390][T17374] wlan1: Trigger new scan to find an IBSS to join [ 913.137944][T31867] lo speed is unknown, defaulting to 1000 [ 913.475019][T31879] pimreg: tun_chr_ioctl cmd 2147767520 [ 913.553452][T31881] lo speed is unknown, defaulting to 1000 [ 913.570463][T31881] lo speed is unknown, defaulting to 1000 [ 913.618143][T31881] lo speed is unknown, defaulting to 1000 [ 913.624871][T31881] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 913.639033][T31881] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 913.689453][T31881] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 913.782411][T31881] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 913.811311][T31881] lo speed is unknown, defaulting to 1000 [ 913.819775][T31881] lo speed is unknown, defaulting to 1000 [ 913.841943][T31881] lo speed is unknown, defaulting to 1000 [ 913.858357][T31881] lo speed is unknown, defaulting to 1000 [ 913.866161][T31881] lo speed is unknown, defaulting to 1000 [ 913.873825][T31881] lo speed is unknown, defaulting to 1000 [ 913.881754][T31881] lo speed is unknown, defaulting to 1000 [ 913.889229][T31881] lo speed is unknown, defaulting to 1000 [ 913.897038][T31881] lo speed is unknown, defaulting to 1000 [ 913.906702][T31881] lo speed is unknown, defaulting to 1000 [ 913.914513][T31881] lo speed is unknown, defaulting to 1000 [ 914.138240][T31891] __nla_validate_parse: 2 callbacks suppressed [ 914.138281][T31891] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7639'. [ 914.944409][ T8990] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 915.119773][T31919] bridge0: port 1(veth0) entered blocking state [ 915.127760][T31919] bridge0: port 1(veth0) entered disabled state [ 915.134724][T31919] veth0: entered allmulticast mode [ 915.142182][T31919] veth0: entered promiscuous mode [ 915.201757][T31920] syzkaller1: entered promiscuous mode [ 915.218176][T31920] syzkaller1: entered allmulticast mode [ 915.268996][T31923] sctp: [Deprecated]: syz.0.7651 (pid 31923) Use of int in max_burst socket option deprecated. [ 915.268996][T31923] Use struct sctp_assoc_value instead [ 915.280120][T31924] nbd: must specify a size in bytes for the device [ 915.445833][T31930] netlink: 830 bytes leftover after parsing attributes in process `syz.4.7654'. [ 915.730594][T31949] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7661'. [ 915.739580][T31949] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 915.767514][T31949] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 915.845946][T31954] bridge0: port 2(bridge_slave_1) entered disabled state [ 915.897260][T31954] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 915.949833][T31954] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 916.183949][T31954] veth0_vlan: left promiscuous mode [ 916.391262][T17374] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 916.437864][T17374] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.465378][T17374] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 916.518870][T17374] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.570681][T17374] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 916.591842][T17374] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.646636][T17374] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 916.662583][T17374] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.693852][T31986] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7666'. [ 916.730845][T31987] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7667'. [ 916.739737][T31987] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7667'. [ 916.937248][T31995] tipc: Enabling of bearer rejected, failed to enable media [ 917.041477][T32006] netlink: 16170 bytes leftover after parsing attributes in process `syz.4.7670'. [ 917.180039][T32009] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7672'. [ 917.982708][T32039] bond4: option primary_reselect: invalid value (6) [ 918.036140][T32039] bond4 (unregistering): Released all slaves [ 918.375815][T32048] ip6tnl1: entered allmulticast mode [ 918.592324][T32069] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 918.757893][ T30] audit: type=1804 audit(1783022930.241:21): pid=32083 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.7682" name="/newroot/328/cgroup.controllers" dev="tmpfs" ino=1688 res=1 errno=0 [ 918.843679][T32080] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7686'. [ 918.896922][ T30] audit: type=1800 audit(1783022930.241:22): pid=32083 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7682" name="cgroup.controllers" dev="tmpfs" ino=1688 res=0 errno=0 [ 918.943271][T32090] netlink: 164 bytes leftover after parsing attributes in process `syz.1.7687'. [ 919.006570][ T8990] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 919.036505][ T5742] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 919.046847][ T8990] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 919.295477][T32106] FAULT_INJECTION: forcing a failure. [ 919.295477][T32106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 919.316695][T32100] netlink: 'syz.3.7690': attribute type 1 has an invalid length. [ 919.325233][T32106] CPU: 1 UID: 0 PID: 32106 Comm: syz.2.7691 Not tainted syzkaller #0 PREEMPT(full) [ 919.325257][T32106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 919.325268][T32106] Call Trace: [ 919.325276][T32106] [ 919.325284][T32106] dump_stack_lvl+0xe8/0x150 [ 919.325324][T32106] should_fail_ex+0x40c/0x560 [ 919.325355][T32106] _copy_from_iter+0x1d3/0x1660 [ 919.325374][T32106] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 919.325406][T32106] ? __pfx_policy_nodemask+0x10/0x10 [ 919.325432][T32106] ? unwind_next_frame+0x8f/0x2550 [ 919.325452][T32106] ? __pfx__copy_from_iter+0x10/0x10 [ 919.325471][T32106] ? alloc_pages_mpol+0x24a/0x380 [ 919.325499][T32106] copy_page_from_iter+0x219/0x2d0 [ 919.325519][T32106] tun_get_user+0x1bf1/0x4370 [ 919.325537][T32106] ? tun_get_user+0x6e7/0x4370 [ 919.325565][T32106] ? aa_file_perm+0x4ed/0x15f0 [ 919.325586][T32106] ? __pfx_tun_get_user+0x10/0x10 [ 919.325604][T32106] ? __lock_acquire+0x683/0x2cf0 [ 919.325635][T32106] ? ref_tracker_alloc+0x341/0x4b0 [ 919.325649][T32106] ? get_pid_task+0x20/0x1f0 [ 919.325670][T32106] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 919.325687][T32106] ? tun_get+0x1c/0x2f0 [ 919.325702][T32106] ? tun_get+0x1c/0x2f0 [ 919.325721][T32106] ? tun_get+0x1c/0x2f0 [ 919.325736][T32106] ? tun_get+0x1c/0x2f0 [ 919.325754][T32106] tun_chr_write_iter+0x113/0x200 [ 919.325772][T32106] vfs_write+0x612/0xba0 [ 919.325801][T32106] ? __pfx_vfs_write+0x10/0x10 [ 919.325831][T32106] ? __fget_files+0x2a/0x420 [ 919.325856][T32106] ksys_write+0x150/0x270 [ 919.325880][T32106] ? __pfx_ksys_write+0x10/0x10 [ 919.325908][T32106] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.325925][T32106] do_syscall_64+0x174/0x580 [ 919.325941][T32106] ? trace_irq_disable+0x3b/0x140 [ 919.325960][T32106] ? clear_bhb_loop+0x40/0x90 [ 919.325979][T32106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 919.325994][T32106] RIP: 0033:0x7f4690d5e68e [ 919.326009][T32106] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 919.326023][T32106] RSP: 002b:00007f4691d32fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 919.326040][T32106] RAX: ffffffffffffffda RBX: 00007f4691d336c0 RCX: 00007f4690d5e68e [ 919.326051][T32106] RDX: 000000000000006e RSI: 00002000000003c0 RDI: 00000000000000c8 [ 919.326061][T32106] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 919.326071][T32106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 919.326080][T32106] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 919.326105][T32106] [ 919.666892][ T5782] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 919.710536][T32124] x_tables: ip_tables: tcp match: only valid for protocol 6 [ 920.059873][ T5782] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 920.173162][T32142] netlink: ct family unspecified [ 920.194268][T32142] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 920.484873][T32167] sctp: [Deprecated]: syz.0.7701 (pid 32167) Use of int in max_burst socket option deprecated. [ 920.484873][T32167] Use struct sctp_assoc_value instead [ 921.187042][T32187] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7705'. [ 921.469105][T32198] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7708'. [ 921.485624][T32206] netlink: 'syz.3.7710': attribute type 1 has an invalid length. [ 922.076144][T32238] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7718'. [ 922.078645][T32235] bond6: option lacp_rate: invalid value (128) [ 922.168364][T32235] bond6 (unregistering): Released all slaves [ 922.185691][T32238] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7718'. [ 922.480694][T32250] bond4: option min_links: invalid value (18446744073709551612) [ 922.495399][T32250] bond4: option min_links: allowed values 0 - 2147483647 [ 922.504005][T32250] bond4 (unregistering): Released all slaves [ 922.629175][T32263] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 922.702345][T32263] tipc: Enabled bearer , priority 10 [ 922.812683][T32268] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.7728'. [ 922.822555][T32268] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 923.179773][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 923.435925][T32302] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7741'. [ 923.587965][T32308] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7742'. [ 923.596884][T32308] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7742'. [ 923.699532][T32314] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7745'. [ 923.710167][T32314] netlink: 'syz.1.7745': attribute type 6 has an invalid length. [ 923.719077][T32314] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 923.884939][ T8996] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 923.895910][T32329] netlink: 'syz.1.7750': attribute type 1 has an invalid length. [ 923.908943][T32316] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 924.129568][T32334] netlink: 'syz.4.7753': attribute type 1 has an invalid length. [ 924.149132][T32334] netlink: 92 bytes leftover after parsing attributes in process `syz.4.7753'. [ 924.184828][T32332] syzkaller0: entered promiscuous mode [ 924.191821][T32332] syzkaller0: entered allmulticast mode [ 925.457374][T32358] FAULT_INJECTION: forcing a failure. [ 925.457374][T32358] name failslab, interval 1, probability 0, space 0, times 0 [ 925.470304][T32358] CPU: 1 UID: 0 PID: 32358 Comm: syz.0.7761 Not tainted syzkaller #0 PREEMPT(full) [ 925.470346][T32358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 925.470369][T32358] Call Trace: [ 925.470382][T32358] [ 925.470391][T32358] dump_stack_lvl+0xe8/0x150 [ 925.470426][T32358] should_fail_ex+0x40c/0x560 [ 925.470460][T32358] should_failslab+0xa8/0x100 [ 925.470490][T32358] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 925.470513][T32358] ? local_lock_release+0x9c/0x160 [ 925.470536][T32358] ? __alloc_skb+0x1d7/0x7a0 [ 925.470555][T32358] ? __alloc_skb+0x1d7/0x7a0 [ 925.470581][T32358] __alloc_skb+0x1d7/0x7a0 [ 925.470606][T32358] alloc_skb_with_frags+0xc6/0x760 [ 925.470639][T32358] sock_alloc_send_pskb+0x878/0x990 [ 925.470680][T32358] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 925.470703][T32358] ? kasan_quarantine_put+0xbb/0x1f0 [ 925.470727][T32358] ? lockdep_hardirqs_on+0x7a/0x110 [ 925.470753][T32358] ? unix_dgram_sendmsg+0x5d7/0x17b0 [ 925.470776][T32358] ? kmem_cache_free+0x182/0x650 [ 925.470802][T32358] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x20 [ 925.470827][T32358] unix_dgram_sendmsg+0x4da/0x17b0 [ 925.470850][T32358] ? __lock_acquire+0x683/0x2cf0 [ 925.470881][T32358] ? __lock_acquire+0x683/0x2cf0 [ 925.470909][T32358] ? __lock_acquire+0x683/0x2cf0 [ 925.470933][T32358] ? __pfx_unix_dgram_sendmsg+0x10/0x10 [ 925.470963][T32358] ? aa_sock_msg_perm+0xda/0x1b0 [ 925.470989][T32358] ? unix_seqpacket_sendmsg+0x111/0x1e0 [ 925.471016][T32358] ? __pfx_unix_seqpacket_sendmsg+0x10/0x10 [ 925.471039][T32358] sock_sendmsg_nosec+0x13a/0x180 [ 925.471069][T32358] ____sys_sendmsg+0x54e/0x850 [ 925.471097][T32358] ? __pfx_____sys_sendmsg+0x10/0x10 [ 925.471127][T32358] ? import_iovec+0x73/0xa0 [ 925.471152][T32358] ___sys_sendmsg+0x2a5/0x360 [ 925.471185][T32358] ? __lock_acquire+0x683/0x2cf0 [ 925.471213][T32358] ? __pfx____sys_sendmsg+0x10/0x10 [ 925.471233][T32358] ? __lock_acquire+0x683/0x2cf0 [ 925.471262][T32358] ? kstrtouint+0x6e/0xe0 [ 925.471327][T32358] __sys_sendmmsg+0x273/0x4d0 [ 925.471354][T32358] ? __pfx___sys_sendmmsg+0x10/0x10 [ 925.471386][T32358] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 925.471420][T32358] ? ksys_write+0x242/0x270 [ 925.471449][T32358] ? __pfx_ksys_write+0x10/0x10 [ 925.471481][T32358] __x64_sys_sendmmsg+0xa0/0xc0 [ 925.471504][T32358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.471523][T32358] do_syscall_64+0x174/0x580 [ 925.471546][T32358] ? trace_irq_disable+0x3b/0x140 [ 925.471569][T32358] ? clear_bhb_loop+0x40/0x90 [ 925.471592][T32358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 925.471611][T32358] RIP: 0033:0x7f545939de59 [ 925.471629][T32358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 925.471646][T32358] RSP: 002b:00007f545a2ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 925.471666][T32358] RAX: ffffffffffffffda RBX: 00007f5459625fa0 RCX: 00007f545939de59 [ 925.471680][T32358] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 925.471693][T32358] RBP: 00007f545a2ae090 R08: 0000000000000000 R09: 0000000000000000 [ 925.471705][T32358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 925.471716][T32358] R13: 00007f5459626038 R14: 00007f5459625fa0 R15: 00007fff9ecfb858 [ 925.471747][T32358] [ 928.429257][T32371] __nla_validate_parse: 2 callbacks suppressed [ 928.429274][T32371] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7763'. [ 928.622352][T32384] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7768'. [ 928.722742][T32388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7772'. [ 928.732275][T32388] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 929.052307][T32410] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7779'. [ 929.158900][T32413] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7780'. [ 929.180628][T19785] IPVS: ip_vs_send_async error -101 [ 929.307539][T32416] gretap1: entered promiscuous mode [ 929.813166][T32420] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7783'. [ 930.035299][T32423] lo speed is unknown, defaulting to 1000 [ 930.478162][T32423] lo speed is unknown, defaulting to 1000 [ 930.521117][T32435] netlink: 48 bytes leftover after parsing attributes in process `syz.1.7788'. [ 930.751668][T32444] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7789'. [ 931.019700][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 931.271909][T32452] ip6tnl4: entered allmulticast mode [ 931.704705][T32461] netlink: 'syz.1.7795': attribute type 1 has an invalid length. [ 931.772712][T32461] 8021q: adding VLAN 0 to HW filter on device bond4 [ 931.790154][T32461] bond4: (slave veth0_to_bond): making interface the new active one [ 931.799462][T32461] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 931.840009][T32461] macvlan4: entered promiscuous mode [ 931.845318][T32461] macvlan4: entered allmulticast mode [ 931.851357][T32461] bond4: entered promiscuous mode [ 931.856398][T32461] veth0_to_bond: entered promiscuous mode [ 931.863099][T32461] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 931.900942][T32461] bond4: (slave macvlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 931.916991][T32461] bond4: left promiscuous mode [ 931.921769][T32461] veth0_to_bond: left promiscuous mode [ 932.192023][T32471] syzkaller0: entered promiscuous mode [ 932.197564][T32471] syzkaller0: entered allmulticast mode [ 932.803748][T32485] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7802'. [ 932.933863][T32492] lo speed is unknown, defaulting to 1000 [ 932.936069][T32488] tipc: Enabled bearer , priority 0 [ 933.035458][T32488] syzkaller0: entered promiscuous mode [ 933.040965][T32488] syzkaller0: entered allmulticast mode [ 933.047179][T32488] tipc: Resetting bearer [ 933.074672][T32487] tipc: Resetting bearer [ 933.295523][T32494] xt_hashlimit: size too large, truncated to 1048576 [ 934.376666][T32536] netlink: 'syz.2.7812': attribute type 1 has an invalid length. [ 936.640237][T32487] tipc: Disabling bearer [ 936.662290][T32492] lo speed is unknown, defaulting to 1000 [ 936.669029][T32536] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 936.895306][T32546] netlink: 64 bytes leftover after parsing attributes in process `syz.3.7814'. [ 936.934554][T32548] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7815'. [ 937.213551][T32562] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7818'. [ 937.244655][T32562] netlink: 148 bytes leftover after parsing attributes in process `syz.1.7818'. [ 937.272825][T32562] netlink: 116 bytes leftover after parsing attributes in process `syz.1.7818'. [ 937.290117][T32562] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7818'. [ 937.767057][T32571] lo speed is unknown, defaulting to 1000 [ 938.375101][T32590] lo speed is unknown, defaulting to 1000 [ 938.416291][T32594] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7827'. [ 938.614954][T32600] tipc: Enabled bearer , priority 0 [ 938.668452][T32571] lo speed is unknown, defaulting to 1000 [ 939.019706][ T50] Bluetooth: hci1: command 0x0405 tx timeout [ 939.035855][T32605] netlink: 'syz.3.7831': attribute type 4 has an invalid length. [ 939.148388][T32591] tipc: Disabling bearer [ 939.235490][T32590] lo speed is unknown, defaulting to 1000 [ 939.526851][T32624] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7837'. [ 939.558522][T32626] netlink: 148 bytes leftover after parsing attributes in process `syz.1.7838'. [ 939.618677][T32629] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7838'. [ 939.636337][T32631] netlink: 'syz.0.7836': attribute type 4 has an invalid length. [ 939.650192][T32629] netlink: 'syz.1.7838': attribute type 1 has an invalid length. [ 939.688881][T32629] macvlan4: entered allmulticast mode [ 939.699634][T32629] gretap0: entered allmulticast mode [ 940.575435][T32661] netdevsim netdevsim3: loading /lib/firmware/. failed with error -22 [ 940.584044][T32661] netdevsim netdevsim3: Direct firmware load for . failed with error -22 [ 940.592471][T32661] netdevsim netdevsim3: Falling back to sysfs fallback for: . [ 940.634348][ T1669] block nbd3: Possible stuck request ffff888028750000: control (read@0,1024B). Runtime 210 seconds [ 941.013111][T32681] syzkaller0: entered promiscuous mode [ 941.018634][T32681] syzkaller0: entered allmulticast mode [ 944.043446][T32697] bridge_slave_0: left allmulticast mode [ 944.070152][T32697] bridge_slave_0: left promiscuous mode [ 944.089937][T32697] bridge0: port 1(bridge_slave_0) entered disabled state [ 944.157575][T32697] bridge_slave_1: left allmulticast mode [ 944.188513][T32697] bridge_slave_1: left promiscuous mode [ 944.237172][T32697] bridge0: port 2(bridge_slave_1) entered disabled state [ 944.256767][T32697] bond0: (slave bond_slave_0): Releasing backup interface [ 944.265465][T32697] bond0: (slave bond_slave_1): Releasing backup interface [ 944.274169][T32697] team0: Port device team_slave_0 removed [ 944.282201][T32697] team0: Port device team_slave_1 removed [ 944.288131][T32697] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 944.295667][T32697] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 944.323475][T32713] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7861'. [ 944.343000][T32697] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 944.367511][T32711] netlink: 56 bytes leftover after parsing attributes in process `syz.4.7860'. [ 944.376460][T32711] netlink: 19 bytes leftover after parsing attributes in process `syz.4.7860'. [ 944.385878][T32711] netlink: 19 bytes leftover after parsing attributes in process `syz.4.7860'. [ 944.677833][T32729] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7864'. [ 944.792513][T32735] 8021q: adding VLAN 0 to HW filter on device bond5 [ 944.875961][T32741] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7865'. [ 944.899792][T32741] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7865'. [ 945.030221][T32741] geneve2: entered promiscuous mode [ 945.283999][T32751] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7871'. [ 945.419006][T32761] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7873'. [ 945.688881][ T8996] team0: Port device bridge2 removed [ 945.727425][ T8996] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 945.766559][ T8996] bond0 (unregistering): Released all slaves [ 945.781118][ T8996] bond1 (unregistering): Released all slaves [ 945.801118][ T8996] bond2 (unregistering): Released all slaves [ 945.931880][ T8996] bond3 (unregistering): Released all slaves [ 945.950615][ T8996] bond4 (unregistering): Released all slaves [ 945.970431][ T8996] bond5 (unregistering): Released all slaves [ 946.002643][ T8996] bond6 (unregistering): Released all slaves [ 946.028699][ T8996] bond7 (unregistering): Released all slaves [ 946.056144][ T8996] bond9 (unregistering): Released all slaves [ 946.128469][T32751] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 946.235449][ T301] lo speed is unknown, defaulting to 1000 [ 946.379584][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 946.471264][ T8996] : left promiscuous mode [ 946.715026][ T8996] tipc: Left network mode [ 946.760595][ T326] netlink: 'syz.0.7879': attribute type 1 has an invalid length. [ 946.883952][ T335] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7880'. [ 946.901187][ T8996] IPVS: stopping master sync thread 19785 ... [ 947.565478][ T301] lo speed is unknown, defaulting to 1000 [ 947.850769][ T358] ipvlan2: entered promiscuous mode [ 949.056087][ T389] bond6: entered promiscuous mode [ 949.061522][ T389] 8021q: adding VLAN 0 to HW filter on device bond6 [ 949.470174][ T8996] hsr_slave_0: left promiscuous mode [ 949.514143][ T8996] hsr_slave_1: left promiscuous mode [ 949.571946][ T8996] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 949.687896][ T8996] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 949.695952][ T8996] batman_adv: batadv0: Removing interface: dummy0 [ 949.720942][ T417] __nla_validate_parse: 4 callbacks suppressed [ 949.720959][ T417] netlink: 104 bytes leftover after parsing attributes in process `syz.2.7902'. [ 950.368269][ T8996] team0 (unregistering): Port device team_slave_1 removed [ 950.417993][ T8996] team0 (unregistering): Port device team_slave_0 removed [ 950.677258][ T417] veth0_to_bond: Caught tx_queue_len zero misconfig [ 950.990109][ T449] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7908'. [ 951.038120][ T449] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7908'. [ 951.400481][ T469] FAULT_INJECTION: forcing a failure. [ 951.400481][ T469] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 951.440827][ T469] CPU: 0 UID: 0 PID: 469 Comm: syz.2.7913 Not tainted syzkaller #0 PREEMPT(full) [ 951.440852][ T469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 951.440864][ T469] Call Trace: [ 951.440872][ T469] [ 951.440881][ T469] dump_stack_lvl+0xe8/0x150 [ 951.440915][ T469] should_fail_ex+0x40c/0x560 [ 951.440950][ T469] _copy_from_iter+0x1d3/0x1660 [ 951.440977][ T469] ? _copy_from_iter+0x21b/0x1660 [ 951.441000][ T469] ? __pfx__copy_from_iter+0x10/0x10 [ 951.441025][ T469] ? __pfx__copy_from_iter+0x10/0x10 [ 951.441059][ T469] copy_page_from_iter+0x219/0x2d0 [ 951.441084][ T469] skb_copy_datagram_from_iter+0x2f4/0x720 [ 951.441123][ T469] tun_get_user+0x1520/0x4370 [ 951.441159][ T469] ? aa_file_perm+0x18b/0x15f0 [ 951.441190][ T469] ? aa_file_perm+0x4ed/0x15f0 [ 951.441217][ T469] ? __pfx_tun_get_user+0x10/0x10 [ 951.441240][ T469] ? __lock_acquire+0x683/0x2cf0 [ 951.441269][ T469] ? kstrtoull+0x12f/0x1d0 [ 951.441304][ T469] ? ref_tracker_alloc+0x341/0x4b0 [ 951.441323][ T469] ? get_pid_task+0x20/0x1f0 [ 951.441351][ T469] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 951.441372][ T469] ? tun_get+0x1c/0x2f0 [ 951.441392][ T469] ? tun_get+0x1c/0x2f0 [ 951.441418][ T469] ? tun_get+0x1c/0x2f0 [ 951.441437][ T469] ? tun_get+0x1c/0x2f0 [ 951.441461][ T469] tun_chr_write_iter+0x113/0x200 [ 951.441484][ T469] vfs_write+0x612/0xba0 [ 951.441521][ T469] ? __pfx_vfs_write+0x10/0x10 [ 951.441558][ T469] ? __fget_files+0x2a/0x420 [ 951.441591][ T469] ksys_write+0x150/0x270 [ 951.441621][ T469] ? __pfx_ksys_write+0x10/0x10 [ 951.441657][ T469] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.441679][ T469] do_syscall_64+0x174/0x580 [ 951.441699][ T469] ? trace_irq_disable+0x3b/0x140 [ 951.441723][ T469] ? clear_bhb_loop+0x40/0x90 [ 951.441747][ T469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 951.441766][ T469] RIP: 0033:0x7f4690d5e68e [ 951.441785][ T469] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 951.441801][ T469] RSP: 002b:00007f4691d11fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 951.441822][ T469] RAX: ffffffffffffffda RBX: 00007f4691d126c0 RCX: 00007f4690d5e68e [ 951.441836][ T469] RDX: 000000000002dc2d RSI: 0000200000000300 RDI: 00000000000000c8 [ 951.441849][ T469] RBP: 00007f4691d12090 R08: 0000000000000000 R09: 0000000000000000 [ 951.441861][ T469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 951.441873][ T469] R13: 00007f4691026128 R14: 00007f4691026090 R15: 00007fff0c486108 [ 951.441905][ T469] [ 952.179649][ T490] xt_hashlimit: size too large, truncated to 1048576 [ 952.324579][ T498] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7921'. [ 952.358100][ T497] netlink: 200 bytes leftover after parsing attributes in process `syz.0.7925'. [ 952.432901][ T498] 8021q: adding VLAN 0 to HW filter on device bond2 [ 952.512367][ T8996] IPVS: stop unused estimator thread 0... [ 952.729189][ T516] syz_tun: entered allmulticast mode [ 952.736494][T25093] IPVS: starting estimator thread 0... [ 952.816174][ T520] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7932'. [ 952.839649][ T517] IPVS: using max 28 ests per chain, 67200 per kthread [ 953.017211][ T531] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7937'. [ 953.401992][ T545] netlink: 'syz.2.7939': attribute type 2 has an invalid length. [ 953.411386][ T545] netlink: 'syz.2.7939': attribute type 2 has an invalid length. [ 953.419126][ T545] netlink: 1347 bytes leftover after parsing attributes in process `syz.2.7939'. [ 953.475346][ T541] xt_CT: No such helper "netbios-ns" [ 953.483526][ T541] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7939'. [ 953.499973][ T541] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7939'. [ 954.023290][ T577] openvswitch: netlink: IPv6 tunnel dst address is zero [ 954.121382][ T580] lo speed is unknown, defaulting to 1000 [ 954.491997][ T580] lo speed is unknown, defaulting to 1000 [ 954.518158][ T594] netlink: 'syz.2.7953': attribute type 9 has an invalid length. [ 954.574478][ T600] xt_hashlimit: size too large, truncated to 1048576 [ 954.893221][ T616] netlink: 'syz.4.7961': attribute type 2 has an invalid length. [ 955.647095][ T635] netlink: 'syz.3.7969': attribute type 1 has an invalid length. [ 955.751072][ T635] bond6 (unregistering): Released all slaves [ 955.806400][ T639] __nla_validate_parse: 6 callbacks suppressed [ 955.806417][ T639] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7969'. [ 956.577392][ T672] FAULT_INJECTION: forcing a failure. [ 956.577392][ T672] name failslab, interval 1, probability 0, space 0, times 0 [ 956.591619][ T672] CPU: 0 UID: 0 PID: 672 Comm: syz.0.7981 Not tainted syzkaller #0 PREEMPT(full) [ 956.591643][ T672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 956.591654][ T672] Call Trace: [ 956.591663][ T672] [ 956.591671][ T672] dump_stack_lvl+0xe8/0x150 [ 956.591705][ T672] should_fail_ex+0x40c/0x560 [ 956.591740][ T672] should_failslab+0xa8/0x100 [ 956.591769][ T672] __kmalloc_cache_noprof+0xa8/0x660 [ 956.591793][ T672] ? __kmalloc_cache_noprof+0x150/0x660 [ 956.591815][ T672] ? sctp_add_bind_addr+0x8c/0x370 [ 956.591842][ T672] ? sctp_add_bind_addr+0x8c/0x370 [ 956.591877][ T672] sctp_add_bind_addr+0x8c/0x370 [ 956.591910][ T672] sctp_copy_local_addr_list+0x31a/0x4e0 [ 956.591942][ T672] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 956.591972][ T672] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 956.592005][ T672] ? sctp_copy_one_addr+0x93/0x360 [ 956.592039][ T672] sctp_bind_addr_copy+0xb3/0x3c0 [ 956.592068][ T672] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 956.592099][ T672] sctp_connect_new_asoc+0x2ff/0x6b0 [ 956.592124][ T672] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 956.592148][ T672] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 956.592171][ T672] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 956.592191][ T672] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 956.592213][ T672] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 956.592235][ T672] ? security_sctp_bind_connect+0x7e/0x2c0 [ 956.592260][ T672] sctp_sendmsg+0x159b/0x2d00 [ 956.592297][ T672] ? __pfx_sctp_sendmsg+0x10/0x10 [ 956.592324][ T672] ? aa_sk_perm+0x6d5/0x900 [ 956.592353][ T672] ? __might_fault+0xaf/0x130 [ 956.592378][ T672] ? sock_rps_record_flow+0x19/0x350 [ 956.592402][ T672] ? inet_sendmsg+0x298/0x320 [ 956.592423][ T672] ? __pfx_inet_sendmsg+0x10/0x10 [ 956.592440][ T672] sock_sendmsg_nosec+0x10e/0x180 [ 956.592471][ T672] ____sys_sendmsg+0x54e/0x850 [ 956.592500][ T672] ? __pfx_____sys_sendmsg+0x10/0x10 [ 956.592541][ T672] ? import_iovec+0x73/0xa0 [ 956.592568][ T672] ___sys_sendmsg+0x2a5/0x360 [ 956.592591][ T672] ? __lock_acquire+0x683/0x2cf0 [ 956.592621][ T672] ? __pfx____sys_sendmsg+0x10/0x10 [ 956.592679][ T672] ? __fget_files+0x2a/0x420 [ 956.592703][ T672] ? __fget_files+0x3a2/0x420 [ 956.592738][ T672] __x64_sys_sendmsg+0x1b1/0x290 [ 956.592765][ T672] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 956.592808][ T672] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.592828][ T672] do_syscall_64+0x174/0x580 [ 956.592850][ T672] ? clear_bhb_loop+0x40/0x90 [ 956.592873][ T672] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 956.592892][ T672] RIP: 0033:0x7f545939de59 [ 956.592910][ T672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 956.592927][ T672] RSP: 002b:00007f545a2ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 956.592947][ T672] RAX: ffffffffffffffda RBX: 00007f5459625fa0 RCX: 00007f545939de59 [ 956.592961][ T672] RDX: 0000000020008050 RSI: 00002000000000c0 RDI: 0000000000000003 [ 956.592974][ T672] RBP: 00007f545a2ae090 R08: 0000000000000000 R09: 0000000000000000 [ 956.592986][ T672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 956.592998][ T672] R13: 00007f5459626038 R14: 00007f5459625fa0 R15: 00007fff9ecfb858 [ 956.593030][ T672] [ 957.076529][ T682] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7985'. [ 957.373757][ T698] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7991'. [ 957.461507][ T698] 8021q: adding VLAN 0 to HW filter on device bond7 [ 957.481789][ T698] bond7 (unregistering): Released all slaves [ 957.658708][ T719] netlink: 'syz.1.7998': attribute type 1 has an invalid length. [ 957.777844][ T724] bond7: (slave dummy0): making interface the new active one [ 957.786163][ T724] bond7: (slave dummy0): Enslaving as an active interface with an up link [ 957.800069][ T719] bond7: entered promiscuous mode [ 957.805116][ T719] dummy0: entered promiscuous mode [ 958.291110][ T719] team0: Port device syz_tun removed [ 958.397770][ T719] bond7: (slave dummy0): Releasing active interface [ 958.404904][ T719] dummy0: left promiscuous mode [ 958.625798][ T719] bridge_slave_0: left allmulticast mode [ 958.644615][ T719] pimreg1: port 1(bridge_slave_0) entered disabled state [ 958.938354][ T719] bridge_slave_1: left allmulticast mode [ 958.944040][ T719] bridge_slave_1: left promiscuous mode [ 958.949803][ T719] pimreg1: port 2(bridge_slave_1) entered disabled state [ 959.061009][ T763] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8010'. [ 959.395609][ T719] bond4: (slave veth0_to_bond): Releasing active interface [ 959.418324][ T719] bond0: (slave bond_slave_0): Releasing backup interface [ 959.467077][ T719] bond0: (slave bond_slave_1): Releasing backup interface [ 959.470620][ T767] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8011'. [ 959.568318][ T719] team0: Port device team_slave_0 removed [ 959.634662][ T719] team0: Port device team_slave_1 removed [ 959.737971][ T719] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 959.775580][ T718] bond7: left promiscuous mode [ 959.781830][ T763] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 960.845200][ T806] openvswitch: netlink: IPv6 tunnel dst address is zero [ 961.580252][ T831] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8029'. [ 961.906002][ T848] netlink: 16166 bytes leftover after parsing attributes in process `syz.4.8035'. [ 961.918440][ T848] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 961.919941][ T845] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8036'. [ 961.959653][ T848] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 961.990452][ T30] audit: type=1804 audit(1783022973.481:23): pid=851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.8035" name="/newroot/493/cgroup.controllers" dev="tmpfs" ino=2535 res=1 errno=0 [ 962.061390][ T30] audit: type=1800 audit(1783022973.481:24): pid=851 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8035" name="cgroup.controllers" dev="tmpfs" ino=2535 res=0 errno=0 [ 962.187902][ T859] syzkaller0: entered promiscuous mode [ 962.211339][ T859] syzkaller0: entered allmulticast mode [ 962.443826][ T869] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8043'. [ 962.625673][ T875] netlink: 'syz.2.8047': attribute type 13 has an invalid length. [ 962.678031][ T875] netlink: 'syz.2.8047': attribute type 17 has an invalid length. [ 962.751091][ T878] netlink: 'syz.0.8048': attribute type 11 has an invalid length. [ 962.880404][ T886] openvswitch: netlink: Duplicate or invalid key (type 0). [ 962.887781][ T886] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 962.891195][ T873] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 962.913112][ T886] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8051'. [ 962.976726][ T886] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8051'. [ 963.459861][ T901] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8054'. [ 963.483544][ T875] 8021q: adding VLAN 0 to HW filter on device  [ 963.504439][ T875] 8021q: adding VLAN 0 to HW filter on device team0 [ 963.522784][ T875] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 963.544176][ T875] bridge_slave_0: left promiscuous mode [ 963.549996][ T875] bridge_slave_0: left allmulticast mode [ 963.603692][ T875] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 963.622512][ T875] veth1_vlan: left promiscuous mode [ 963.628630][ T875] veth0_vlan: left promiscuous mode [ 963.636779][ T875] veth0_vlan: entered promiscuous mode [ 963.644974][ T875] veth1_vlan: entered promiscuous mode [ 963.658306][ T875] veth1_macvtap: left promiscuous mode [ 963.697537][ T875] veth0_macvtap: left promiscuous mode [ 963.705089][ T875] veth0_macvtap: entered promiscuous mode [ 963.711051][ T875] macvtap0: left promiscuous mode [ 963.728103][ T875] veth1_macvtap: entered promiscuous mode [ 963.741442][ T875] netdevsim netdevsim2 netdevsim0: left allmulticast mode [ 963.748896][ T875] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 963.760700][ T875] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 963.772787][ T875] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 963.813600][ T875] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 963.851642][ T875] erspan1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 963.860977][ T875] ip6tnl1: left allmulticast mode [ 963.871418][ T875] xfrm1: left allmulticast mode [ 963.882210][ T875] bond0: left promiscuous mode [ 963.886987][ T875] veth0_to_bond: left promiscuous mode [ 963.922231][ T875] bond0: left allmulticast mode [ 963.927146][ T875] veth0_to_bond: left allmulticast mode [ 963.933851][ T875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 963.942188][ T875] 8021q: adding VLAN 0 to HW filter on device bond1 [ 963.951203][ T875] bridge0: port 1(vlan2) entered blocking state [ 963.957514][ T875] bridge0: port 1(vlan2) entered forwarding state [ 963.970215][ T875] gretap1: left promiscuous mode [ 963.979195][ T875] geneve2: left promiscuous mode [ 963.984134][ T875] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 964.180209][ T911] netlink: 'syz.0.8057': attribute type 8 has an invalid length. [ 964.255958][ T907] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8055'. [ 964.973812][ T941] FAULT_INJECTION: forcing a failure. [ 964.973812][ T941] name failslab, interval 1, probability 0, space 0, times 0 [ 964.986447][ T941] CPU: 0 UID: 0 PID: 941 Comm: syz.4.8064 Not tainted syzkaller #0 PREEMPT(full) [ 964.986469][ T941] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 964.986481][ T941] Call Trace: [ 964.986490][ T941] [ 964.986498][ T941] dump_stack_lvl+0xe8/0x150 [ 964.986531][ T941] should_fail_ex+0x40c/0x560 [ 964.986564][ T941] should_failslab+0xa8/0x100 [ 964.986594][ T941] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 964.986616][ T941] ? skb_clone+0x212/0x3a0 [ 964.986637][ T941] ? skb_clone+0x212/0x3a0 [ 964.986663][ T941] skb_clone+0x212/0x3a0 [ 964.986690][ T941] bpf_clone_redirect+0x170/0x4b0 [ 964.986714][ T941] ? bpf_test_run+0x1d1/0x830 [ 964.986738][ T941] bpf_prog_5de8a3f9b7a888dc+0x5e/0x67 [ 964.986760][ T941] ? __kernel_text_address+0xd/0x30 [ 964.986786][ T941] ? unwind_get_return_address+0x4d/0x90 [ 964.986806][ T941] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 964.986831][ T941] ? arch_stack_walk+0xfb/0x150 [ 964.986857][ T941] ? ktime_get+0x45/0x220 [ 964.986888][ T941] ? ktime_get+0x45/0x220 [ 964.986913][ T941] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 964.986939][ T941] ? lockdep_hardirqs_on+0x7a/0x110 [ 964.986959][ T941] ? ktime_get+0x45/0x220 [ 964.986980][ T941] ? seqcount_lockdep_reader_access+0xea/0x100 [ 964.987004][ T941] ? bpf_test_run+0x1d1/0x830 [ 964.987031][ T941] ? bpf_test_timer_continue+0x10c/0x320 [ 964.987059][ T941] bpf_test_run+0x354/0x830 [ 964.987105][ T941] ? __pfx_bpf_test_run+0x10/0x10 [ 964.987144][ T941] ? __kasan_krealloc+0xec/0x110 [ 964.987186][ T941] ? skb_dst_set+0x72/0x140 [ 964.987213][ T941] bpf_prog_test_run_skb+0xe35/0x2230 [ 964.987257][ T941] ? __fget_files+0x3a2/0x420 [ 964.987281][ T941] ? __fget_files+0x2a/0x420 [ 964.987310][ T941] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 964.987336][ T941] bpf_prog_test_run+0x2c5/0x340 [ 964.987366][ T941] __sys_bpf+0xa22/0xd90 [ 964.987399][ T941] ? __pfx___sys_bpf+0x10/0x10 [ 964.987435][ T941] ? __fget_files+0x2a/0x420 [ 964.987476][ T941] ? ksys_write+0x242/0x270 [ 964.987507][ T941] ? __pfx_ksys_write+0x10/0x10 [ 964.987539][ T941] __x64_sys_bpf+0xba/0xd0 [ 964.987562][ T941] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.987584][ T941] do_syscall_64+0x174/0x580 [ 964.987604][ T941] ? trace_irq_disable+0x3b/0x140 [ 964.987629][ T941] ? clear_bhb_loop+0x40/0x90 [ 964.987652][ T941] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 964.987672][ T941] RIP: 0033:0x7ff9cc19de59 [ 964.987689][ T941] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 964.987707][ T941] RSP: 002b:00007ff9cd093028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 964.987728][ T941] RAX: ffffffffffffffda RBX: 00007ff9cc425fa0 RCX: 00007ff9cc19de59 [ 964.987742][ T941] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 000000000000000a [ 964.987755][ T941] RBP: 00007ff9cd093090 R08: 0000000000000000 R09: 0000000000000000 [ 964.987768][ T941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 964.987779][ T941] R13: 00007ff9cc426038 R14: 00007ff9cc425fa0 R15: 00007ffd908f71e8 [ 964.987811][ T941] [ 966.175740][ T976] netlink: 'syz.4.8071': attribute type 4 has an invalid length. [ 966.307400][ T979] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8074'. [ 966.378145][ T981] netlink: 'syz.3.8075': attribute type 1 has an invalid length. [ 966.393848][ T981] netlink: 236 bytes leftover after parsing attributes in process `syz.3.8075'. [ 966.456851][ T986] tipc: Enabled bearer , priority 0 [ 966.467339][ T985] tipc: Disabling bearer [ 967.034409][ T1003] __nla_validate_parse: 1 callbacks suppressed [ 967.034439][ T1003] netlink: 228 bytes leftover after parsing attributes in process `syz.1.8083'. [ 967.051593][ T1003] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8083'. [ 968.209565][ T1030] tap0: tun_chr_ioctl cmd 1074025672 [ 968.214907][ T1030] tap0: ignored: set checksum disabled [ 968.996754][ T1051] netlink: 'syz.1.8098': attribute type 13 has an invalid length. [ 969.058639][ T1051] netlink: 'syz.1.8098': attribute type 17 has an invalid length. [ 969.219707][ T1051] pimreg1: left allmulticast mode [ 969.282982][ T1055] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8100'. [ 969.351836][ T1051] 8021q: adding VLAN 0 to HW filter on device bond0 [ 969.435484][ T1051] 8021q: adding VLAN 0 to HW filter on device team0 [ 969.740659][ T1051] mac80211_hwsim hwsim44 wlan0: left promiscuous mode [ 969.772893][ T1051] mac80211_hwsim hwsim44 wlan0: left allmulticast mode [ 969.814147][ T1051] bond1: left allmulticast mode [ 969.819042][ T1051] bridge2: left allmulticast mode [ 969.879685][ T1051] bridge3: left allmulticast mode [ 969.904236][ T1051] bond3: left promiscuous mode [ 969.909035][ T1051] bond3: left allmulticast mode [ 969.941162][ T1051] ip6tnl4: left allmulticast mode [ 969.993517][ T1051] macvlan4: left allmulticast mode [ 970.057625][ T1051] gretap0: left allmulticast mode [ 970.078901][ T1051] bond6: left promiscuous mode [ 970.125114][ T1051] 8021q: adding VLAN 0 to HW filter on device bond7 [ 970.135086][ T1051] 8021q: adding VLAN 0 to HW filter on device bond8 [ 970.307560][ T1085] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8107'. [ 970.325384][ T8990] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 970.395949][ T1087] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8108'. [ 970.416049][ T1090] FAULT_INJECTION: forcing a failure. [ 970.416049][ T1090] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 970.429110][ T1090] CPU: 0 UID: 0 PID: 1090 Comm: syz.2.8109 Not tainted syzkaller #0 PREEMPT(full) [ 970.429135][ T1090] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 970.429147][ T1090] Call Trace: [ 970.429155][ T1090] [ 970.429164][ T1090] dump_stack_lvl+0xe8/0x150 [ 970.429197][ T1090] should_fail_ex+0x40c/0x560 [ 970.429232][ T1090] _copy_to_user+0x31/0xb0 [ 970.429257][ T1090] bpf_verifier_vlog+0x496/0x900 [ 970.429290][ T1090] __btf_verifier_log+0xe2/0x140 [ 970.429318][ T1090] ? __pfx___btf_verifier_log+0x10/0x10 [ 970.429338][ T1090] ? __might_fault+0xaf/0x130 [ 970.429364][ T1090] ? btf_parse_hdr+0x1da/0x810 [ 970.429393][ T1090] btf_parse_hdr+0x4a2/0x810 [ 970.429423][ T1090] btf_new_fd+0x32f/0xbb0 [ 970.429455][ T1090] __sys_bpf+0xd2e/0xd90 [ 970.429487][ T1090] ? __pfx___sys_bpf+0x10/0x10 [ 970.429519][ T1090] ? __fget_files+0x2a/0x420 [ 970.429559][ T1090] ? ksys_write+0x242/0x270 [ 970.429587][ T1090] ? __pfx_ksys_write+0x10/0x10 [ 970.429619][ T1090] __x64_sys_bpf+0xba/0xd0 [ 970.429641][ T1090] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.429663][ T1090] do_syscall_64+0x174/0x580 [ 970.429683][ T1090] ? trace_irq_disable+0x3b/0x140 [ 970.429714][ T1090] ? clear_bhb_loop+0x40/0x90 [ 970.429738][ T1090] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 970.429758][ T1090] RIP: 0033:0x7f4690d9de59 [ 970.429776][ T1090] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 970.429793][ T1090] RSP: 002b:00007f4691d33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 970.429813][ T1090] RAX: ffffffffffffffda RBX: 00007f4691025fa0 RCX: 00007f4690d9de59 [ 970.429827][ T1090] RDX: 0000000000000028 RSI: 0000200000000780 RDI: 0000000000000012 [ 970.429840][ T1090] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 970.429852][ T1090] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 970.429864][ T1090] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 970.429895][ T1090] [ 970.432933][ T1087] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8108'. [ 970.677366][ T1087] netlink: 'syz.4.8108': attribute type 11 has an invalid length. [ 970.685200][ T1087] netlink: 'syz.4.8108': attribute type 14 has an invalid length. [ 970.691130][ T1100] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8113'. [ 970.742206][ T1103] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8113'. [ 970.811254][ T1669] block nbd3: Possible stuck request ffff888028750000: control (read@0,1024B). Runtime 240 seconds [ 970.814784][ T1107] netlink: 52 bytes leftover after parsing attributes in process `syz.1.8112'. [ 970.876148][ T1100] netlink: 44 bytes leftover after parsing attributes in process `syz.2.8113'. [ 970.912977][ T1107] netlink: 'syz.1.8112': attribute type 1 has an invalid length. [ 971.051064][ T1100] bridge0: port 1(vlan2) entered disabled state [ 971.084746][ T1100] bridge0: entered allmulticast mode [ 971.111325][ T9004] wlan0: Trigger new scan to find an IBSS to join [ 971.135274][ T1103] vlan2: left allmulticast mode [ 971.219919][ T1103] dummy0: left allmulticast mode [ 971.296927][ T1103] vlan2: left promiscuous mode [ 971.340074][ T1103] dummy0: left promiscuous mode [ 971.364291][ T1103] bridge0: port 1(vlan2) entered disabled state [ 971.373175][ T1132] netlink: 'syz.3.8117': attribute type 2 has an invalid length. [ 971.385472][ T1132] netlink: 'syz.3.8117': attribute type 1 has an invalid length. [ 971.798954][ T1142] netlink: 'syz.1.8119': attribute type 25 has an invalid length. [ 971.867095][ T1146] FAULT_INJECTION: forcing a failure. [ 971.867095][ T1146] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 971.898944][ T1146] CPU: 0 UID: 0 PID: 1146 Comm: syz.0.8121 Not tainted syzkaller #0 PREEMPT(full) [ 971.898969][ T1146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 971.898988][ T1146] Call Trace: [ 971.898996][ T1146] [ 971.899005][ T1146] dump_stack_lvl+0xe8/0x150 [ 971.899040][ T1146] should_fail_ex+0x40c/0x560 [ 971.899074][ T1146] _copy_from_user+0x2d/0xb0 [ 971.899098][ T1146] kstrtouint_from_user+0xd6/0x180 [ 971.899130][ T1146] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 971.899178][ T1146] proc_fail_nth_write+0x8e/0x210 [ 971.899205][ T1146] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 971.899240][ T1146] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 971.899265][ T1146] vfs_write+0x296/0xba0 [ 971.899303][ T1146] ? __pfx_vfs_write+0x10/0x10 [ 971.899333][ T1146] ? __fget_files+0x2a/0x420 [ 971.899361][ T1146] ? __fget_files+0x3a2/0x420 [ 971.899383][ T1146] ? __fget_files+0x2a/0x420 [ 971.899414][ T1146] ksys_write+0x150/0x270 [ 971.899444][ T1146] ? __pfx_ksys_write+0x10/0x10 [ 971.899479][ T1146] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.899500][ T1146] do_syscall_64+0x174/0x580 [ 971.899521][ T1146] ? trace_irq_disable+0x3b/0x140 [ 971.899545][ T1146] ? clear_bhb_loop+0x40/0x90 [ 971.899569][ T1146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.899587][ T1146] RIP: 0033:0x7f545935e68e [ 971.899605][ T1146] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 971.899621][ T1146] RSP: 002b:00007f545a2adfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 971.899641][ T1146] RAX: ffffffffffffffda RBX: 00007f545a2ae6c0 RCX: 00007f545935e68e [ 971.899655][ T1146] RDX: 0000000000000001 RSI: 00007f545a2ae0a0 RDI: 0000000000000004 [ 971.899667][ T1146] RBP: 00007f545a2ae090 R08: 0000000000000000 R09: 0000000000000000 [ 971.899679][ T1146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 971.899689][ T1146] R13: 00007f5459626038 R14: 00007f5459625fa0 R15: 00007fff9ecfb858 [ 971.899722][ T1146] [ 972.661891][ T1176] __nla_validate_parse: 2 callbacks suppressed [ 972.661925][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.680235][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.697479][ T1173] netlink: 92 bytes leftover after parsing attributes in process `syz.1.8133'. [ 972.706793][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.726256][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.753946][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.766420][ T1176] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8134'. [ 972.788119][ T1177] macvlan1: entered promiscuous mode [ 972.793587][ T1177] macvlan1: entered allmulticast mode [ 972.798981][ T1177] veth1_vlan: entered allmulticast mode [ 973.309688][ T1198] sctp: [Deprecated]: syz.1.8140 (pid 1198) Use of struct sctp_assoc_value in delayed_ack socket option. [ 973.309688][ T1198] Use struct sctp_sack_info instead [ 973.581488][ T1210] netlink: 64 bytes leftover after parsing attributes in process `syz.0.8141'. [ 974.139738][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 974.193725][ T1228] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8147'. [ 974.232415][ T1230] netlink: 'syz.1.8149': attribute type 11 has an invalid length. [ 974.259956][ T1230] netlink: 140 bytes leftover after parsing attributes in process `syz.1.8149'. [ 974.678761][ T1252] netlink: 'syz.3.8156': attribute type 1 has an invalid length. [ 974.813645][ T1252] bond7: entered promiscuous mode [ 974.831492][ T1252] bond7: entered allmulticast mode [ 974.846534][ T1252] 8021q: adding VLAN 0 to HW filter on device bond7 [ 974.938408][ T1256] erspan1: entered allmulticast mode [ 974.943830][ T8990] wlan0: Trigger new scan to find an IBSS to join [ 974.955718][ T1256] bond7: (slave erspan1): making interface the new active one [ 974.963204][ T1256] erspan1: entered promiscuous mode [ 975.035942][ T1256] bond7: (slave erspan1): Enslaving as an active interface with an up link [ 975.051350][ T1269] FAULT_INJECTION: forcing a failure. [ 975.051350][ T1269] name failslab, interval 1, probability 0, space 0, times 0 [ 975.064077][ T1269] CPU: 0 UID: 0 PID: 1269 Comm: syz.0.8161 Not tainted syzkaller #0 PREEMPT(full) [ 975.064099][ T1269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 975.064110][ T1269] Call Trace: [ 975.064118][ T1269] [ 975.064127][ T1269] dump_stack_lvl+0xe8/0x150 [ 975.064165][ T1269] should_fail_ex+0x40c/0x560 [ 975.064207][ T1269] should_failslab+0xa8/0x100 [ 975.064237][ T1269] __kmalloc_cache_noprof+0xa8/0x660 [ 975.064261][ T1269] ? nft_pernet+0x23/0x240 [ 975.064281][ T1269] ? nf_tables_commit+0x9c8/0xad90 [ 975.064299][ T1269] ? nf_tables_commit+0x9c8/0xad90 [ 975.064322][ T1269] nf_tables_commit+0x9c8/0xad90 [ 975.064354][ T1269] ? __free_frozen_pages+0x7b4/0xd10 [ 975.064376][ T1269] ? lock_acquire+0x106/0x350 [ 975.064402][ T1269] ? __free_frozen_pages+0x7b4/0xd10 [ 975.064436][ T1269] ? __pfx_nf_tables_commit+0x10/0x10 [ 975.064459][ T1269] ? __free_frozen_pages+0x7ed/0xd10 [ 975.064490][ T1269] ? nf_tables_newrule+0x258d/0x28a0 [ 975.064525][ T1269] ? __pfx_nf_tables_newrule+0x10/0x10 [ 975.064543][ T1269] ? nfnl_pernet+0x23/0x240 [ 975.064584][ T1269] nfnetlink_rcv+0x1caf/0x28c0 [ 975.064638][ T1269] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 975.064704][ T1269] ? netlink_deliver_tap+0x2e/0x1b0 [ 975.064739][ T1269] ? netlink_deliver_tap+0x2e/0x1b0 [ 975.064762][ T1269] ? netlink_deliver_tap+0x2e/0x1b0 [ 975.064791][ T1269] netlink_unicast+0x7bb/0x940 [ 975.064824][ T1269] netlink_sendmsg+0x813/0xb40 [ 975.064858][ T1269] ? __pfx_netlink_sendmsg+0x10/0x10 [ 975.064887][ T1269] ? aa_sock_msg_perm+0xf1/0x1b0 [ 975.064919][ T1269] ? __pfx_netlink_sendmsg+0x10/0x10 [ 975.064941][ T1269] sock_sendmsg_nosec+0x13a/0x180 [ 975.064974][ T1269] ____sys_sendmsg+0x54e/0x850 [ 975.065002][ T1269] ? __pfx_____sys_sendmsg+0x10/0x10 [ 975.065035][ T1269] ? import_iovec+0x73/0xa0 [ 975.065062][ T1269] ___sys_sendmsg+0x2a5/0x360 [ 975.065083][ T1269] ? __lock_acquire+0x683/0x2cf0 [ 975.065112][ T1269] ? __pfx____sys_sendmsg+0x10/0x10 [ 975.065177][ T1269] ? __fget_files+0x2a/0x420 [ 975.065201][ T1269] ? __fget_files+0x3a2/0x420 [ 975.065235][ T1269] __x64_sys_sendmsg+0x1b1/0x290 [ 975.065263][ T1269] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 975.065304][ T1269] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.065325][ T1269] do_syscall_64+0x174/0x580 [ 975.065344][ T1269] ? trace_irq_disable+0x3b/0x140 [ 975.065367][ T1269] ? clear_bhb_loop+0x40/0x90 [ 975.065389][ T1269] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 975.065408][ T1269] RIP: 0033:0x7f545939de59 [ 975.065426][ T1269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 975.065442][ T1269] RSP: 002b:00007f545a2ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 975.065462][ T1269] RAX: ffffffffffffffda RBX: 00007f5459625fa0 RCX: 00007f545939de59 [ 975.065476][ T1269] RDX: 0000000020040040 RSI: 0000200000000500 RDI: 0000000000000003 [ 975.065490][ T1269] RBP: 00007f545a2ae090 R08: 0000000000000000 R09: 0000000000000000 [ 975.065502][ T1269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 975.065514][ T1269] R13: 00007f5459626038 R14: 00007f5459625fa0 R15: 00007fff9ecfb858 [ 975.065545][ T1269] [ 975.479600][ T1271] netlink: 'syz.1.8160': attribute type 3 has an invalid length. [ 975.612620][ T1276] netlink: 'syz.2.8158': attribute type 2 has an invalid length. [ 975.821118][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 977.100022][ T1345] netlink: zone id is out of range [ 977.113603][ T1345] netlink: zone id is out of range [ 977.118736][ T1345] netlink: zone id is out of range [ 977.123845][ T1345] netlink: zone id is out of range [ 977.128953][ T1345] netlink: zone id is out of range [ 977.134060][ T1345] netlink: zone id is out of range [ 977.139166][ T1345] netlink: zone id is out of range [ 977.144274][ T1345] netlink: zone id is out of range [ 977.149378][ T1345] netlink: zone id is out of range [ 977.154479][ T1345] netlink: zone id is out of range [ 977.864089][ T1377] __nla_validate_parse: 7 callbacks suppressed [ 977.864108][ T1377] netlink: 204 bytes leftover after parsing attributes in process `syz.2.8186'. [ 977.882312][ T1377] netlink: 84 bytes leftover after parsing attributes in process `syz.2.8186'. [ 978.327820][ T1387] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8190'. [ 979.336600][ T1416] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8199'. [ 980.422903][ T1470] netlink: 36 bytes leftover after parsing attributes in process `syz.3.8213'. [ 980.580344][ T1475] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8215'. [ 980.594034][ T1476] siw: device registration error -23 [ 980.597330][ T1478] netlink: 204 bytes leftover after parsing attributes in process `syz.0.8216'. [ 980.635774][ T1478] netlink: 84 bytes leftover after parsing attributes in process `syz.0.8216'. [ 981.579585][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 981.772696][ T1503] 8021q: VLANs not supported on lo [ 982.008288][ T1509] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8226'. [ 982.230716][ T1513] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 982.238281][ T1513] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 982.319643][ T1516] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8229'. [ 983.024985][ T1537] netlink: 'syz.1.8236': attribute type 10 has an invalid length. [ 983.115503][ T1547] netlink: 'syz.1.8240': attribute type 4 has an invalid length. [ 983.135465][ T1547] netlink: 'syz.1.8240': attribute type 4 has an invalid length. [ 983.169434][ T1550] mac80211_hwsim hwsim56 syzkaller1: entered promiscuous mode [ 983.176955][ T1550] mac80211_hwsim hwsim56 syzkaller1: entered allmulticast mode [ 983.321074][ T1553] syzkaller0: entered promiscuous mode [ 983.336019][ T1553] syzkaller0: entered allmulticast mode [ 983.563157][ T1555] netlink: 'syz.1.8243': attribute type 2 has an invalid length. [ 983.785625][ T1569] net_ratelimit: 287 callbacks suppressed [ 983.785644][ T1569] openvswitch: netlink: Flow key attr not present in new flow. [ 983.968708][ T1574] lo speed is unknown, defaulting to 1000 [ 984.401145][ T1574] lo speed is unknown, defaulting to 1000 [ 984.613318][ T1598] lo speed is unknown, defaulting to 1000 [ 985.010223][ T1614] xt_hashlimit: size too large, truncated to 1048576 [ 985.098422][ T1633] openvswitch: netlink: IP tunnel dst address not specified [ 985.125850][ T1633] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 985.321142][ T1637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8263'. [ 985.377364][ T1640] netlink: 64 bytes leftover after parsing attributes in process `syz.3.8256'. [ 985.409225][ T1637] 8021q: adding VLAN 0 to HW filter on device bond4 [ 985.443633][ T1641] syzkaller1: entered promiscuous mode [ 985.449212][ T1641] syzkaller1: entered allmulticast mode [ 985.554256][ T1598] lo speed is unknown, defaulting to 1000 [ 985.743240][ T1649] netlink: 132 bytes leftover after parsing attributes in process `syz.4.8267'. [ 985.791869][ T1649] openvswitch: netlink: Missing valid actions attribute. [ 985.809522][ T1649] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 985.923598][ T1651] netlink: 'syz.2.8268': attribute type 2 has an invalid length. [ 985.966886][ T1651] netlink: 'syz.2.8268': attribute type 1 has an invalid length. [ 985.974672][ T1651] netlink: 'syz.2.8268': attribute type 1 has an invalid length. [ 986.009557][ T1651] netlink: 'syz.2.8268': attribute type 1 has an invalid length. [ 986.210739][ T1665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8269'. [ 986.245298][ T1651] bond5: entered promiscuous mode [ 986.260766][ T1651] 8021q: adding VLAN 0 to HW filter on device bond5 [ 986.269663][ T1665] netlink: 'syz.1.8269': attribute type 1 has an invalid length. [ 986.277398][ T1665] netlink: 756 bytes leftover after parsing attributes in process `syz.1.8269'. [ 986.466085][ T1667] bond5: (slave veth5): making interface the new active one [ 986.473414][ T1667] veth5: entered promiscuous mode [ 986.480750][ T1667] bond5: (slave veth5): Enslaving as an active interface with an up link [ 986.563336][ T1673] FAULT_INJECTION: forcing a failure. [ 986.563336][ T1673] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 986.599531][ T1673] CPU: 1 UID: 0 PID: 1673 Comm: syz.3.8271 Not tainted syzkaller #0 PREEMPT(full) [ 986.599554][ T1673] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 986.599566][ T1673] Call Trace: [ 986.599574][ T1673] [ 986.599583][ T1673] dump_stack_lvl+0xe8/0x150 [ 986.599615][ T1673] should_fail_ex+0x40c/0x560 [ 986.599648][ T1673] _copy_from_user+0x2d/0xb0 [ 986.599672][ T1673] ___sys_recvmsg+0x173/0x5a0 [ 986.599694][ T1673] ? ktime_get_ts64+0xa9/0x410 [ 986.599733][ T1673] ? __pfx____sys_recvmsg+0x10/0x10 [ 986.599762][ T1673] ? ktime_get_ts64+0xa9/0x410 [ 986.599812][ T1673] do_recvmmsg+0x31a/0x7f0 [ 986.599844][ T1673] ? __pfx_do_recvmmsg+0x10/0x10 [ 986.599879][ T1673] ? get_timespec64+0x119/0x1b0 [ 986.599905][ T1673] ? __pfx_get_timespec64+0x10/0x10 [ 986.599941][ T1673] __x64_sys_recvmmsg+0x1b7/0x250 [ 986.599968][ T1673] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 986.600002][ T1673] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.600023][ T1673] do_syscall_64+0x174/0x580 [ 986.600043][ T1673] ? trace_irq_disable+0x3b/0x140 [ 986.600067][ T1673] ? clear_bhb_loop+0x40/0x90 [ 986.600090][ T1673] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 986.600110][ T1673] RIP: 0033:0x7f912399de59 [ 986.600127][ T1673] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 986.600143][ T1673] RSP: 002b:00007f9124782028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 986.600162][ T1673] RAX: ffffffffffffffda RBX: 00007f9123c25fa0 RCX: 00007f912399de59 [ 986.600176][ T1673] RDX: 00000000000006f5 RSI: 0000200000000440 RDI: 0000000000000003 [ 986.600189][ T1673] RBP: 00007f9124782090 R08: 0000200000000480 R09: 0000000000000000 [ 986.600200][ T1673] R10: 0000002000000022 R11: 0000000000000246 R12: 0000000000000001 [ 986.600212][ T1673] R13: 00007f9123c26038 R14: 00007f9123c25fa0 R15: 00007ffec6dd4538 [ 986.600242][ T1673] [ 987.015605][ T1677] netlink: 'syz.1.8274': attribute type 1 has an invalid length. [ 987.131302][ T1690] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8278'. [ 987.233169][ T1693] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8279'. [ 987.266782][ T1694] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8278'. [ 987.576532][ T1691] bond8: (slave bridge1): Enslaving as an active interface with an up link [ 987.598801][ T1694] bond8: entered promiscuous mode [ 987.607880][ T1694] bridge1: entered promiscuous mode [ 987.613437][ T1694] bond8: entered allmulticast mode [ 987.684276][ T1694] bridge1: entered allmulticast mode [ 987.716979][ T1694] 8021q: adding VLAN 0 to HW filter on device bond8 [ 988.328232][ T1739] netlink: 'syz.3.8289': attribute type 2 has an invalid length. [ 988.725471][ T1749] netlink: 'syz.1.8295': attribute type 13 has an invalid length. [ 988.888815][ T1751] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8296'. [ 988.907585][ T1753] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 988.947990][ T1753] syzkaller0: entered promiscuous mode [ 988.954420][ T1753] syzkaller0: entered allmulticast mode [ 989.197405][ T1760] netlink: 'syz.3.8298': attribute type 49 has an invalid length. [ 989.350009][ T1764] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8300'. [ 990.017078][ T1796] FAULT_INJECTION: forcing a failure. [ 990.017078][ T1796] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 990.030090][ T1788] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 990.074211][ T1796] CPU: 1 UID: 0 PID: 1796 Comm: syz.3.8310 Not tainted syzkaller #0 PREEMPT(full) [ 990.074234][ T1796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 990.074245][ T1796] Call Trace: [ 990.074253][ T1796] [ 990.074262][ T1796] dump_stack_lvl+0xe8/0x150 [ 990.074296][ T1796] should_fail_ex+0x40c/0x560 [ 990.074329][ T1796] _copy_from_user+0x2d/0xb0 [ 990.074352][ T1796] kstrtouint_from_user+0xd6/0x180 [ 990.074386][ T1796] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 990.074430][ T1796] proc_fail_nth_write+0x8e/0x210 [ 990.074456][ T1796] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 990.074488][ T1796] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 990.074512][ T1796] vfs_write+0x296/0xba0 [ 990.074547][ T1796] ? __pfx_vfs_write+0x10/0x10 [ 990.074574][ T1796] ? __fget_files+0x2a/0x420 [ 990.074602][ T1796] ? __fget_files+0x3a2/0x420 [ 990.074624][ T1796] ? __fget_files+0x2a/0x420 [ 990.074655][ T1796] ksys_write+0x150/0x270 [ 990.074684][ T1796] ? __pfx_ksys_write+0x10/0x10 [ 990.074719][ T1796] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.074740][ T1796] do_syscall_64+0x174/0x580 [ 990.074760][ T1796] ? trace_irq_disable+0x3b/0x140 [ 990.074782][ T1796] ? clear_bhb_loop+0x40/0x90 [ 990.074805][ T1796] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 990.074823][ T1796] RIP: 0033:0x7f912395e68e [ 990.074841][ T1796] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 990.074858][ T1796] RSP: 002b:00007f9124781fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 990.074879][ T1796] RAX: ffffffffffffffda RBX: 00007f91247826c0 RCX: 00007f912395e68e [ 990.074893][ T1796] RDX: 0000000000000001 RSI: 00007f91247820a0 RDI: 0000000000000004 [ 990.074906][ T1796] RBP: 00007f9124782090 R08: 0000000000000000 R09: 0000000000000000 [ 990.074918][ T1796] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 990.074929][ T1796] R13: 00007f9123c26038 R14: 00007f9123c25fa0 R15: 00007ffec6dd4538 [ 990.074961][ T1796] [ 990.782542][ T1790] bond0: (slave wlan0): Enslaving as an active interface with an up link [ 990.983939][ T1807] __nla_validate_parse: 1 callbacks suppressed [ 990.983957][ T1807] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8314'. [ 990.999236][ T1811] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8315'. [ 991.592120][ T1848] netlink: 4560 bytes leftover after parsing attributes in process `syz.0.8324'. [ 991.707575][ T1849] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8323'. [ 991.852725][ T1865] IPv6: NLM_F_CREATE should be specified when creating new route [ 991.861197][ T1865] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 991.868448][ T1865] IPv6: NLM_F_CREATE should be set when creating new route [ 991.875872][ T1865] IPv6: NLM_F_CREATE should be set when creating new route [ 991.883214][ T1865] IPv6: NLM_F_CREATE should be set when creating new route [ 991.893929][ T1865] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.8328'. [ 991.904499][ T1855] syzkaller1: entered promiscuous mode [ 991.909979][ T1855] syzkaller1: entered allmulticast mode [ 992.745203][ T1881] FAULT_INJECTION: forcing a failure. [ 992.745203][ T1881] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 992.758955][ T1881] CPU: 1 UID: 0 PID: 1881 Comm: syz.1.8330 Not tainted syzkaller #0 PREEMPT(full) [ 992.758978][ T1881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 992.758990][ T1881] Call Trace: [ 992.758997][ T1881] [ 992.759005][ T1881] dump_stack_lvl+0xe8/0x150 [ 992.759037][ T1881] should_fail_ex+0x40c/0x560 [ 992.759070][ T1881] _copy_from_iter+0x1d3/0x1660 [ 992.759098][ T1881] ? _copy_from_iter+0x21b/0x1660 [ 992.759121][ T1881] ? __pfx__copy_from_iter+0x10/0x10 [ 992.759146][ T1881] ? __pfx__copy_from_iter+0x10/0x10 [ 992.759174][ T1881] copy_page_from_iter+0x219/0x2d0 [ 992.759198][ T1881] skb_copy_datagram_from_iter+0x2f4/0x720 [ 992.759234][ T1881] tun_get_user+0x1520/0x4370 [ 992.759270][ T1881] ? aa_file_perm+0x18b/0x15f0 [ 992.759301][ T1881] ? aa_file_perm+0x4ed/0x15f0 [ 992.759327][ T1881] ? __pfx_tun_get_user+0x10/0x10 [ 992.759352][ T1881] ? __lock_acquire+0x683/0x2cf0 [ 992.759380][ T1881] ? kstrtoull+0x12f/0x1d0 [ 992.759415][ T1881] ? ref_tracker_alloc+0x341/0x4b0 [ 992.759432][ T1881] ? get_pid_task+0x20/0x1f0 [ 992.759459][ T1881] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 992.759479][ T1881] ? tun_get+0x1c/0x2f0 [ 992.759498][ T1881] ? tun_get+0x1c/0x2f0 [ 992.759522][ T1881] ? tun_get+0x1c/0x2f0 [ 992.759540][ T1881] ? tun_get+0x1c/0x2f0 [ 992.759563][ T1881] tun_chr_write_iter+0x113/0x200 [ 992.759586][ T1881] vfs_write+0x612/0xba0 [ 992.759621][ T1881] ? __pfx_vfs_write+0x10/0x10 [ 992.759659][ T1881] ? __fget_files+0x2a/0x420 [ 992.759693][ T1881] ksys_write+0x150/0x270 [ 992.759724][ T1881] ? __pfx_ksys_write+0x10/0x10 [ 992.759761][ T1881] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.759783][ T1881] do_syscall_64+0x174/0x580 [ 992.759804][ T1881] ? trace_irq_disable+0x3b/0x140 [ 992.759828][ T1881] ? clear_bhb_loop+0x40/0x90 [ 992.759851][ T1881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 992.759870][ T1881] RIP: 0033:0x7fd9c4d5e68e [ 992.759889][ T1881] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 992.759905][ T1881] RSP: 002b:00007fd9c5c23fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 992.759932][ T1881] RAX: ffffffffffffffda RBX: 00007fd9c5c246c0 RCX: 00007fd9c4d5e68e [ 992.759947][ T1881] RDX: 000000000000fcf0 RSI: 0000200000000340 RDI: 00000000000000c8 [ 992.759960][ T1881] RBP: 00007fd9c5c24090 R08: 0000000000000000 R09: 0000000000000000 [ 992.759973][ T1881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 992.759984][ T1881] R13: 00007fd9c5026038 R14: 00007fd9c5025fa0 R15: 00007ffdd00db6b8 [ 992.760016][ T1881] [ 993.117285][ T1318] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 994.571683][ T1853] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 994.918861][ T1898] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8334'. [ 996.011870][ T1935] xt_hashlimit: size too large, truncated to 1048576 [ 996.158188][ T1944] netlink: 'syz.1.8346': attribute type 12 has an invalid length. [ 996.854579][ T1970] 8021q: VLANs not supported on ip_vti0 [ 996.939703][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 997.312980][ T1992] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8364'. [ 997.470043][ T2001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8365'. [ 997.478931][ T2001] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8365'. [ 997.501311][ T2001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8365'. [ 997.510181][ T2001] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8365'. [ 998.753396][ T2052] syzkaller0: entered promiscuous mode [ 998.755820][ T2056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8382'. [ 998.768146][ T2052] syzkaller0: entered allmulticast mode [ 998.807110][ T2056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8382'. [ 998.835490][ T2050] lo speed is unknown, defaulting to 1000 [ 999.230362][ T2065] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8385'. [ 999.299191][ T2050] lo speed is unknown, defaulting to 1000 [ 999.348815][ T2069] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8386'. [ 999.399210][ T2069] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8386'. [ 999.619849][ T2074] netlink: 'syz.2.8387': attribute type 7 has an invalid length. [ 999.802667][ T2084] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1000.702274][ T2127] IPv6: Can't replace route, no match found [ 1001.450545][ T1669] block nbd3: Possible stuck request ffff888028750000: control (read@0,1024B). Runtime 270 seconds [ 1001.586393][ T2158] syzkaller0: entered promiscuous mode [ 1001.597098][ T2158] syzkaller0: entered allmulticast mode [ 1001.733627][ T2176] sctp: [Deprecated]: syz.3.8419 (pid 2176) Use of int in maxseg socket option. [ 1001.733627][ T2176] Use struct sctp_assoc_value instead [ 1001.756098][ T2178] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 1002.363777][ T2203] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1002.593815][ T2211] __nla_validate_parse: 15 callbacks suppressed [ 1002.593833][ T2211] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8427'. [ 1002.814973][ T2223] netlink: 'syz.3.8431': attribute type 10 has an invalid length. [ 1002.844169][ T2223] team0: Port device dummy0 added [ 1002.862219][ T2223] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8431'. [ 1003.371262][ T2240] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8438'. [ 1003.550526][ T2242] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 1003.885994][ T2259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8447'. [ 1003.970099][ T2267] netlink: 'syz.4.8448': attribute type 62 has an invalid length. [ 1004.055189][ T2267] vlan1: left promiscuous mode [ 1004.560868][ T2291] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8455'. [ 1004.598001][ T2293] pimreg1: renamed from bridge0 [ 1004.604606][ T2293] pimreg1: entered allmulticast mode [ 1004.610799][ T2293] A link change request failed with some changes committed already. Interface pimreg1 may have been left with an inconsistent configuration, please check. [ 1004.720993][ T2262] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1004.731701][ T2296] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1004.846190][ T2298] lo speed is unknown, defaulting to 1000 [ 1005.125065][ T2304] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8459'. [ 1005.181589][ T2308] xt_bpf: check failed: parse error [ 1005.494532][ T2313] bond6: entered promiscuous mode [ 1005.533284][ T2313] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1005.549569][ T2298] lo speed is unknown, defaulting to 1000 [ 1005.719678][ T2322] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1005.888815][ T2329] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8466'. [ 1006.115857][ T2334] FAULT_INJECTION: forcing a failure. [ 1006.115857][ T2334] name failslab, interval 1, probability 0, space 0, times 0 [ 1006.150917][ T2334] CPU: 1 UID: 0 PID: 2334 Comm: syz.2.8469 Not tainted syzkaller #0 PREEMPT(full) [ 1006.150942][ T2334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1006.150954][ T2334] Call Trace: [ 1006.150963][ T2334] [ 1006.150972][ T2334] dump_stack_lvl+0xe8/0x150 [ 1006.151009][ T2334] should_fail_ex+0x40c/0x560 [ 1006.151046][ T2334] should_failslab+0xa8/0x100 [ 1006.151078][ T2334] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1006.151100][ T2334] ? local_lock_release+0x9c/0x160 [ 1006.151126][ T2334] ? __alloc_skb+0x1d7/0x7a0 [ 1006.151144][ T2334] ? __alloc_skb+0x1d7/0x7a0 [ 1006.151171][ T2334] __alloc_skb+0x1d7/0x7a0 [ 1006.151197][ T2334] nl80211_tx_mgmt+0xad5/0xf40 [ 1006.151318][ T2334] ? __pfx_nl80211_tx_mgmt+0x10/0x10 [ 1006.151340][ T2334] ? __pfx___mutex_lock+0x10/0x10 [ 1006.151361][ T2334] ? __cfg80211_wdev_from_attrs+0x766/0x810 [ 1006.151460][ T2334] ? nl80211_pre_doit+0x53d/0x890 [ 1006.151492][ T2334] genl_family_rcv_msg_doit+0x233/0x340 [ 1006.151520][ T2334] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1006.151570][ T2334] ? bpf_lsm_capable+0x9/0x20 [ 1006.151595][ T2334] ? security_capable+0x7e/0x2c0 [ 1006.151627][ T2334] genl_rcv_msg+0x614/0x7a0 [ 1006.151663][ T2334] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1006.151690][ T2334] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1006.151714][ T2334] ? __pfx_nl80211_tx_mgmt+0x10/0x10 [ 1006.151734][ T2334] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1006.151760][ T2334] ? __pfx_ref_tracker_free+0x10/0x10 [ 1006.151792][ T2334] netlink_rcv_skb+0x226/0x4a0 [ 1006.151817][ T2334] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1006.151847][ T2334] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1006.151887][ T2334] ? down_read+0x2be/0x330 [ 1006.151914][ T2334] genl_rcv+0x28/0x40 [ 1006.151940][ T2334] netlink_unicast+0x7bb/0x940 [ 1006.151974][ T2334] netlink_sendmsg+0x813/0xb40 [ 1006.152008][ T2334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1006.152037][ T2334] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1006.152069][ T2334] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1006.152092][ T2334] sock_sendmsg_nosec+0x13a/0x180 [ 1006.152125][ T2334] ____sys_sendmsg+0x54e/0x850 [ 1006.152154][ T2334] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1006.152188][ T2334] ? import_iovec+0x73/0xa0 [ 1006.152215][ T2334] ___sys_sendmsg+0x2a5/0x360 [ 1006.152237][ T2334] ? __lock_acquire+0x683/0x2cf0 [ 1006.152268][ T2334] ? __pfx____sys_sendmsg+0x10/0x10 [ 1006.152333][ T2334] ? __fget_files+0x2a/0x420 [ 1006.152357][ T2334] ? __fget_files+0x3a2/0x420 [ 1006.152393][ T2334] __x64_sys_sendmsg+0x1b1/0x290 [ 1006.152420][ T2334] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1006.152463][ T2334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1006.152486][ T2334] do_syscall_64+0x174/0x580 [ 1006.152506][ T2334] ? trace_irq_disable+0x3b/0x140 [ 1006.152536][ T2334] ? clear_bhb_loop+0x40/0x90 [ 1006.152561][ T2334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1006.152580][ T2334] RIP: 0033:0x7f4690d9de59 [ 1006.152599][ T2334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1006.152616][ T2334] RSP: 002b:00007f4691d33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1006.152636][ T2334] RAX: ffffffffffffffda RBX: 00007f4691025fa0 RCX: 00007f4690d9de59 [ 1006.152651][ T2334] RDX: 0000000000008800 RSI: 0000200000003740 RDI: 0000000000000003 [ 1006.152663][ T2334] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 1006.152676][ T2334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1006.152687][ T2334] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 1006.152720][ T2334] [ 1006.680319][ T2336] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8470'. [ 1006.689302][ T2336] netlink: 47 bytes leftover after parsing attributes in process `syz.1.8470'. [ 1006.751240][ T2336] netlink: 'syz.1.8470': attribute type 6 has an invalid length. [ 1006.759129][ T2336] netlink: 47 bytes leftover after parsing attributes in process `syz.1.8470'. [ 1006.903903][ T2348] lo speed is unknown, defaulting to 1000 [ 1006.930456][ T2352] xt_ecn: cannot match TCP bits for non-tcp packets [ 1007.207358][ T2357] FAULT_INJECTION: forcing a failure. [ 1007.207358][ T2357] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1007.238717][ T2357] CPU: 1 UID: 0 PID: 2357 Comm: syz.2.8476 Not tainted syzkaller #0 PREEMPT(full) [ 1007.238743][ T2357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1007.238755][ T2357] Call Trace: [ 1007.238763][ T2357] [ 1007.238771][ T2357] dump_stack_lvl+0xe8/0x150 [ 1007.238806][ T2357] should_fail_ex+0x40c/0x560 [ 1007.238840][ T2357] prepare_alloc_pages+0x230/0x650 [ 1007.238874][ T2357] __alloc_frozen_pages_noprof+0x12f/0x380 [ 1007.238904][ T2357] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1007.238933][ T2357] ? __pfx_policy_nodemask+0x10/0x10 [ 1007.238971][ T2357] alloc_pages_mpol+0x212/0x380 [ 1007.239005][ T2357] folio_alloc_mpol_noprof+0x39/0x160 [ 1007.239036][ T2357] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1007.239067][ T2357] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1007.239107][ T2357] do_wp_page+0x1163/0x4c70 [ 1007.239147][ T2357] ? __pfx_do_wp_page+0x10/0x10 [ 1007.239164][ T2357] ? do_raw_spin_lock+0x12b/0x2f0 [ 1007.239189][ T2357] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1007.239221][ T2357] handle_mm_fault+0x1490/0x3080 [ 1007.239256][ T2357] ? handle_mm_fault+0xec/0x3080 [ 1007.239287][ T2357] ? __pfx_handle_mm_fault+0x10/0x10 [ 1007.239308][ T2357] ? follow_page_pte+0xbd0/0xe70 [ 1007.239342][ T2357] ? __pfx_follow_page_pte+0x10/0x10 [ 1007.239375][ T2357] __get_user_pages+0x1678/0x2720 [ 1007.239446][ T2357] __gup_longterm_locked+0xd52/0x15c0 [ 1007.239480][ T2357] ? sanity_check_pinned_pages+0x817/0x8d0 [ 1007.239516][ T2357] gup_fast_fallback+0x1d8c/0x20e0 [ 1007.239570][ T2357] ? __pfx_gup_fast_fallback+0x10/0x10 [ 1007.239597][ T2357] ? pin_user_pages_fast+0x4d/0xb0 [ 1007.239620][ T2357] iov_iter_extract_pages+0x369/0x5f0 [ 1007.239654][ T2357] extract_iter_to_sg+0xee0/0x25f0 [ 1007.239690][ T2357] ? __pfx_extract_iter_to_sg+0x10/0x10 [ 1007.239712][ T2357] ? __kmalloc_noprof+0x396/0x720 [ 1007.239737][ T2357] ? __kmalloc_noprof+0x1ad/0x720 [ 1007.239759][ T2357] ? sock_kmalloc+0xd6/0x160 [ 1007.239782][ T2357] ? sock_kmalloc+0xd6/0x160 [ 1007.239813][ T2357] ? __asan_memset+0x22/0x50 [ 1007.239838][ T2357] af_alg_get_rsgl+0x493/0x8d0 [ 1007.239993][ T2357] ? af_alg_alloc_areq+0xac/0x200 [ 1007.240024][ T2357] skcipher_recvmsg+0x39d/0xe10 [ 1007.240065][ T2357] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1007.240084][ T2357] ? __lock_acquire+0x683/0x2cf0 [ 1007.240108][ T2357] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1007.240136][ T2357] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1007.240155][ T2357] ? security_socket_recvmsg+0x7e/0x2c0 [ 1007.240176][ T2357] ? __pfx_skcipher_recvmsg+0x10/0x10 [ 1007.240197][ T2357] sock_recvmsg+0x196/0x1e0 [ 1007.240229][ T2357] ____sys_recvmsg+0x1e6/0x4a0 [ 1007.240264][ T2357] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1007.240305][ T2357] ? import_iovec+0x73/0xa0 [ 1007.240332][ T2357] ___sys_recvmsg+0x213/0x5a0 [ 1007.240363][ T2357] ? __pfx____sys_recvmsg+0x10/0x10 [ 1007.240392][ T2357] ? __fget_files+0x2a/0x420 [ 1007.240448][ T2357] ? __fget_files+0x3a2/0x420 [ 1007.240483][ T2357] __x64_sys_recvmsg+0x1ae/0x290 [ 1007.240511][ T2357] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1007.240555][ T2357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.240577][ T2357] do_syscall_64+0x174/0x580 [ 1007.240598][ T2357] ? trace_irq_disable+0x3b/0x140 [ 1007.240622][ T2357] ? clear_bhb_loop+0x40/0x90 [ 1007.240646][ T2357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1007.240667][ T2357] RIP: 0033:0x7f4690d9de59 [ 1007.240685][ T2357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1007.240700][ T2357] RSP: 002b:00007f4691d33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1007.240721][ T2357] RAX: ffffffffffffffda RBX: 00007f4691025fa0 RCX: 00007f4690d9de59 [ 1007.240736][ T2357] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000005 [ 1007.240749][ T2357] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 1007.240761][ T2357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1007.240773][ T2357] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 1007.240807][ T2357] [ 1007.935767][ T2348] lo speed is unknown, defaulting to 1000 [ 1008.072484][ T2379] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 1008.360850][ T2388] FAULT_INJECTION: forcing a failure. [ 1008.360850][ T2388] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1008.410615][ T2388] CPU: 1 UID: 0 PID: 2388 Comm: syz.0.8482 Not tainted syzkaller #0 PREEMPT(full) [ 1008.410640][ T2388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1008.410652][ T2388] Call Trace: [ 1008.410660][ T2388] [ 1008.410669][ T2388] dump_stack_lvl+0xe8/0x150 [ 1008.410702][ T2388] should_fail_ex+0x40c/0x560 [ 1008.410738][ T2388] _copy_from_iter+0x1d3/0x1660 [ 1008.410757][ T2388] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 1008.410783][ T2388] ? rcu_is_watching+0x15/0xb0 [ 1008.410819][ T2388] ? trace_kmem_cache_alloc+0x29/0xe0 [ 1008.410844][ T2388] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 1008.410868][ T2388] ? __pfx__copy_from_iter+0x10/0x10 [ 1008.410888][ T2388] ? __alloc_skb+0x276/0x7a0 [ 1008.410907][ T2388] ? __alloc_skb+0x276/0x7a0 [ 1008.410935][ T2388] ? netlink_sendmsg+0x650/0xb40 [ 1008.410960][ T2388] ? skb_put+0x112/0x210 [ 1008.410984][ T2388] netlink_sendmsg+0x6c0/0xb40 [ 1008.411019][ T2388] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1008.411048][ T2388] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1008.411080][ T2388] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1008.411103][ T2388] sock_sendmsg_nosec+0x13a/0x180 [ 1008.411135][ T2388] ____sys_sendmsg+0x54e/0x850 [ 1008.411165][ T2388] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1008.411197][ T2388] ? import_iovec+0x73/0xa0 [ 1008.411224][ T2388] ___sys_sendmsg+0x2a5/0x360 [ 1008.411247][ T2388] ? __lock_acquire+0x683/0x2cf0 [ 1008.411277][ T2388] ? __pfx____sys_sendmsg+0x10/0x10 [ 1008.411335][ T2388] ? __fget_files+0x2a/0x420 [ 1008.411359][ T2388] ? __fget_files+0x3a2/0x420 [ 1008.411394][ T2388] __x64_sys_sendmsg+0x1b1/0x290 [ 1008.411421][ T2388] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1008.411463][ T2388] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1008.411484][ T2388] do_syscall_64+0x174/0x580 [ 1008.411505][ T2388] ? trace_irq_disable+0x3b/0x140 [ 1008.411530][ T2388] ? clear_bhb_loop+0x40/0x90 [ 1008.411554][ T2388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1008.411574][ T2388] RIP: 0033:0x7f545939de59 [ 1008.411592][ T2388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1008.411610][ T2388] RSP: 002b:00007f545a28d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1008.411631][ T2388] RAX: ffffffffffffffda RBX: 00007f5459626090 RCX: 00007f545939de59 [ 1008.411645][ T2388] RDX: 0000000020000014 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1008.411659][ T2388] RBP: 00007f545a28d090 R08: 0000000000000000 R09: 0000000000000000 [ 1008.411671][ T2388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1008.411683][ T2388] R13: 00007f5459626128 R14: 00007f5459626090 R15: 00007fff9ecfb858 [ 1008.411715][ T2388] [ 1009.209588][ T2396] ipip1: entered promiscuous mode [ 1009.219657][ T2396] ipip1: entered allmulticast mode [ 1009.710212][ T2401] netpci0: tun_chr_ioctl cmd 1074025678 [ 1009.715815][ T2401] netpci0: group set to 0 [ 1009.728816][ T2401] netlink: 36 bytes leftover after parsing attributes in process `syz.1.8487'. [ 1010.027593][ T2418] netlink: 14 bytes leftover after parsing attributes in process `syz.3.8491'. [ 1011.094749][ T2442] FAULT_INJECTION: forcing a failure. [ 1011.094749][ T2442] name failslab, interval 1, probability 0, space 0, times 0 [ 1011.117592][ T2442] CPU: 0 UID: 0 PID: 2442 Comm: syz.3.8498 Not tainted syzkaller #0 PREEMPT(full) [ 1011.117617][ T2442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1011.117628][ T2442] Call Trace: [ 1011.117637][ T2442] [ 1011.117645][ T2442] dump_stack_lvl+0xe8/0x150 [ 1011.117678][ T2442] should_fail_ex+0x40c/0x560 [ 1011.117711][ T2442] should_failslab+0xa8/0x100 [ 1011.117739][ T2442] __kmalloc_cache_noprof+0xa8/0x660 [ 1011.117766][ T2442] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 1011.117798][ T2442] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 1011.117834][ T2442] sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 1011.117863][ T2442] ? sctp_stream_interleave_init+0x55/0x90 [ 1011.117896][ T2442] sctp_association_new+0x15be/0x25d0 [ 1011.117931][ T2442] sctp_connect_new_asoc+0x2e4/0x6b0 [ 1011.117958][ T2442] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1011.117984][ T2442] ? __ipv6_addr_type+0x23d/0x2f0 [ 1011.118018][ T2442] ? sctp_inet6_send_verify+0x6e/0x300 [ 1011.118045][ T2442] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 1011.118078][ T2442] __sctp_connect+0x5cb/0xdc0 [ 1011.118112][ T2442] ? __pfx___sctp_connect+0x10/0x10 [ 1011.118133][ T2442] ? sctp_setsockopt+0x21c/0x12c0 [ 1011.118153][ T2442] ? security_sctp_bind_connect+0x7e/0x2c0 [ 1011.118179][ T2442] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 1011.118210][ T2442] sctp_setsockopt+0x480/0x12c0 [ 1011.118231][ T2442] ? sock_common_setsockopt+0x36/0xc0 [ 1011.118261][ T2442] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1011.118291][ T2442] do_sock_setsockopt+0x17c/0x1b0 [ 1011.118317][ T2442] __x64_sys_setsockopt+0x13d/0x1b0 [ 1011.118340][ T2442] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.118361][ T2442] do_syscall_64+0x174/0x580 [ 1011.118381][ T2442] ? trace_irq_disable+0x3b/0x140 [ 1011.118403][ T2442] ? clear_bhb_loop+0x40/0x90 [ 1011.118426][ T2442] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1011.118445][ T2442] RIP: 0033:0x7f912399de59 [ 1011.118462][ T2442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1011.118477][ T2442] RSP: 002b:00007f9124782028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1011.118498][ T2442] RAX: ffffffffffffffda RBX: 00007f9123c25fa0 RCX: 00007f912399de59 [ 1011.118512][ T2442] RDX: 000000000000006b RSI: 0000000000000084 RDI: 0000000000000003 [ 1011.118524][ T2442] RBP: 00007f9124782090 R08: 000000000000001c R09: 0000000000000000 [ 1011.118536][ T2442] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000001 [ 1011.118548][ T2442] R13: 00007f9123c26038 R14: 00007f9123c25fa0 R15: 00007ffec6dd4538 [ 1011.118579][ T2442] [ 1011.856206][ T2450] syzkaller1: entered promiscuous mode [ 1011.861716][ T2450] syzkaller1: entered allmulticast mode [ 1011.909887][ T2450] openvswitch: netlink: Message has 8 unknown bytes. [ 1011.916613][ T2450] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1012.922072][ T2481] IPv6: sit2: Disabled Multicast RS [ 1013.972092][ T2512] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1014.187513][ T2529] netlink: 'syz.1.8518': attribute type 6 has an invalid length. [ 1014.239752][ T2529] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8518'. [ 1014.588112][ T2555] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8524'. [ 1014.713467][ T2568] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8527'. [ 1014.890186][ T2575] netlink: 32 bytes leftover after parsing attributes in process `syz.4.8529'. [ 1014.978618][ T2583] netlink: 36 bytes leftover after parsing attributes in process `syz.4.8530'. [ 1015.145605][ T2589] bond4: down delay (3) is not a multiple of miimon (100), value rounded to 0 ms [ 1015.154764][ T2589] bond4: peer notification delay (6) is not a multiple of miimon (100), value rounded to 0 ms [ 1015.185135][ T2589] bond4: entered allmulticast mode [ 1015.190639][ T2589] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1015.248492][ T2599] syzkaller0: entered promiscuous mode [ 1015.254353][ T2599] syzkaller0: entered allmulticast mode [ 1015.338280][ T2604] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8536'. [ 1015.605985][ T2607] netlink: 'syz.4.8537': attribute type 3 has an invalid length. [ 1015.638866][ T2614] FAULT_INJECTION: forcing a failure. [ 1015.638866][ T2614] name failslab, interval 1, probability 0, space 0, times 0 [ 1015.651492][ T2614] CPU: 0 UID: 0 PID: 2614 Comm: syz.2.8539 Not tainted syzkaller #0 PREEMPT(full) [ 1015.651515][ T2614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1015.651527][ T2614] Call Trace: [ 1015.651534][ T2614] [ 1015.651543][ T2614] dump_stack_lvl+0xe8/0x150 [ 1015.651577][ T2614] should_fail_ex+0x40c/0x560 [ 1015.651613][ T2614] should_failslab+0xa8/0x100 [ 1015.651641][ T2614] __kmalloc_cache_noprof+0xa8/0x660 [ 1015.651668][ T2614] ? register_netdevice+0x57e/0x1eb0 [ 1015.651693][ T2614] ? register_netdevice+0x57e/0x1eb0 [ 1015.651725][ T2614] register_netdevice+0x57e/0x1eb0 [ 1015.651747][ T2614] ? rcu_is_watching+0x15/0xb0 [ 1015.651780][ T2614] ? alloc_netdev_mqs+0xd45/0x12b0 [ 1015.651806][ T2614] ? __kvmalloc_node_noprof+0x55a/0x860 [ 1015.651834][ T2614] ? __kvmalloc_node_noprof+0x35c/0x860 [ 1015.651858][ T2614] ? __pfx_register_netdevice+0x10/0x10 [ 1015.651889][ T2614] ? validate_linkmsg+0x765/0x950 [ 1015.651927][ T2614] bond_newlink+0x48/0xd0 [ 1015.651953][ T2614] ? __pfx_bond_newlink+0x10/0x10 [ 1015.651980][ T2614] rtnl_newlink_create+0x310/0xb00 [ 1015.652014][ T2614] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1015.652042][ T2614] ? __pfx___mutex_lock+0x10/0x10 [ 1015.652081][ T2614] ? ns_capable+0x89/0xe0 [ 1015.652107][ T2614] rtnl_newlink+0x167f/0x1bd0 [ 1015.652145][ T2614] ? __pfx_rtnl_newlink+0x10/0x10 [ 1015.652162][ T2614] ? do_syscall_64+0x174/0x580 [ 1015.652180][ T2614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1015.652236][ T2614] ? kasan_quarantine_put+0xbb/0x1f0 [ 1015.652258][ T2614] ? lockdep_hardirqs_on+0x7a/0x110 [ 1015.652282][ T2614] ? nlmon_xmit+0xb0/0x100 [ 1015.652301][ T2614] ? kmem_cache_free+0x182/0x650 [ 1015.652337][ T2614] ? __lock_acquire+0x683/0x2cf0 [ 1015.652365][ T2614] ? __dev_queue_xmit+0x29b/0x37f0 [ 1015.652392][ T2614] ? __local_bh_enable_ip+0xd0/0x130 [ 1015.652414][ T2614] ? lockdep_hardirqs_on+0x7a/0x110 [ 1015.652432][ T2614] ? __dev_queue_xmit+0x29b/0x37f0 [ 1015.652453][ T2614] ? __local_bh_enable_ip+0xd0/0x130 [ 1015.652472][ T2614] ? __dev_queue_xmit+0x29b/0x37f0 [ 1015.652503][ T2614] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1015.652539][ T2614] ? __pfx_rtnl_newlink+0x10/0x10 [ 1015.652573][ T2614] rtnetlink_rcv_msg+0x802/0xc00 [ 1015.652596][ T2614] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 1015.652616][ T2614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1015.652635][ T2614] ? ref_tracker_free+0x689/0x830 [ 1015.652657][ T2614] ? __pfx_ref_tracker_free+0x10/0x10 [ 1015.652686][ T2614] netlink_rcv_skb+0x226/0x4a0 [ 1015.652712][ T2614] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1015.652735][ T2614] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1015.652771][ T2614] ? netlink_deliver_tap+0x2e/0x1b0 [ 1015.652794][ T2614] ? netlink_deliver_tap+0x2e/0x1b0 [ 1015.652822][ T2614] netlink_unicast+0x7bb/0x940 [ 1015.652856][ T2614] netlink_sendmsg+0x813/0xb40 [ 1015.652890][ T2614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1015.652918][ T2614] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1015.652949][ T2614] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1015.652970][ T2614] sock_sendmsg_nosec+0x13a/0x180 [ 1015.653001][ T2614] ____sys_sendmsg+0x54e/0x850 [ 1015.653029][ T2614] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1015.653061][ T2614] ? import_iovec+0x73/0xa0 [ 1015.653096][ T2614] ___sys_sendmsg+0x2a5/0x360 [ 1015.653118][ T2614] ? __lock_acquire+0x683/0x2cf0 [ 1015.653147][ T2614] ? __pfx____sys_sendmsg+0x10/0x10 [ 1015.653205][ T2614] ? __fget_files+0x2a/0x420 [ 1015.653230][ T2614] ? __fget_files+0x3a2/0x420 [ 1015.653265][ T2614] __x64_sys_sendmsg+0x1b1/0x290 [ 1015.653291][ T2614] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1015.653331][ T2614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1015.653352][ T2614] do_syscall_64+0x174/0x580 [ 1015.653371][ T2614] ? trace_irq_disable+0x3b/0x140 [ 1015.653395][ T2614] ? clear_bhb_loop+0x40/0x90 [ 1015.653418][ T2614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1015.653438][ T2614] RIP: 0033:0x7f4690d9de59 [ 1015.653456][ T2614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1015.653472][ T2614] RSP: 002b:00007f4691d33028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1015.653492][ T2614] RAX: ffffffffffffffda RBX: 00007f4691025fa0 RCX: 00007f4690d9de59 [ 1015.653506][ T2614] RDX: 0000000020044060 RSI: 0000200000000200 RDI: 0000000000000003 [ 1015.653519][ T2614] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 1015.653531][ T2614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1015.653543][ T2614] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 1015.653573][ T2614] [ 1016.337102][ T2609] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8538'. [ 1016.615291][ T2638] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8548'. [ 1016.632770][ T2638] netlink: 212336 bytes leftover after parsing attributes in process `syz.4.8548'. [ 1016.642081][ T2638] openvswitch: netlink: Message has 16 unknown bytes. [ 1016.668072][ T2630] sctp: [Deprecated]: syz.1.8544 (pid 2630) Use of int in max_burst socket option. [ 1016.668072][ T2630] Use struct sctp_assoc_value instead [ 1016.879099][ T2651] netlink: 'syz.3.8550': attribute type 4 has an invalid length. [ 1016.894203][ T2654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8552'. [ 1016.913198][ T2654] netlink: 'syz.1.8552': attribute type 13 has an invalid length. [ 1016.914797][ T5742] lo speed is unknown, defaulting to 1000 [ 1016.971282][ T2655] netlink: 'syz.0.8551': attribute type 1 has an invalid length. [ 1016.976406][ T5742] syz2: Port: 1 Link ACTIVE [ 1017.016251][ T2655] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1017.137903][ T2664] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1017.149209][ T2665] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8551'. [ 1017.218813][ T2669] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1017.228787][ T2665] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1017.239789][ T2669] gretap1: entered promiscuous mode [ 1017.247935][ T2669] bond4: (slave gretap1): making interface the new active one [ 1017.275764][ T2669] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 1017.363109][ T2672] ip6tnl4: entered allmulticast mode [ 1017.469843][ T2678] netlink: 'syz.0.8557': attribute type 11 has an invalid length. [ 1017.477803][ T2678] netlink: 280 bytes leftover after parsing attributes in process `syz.0.8557'. [ 1017.720160][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1017.734826][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1017.743395][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1017.752566][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1017.760635][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1018.324807][ T2699] netlink: 204 bytes leftover after parsing attributes in process `syz.3.8561'. [ 1018.375197][ T2682] lo speed is unknown, defaulting to 1000 [ 1018.529075][ T2712] SET target dimension over the limit! [ 1018.793587][ T2682] lo speed is unknown, defaulting to 1000 [ 1019.390049][ T2758] netlink: 'syz.0.8577': attribute type 6 has an invalid length. [ 1019.398028][ T2758] netlink: 'syz.0.8577': attribute type 5 has an invalid length. [ 1019.528987][ T2682] bridge0: port 1(bridge_slave_0) entered blocking state [ 1019.536830][ T2682] bridge0: port 1(bridge_slave_0) entered disabled state [ 1019.569669][ T2682] bridge_slave_0: entered allmulticast mode [ 1019.577967][ T2682] bridge_slave_0: entered promiscuous mode [ 1019.586084][ T2682] bridge0: port 2(bridge_slave_1) entered blocking state [ 1019.593160][ T2682] bridge0: port 2(bridge_slave_1) entered disabled state [ 1019.600293][ T2682] bridge_slave_1: entered allmulticast mode [ 1019.607210][ T2682] bridge_slave_1: entered promiscuous mode [ 1019.670273][ T2682] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1019.749051][ T2682] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1019.819426][ T50] Bluetooth: hci0: command tx timeout [ 1019.828662][ T2682] team0: Port device team_slave_0 added [ 1019.837336][ T2682] team0: Port device team_slave_1 added [ 1019.843560][ T2776] tun0: tun_chr_ioctl cmd 1074812117 [ 1019.867962][ T2682] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1019.875048][ T2682] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1019.919937][ T2682] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1019.943147][ T2682] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1019.957849][ T2682] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1019.991101][ T2682] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1020.073504][ T2682] hsr_slave_0: entered promiscuous mode [ 1020.080759][ T2682] hsr_slave_1: entered promiscuous mode [ 1020.087024][ T2682] debugfs: 'hsr0' already exists in 'hsr' [ 1020.103008][ T2785] __nla_validate_parse: 8 callbacks suppressed [ 1020.103023][ T2785] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8583'. [ 1020.120309][ T2682] Cannot create hsr debugfs directory [ 1020.220288][ T2792] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8584'. [ 1020.280441][ T2795] netlink: 24 bytes leftover after parsing attributes in process `syz.1.8586'. [ 1020.292938][ T2795] netlink: 'syz.1.8586': attribute type 4 has an invalid length. [ 1021.585132][ T2848] netlink: 'syz.0.8599': attribute type 21 has an invalid length. [ 1021.609775][ T2848] netlink: 164 bytes leftover after parsing attributes in process `syz.0.8599'. [ 1021.623521][ T2682] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1021.635512][ T2682] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1021.658019][ T2682] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1021.668301][ T2682] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1021.678861][ T2682] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1021.689787][ T2682] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1021.697844][ T2682] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1021.707639][ T2682] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1021.863736][ T2682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1021.899058][ T2682] 8021q: adding VLAN 0 to HW filter on device team0 [ 1021.960579][T17380] bridge0: port 1(bridge_slave_0) entered blocking state [ 1021.967720][T17380] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1021.995600][ T50] Bluetooth: hci0: command tx timeout [ 1022.037061][ T2879] Cannot find del_set index 3 as target [ 1022.045209][ T2876] netlink: 32 bytes leftover after parsing attributes in process `syz.3.8602'. [ 1022.084669][ T1604] bridge0: port 2(bridge_slave_1) entered blocking state [ 1022.091848][ T1604] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1022.916764][ T2913] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8614'. [ 1022.991545][ T2920] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8614'. [ 1023.044969][ T2923] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8614'. [ 1023.122981][ T2927] netlink: 'syz.0.8616': attribute type 1 has an invalid length. [ 1023.125127][ T2682] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1023.171459][ T2927] bond6: option mode: invalid value (7) [ 1023.178971][ T2927] bond6 (unregistering): Released all slaves [ 1023.226284][ T2932] netlink: 'syz.0.8616': attribute type 10 has an invalid length. [ 1023.234123][ T2932] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8616'. [ 1023.243160][ T2932] dummy0: entered promiscuous mode [ 1023.263069][ T2932] team0: Port device dummy0 removed [ 1023.588801][ T2942] netlink: 1028 bytes leftover after parsing attributes in process `syz.0.8618'. [ 1023.611781][ T2942] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 1023.669701][ T2682] veth0_vlan: entered promiscuous mode [ 1023.681467][ T2682] veth1_vlan: entered promiscuous mode [ 1023.712829][ T2682] veth0_macvtap: entered promiscuous mode [ 1023.777357][ T2682] veth1_macvtap: entered promiscuous mode [ 1023.817340][ T2682] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1023.865660][ T2682] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1023.886853][ T1601] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1023.895958][ T1601] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1023.920026][ T1601] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1023.929628][ T1601] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1024.071585][ T50] Bluetooth: hci0: command tx timeout [ 1024.115575][ T1602] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1024.124658][ T1602] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1024.149121][T17380] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1024.160449][T17380] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1026.149586][ T50] Bluetooth: hci0: command tx timeout [ 1027.019728][ C1] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 1031.500191][ T1669] block nbd3: Possible stuck request ffff888028750000: control (read@0,1024B). Runtime 300 seconds [ 1034.059546][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 1051.299535][ T2960] syzkaller0: entered promiscuous mode [ 1051.330669][ T2960] syzkaller0: entered allmulticast mode [ 1051.385900][ T2956] lo speed is unknown, defaulting to 1000 [ 1051.476897][ T2955] lo speed is unknown, defaulting to 1000 [ 1051.491175][ T2968] __nla_validate_parse: 1 callbacks suppressed [ 1051.491190][ T2968] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8626'. [ 1051.539470][ T2970] syzkaller1: entered promiscuous mode [ 1051.544962][ T2970] syzkaller1: entered allmulticast mode [ 1051.770425][ T2956] lo speed is unknown, defaulting to 1000 [ 1051.957777][ T2980] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1051.978029][ T2978] netlink: 'syz.0.8630': attribute type 49 has an invalid length. [ 1052.108827][ T2955] lo speed is unknown, defaulting to 1000 [ 1052.509740][ T2997] syzkaller0: entered promiscuous mode [ 1052.515248][ T2997] syzkaller0: entered allmulticast mode [ 1052.643030][ T3007] netlink: 204 bytes leftover after parsing attributes in process `syz.0.8640'. [ 1052.653248][ T3007] netlink: 84 bytes leftover after parsing attributes in process `syz.0.8640'. [ 1052.704890][ T3011] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8639'. [ 1053.072152][ T3021] FAULT_INJECTION: forcing a failure. [ 1053.072152][ T3021] name failslab, interval 1, probability 0, space 0, times 0 [ 1053.086745][ T3021] CPU: 1 UID: 0 PID: 3021 Comm: syz.2.8642 Not tainted syzkaller #0 PREEMPT(full) [ 1053.086788][ T3021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1053.086810][ T3021] Call Trace: [ 1053.086818][ T3021] [ 1053.086827][ T3021] dump_stack_lvl+0xe8/0x150 [ 1053.086862][ T3021] should_fail_ex+0x40c/0x560 [ 1053.086898][ T3021] should_failslab+0xa8/0x100 [ 1053.086928][ T3021] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 1053.086950][ T3021] ? local_lock_release+0x9c/0x160 [ 1053.086973][ T3021] ? __alloc_skb+0x1d7/0x7a0 [ 1053.086991][ T3021] ? __alloc_skb+0x1d7/0x7a0 [ 1053.087018][ T3021] __alloc_skb+0x1d7/0x7a0 [ 1053.087044][ T3021] skb_segment+0xf87/0x41d0 [ 1053.087070][ T3021] ? is_bpf_text_address+0x292/0x2b0 [ 1053.087107][ T3021] ? unwind_get_return_address+0x4d/0x90 [ 1053.087133][ T3021] ? __lock_acquire+0x683/0x2cf0 [ 1053.087181][ T3021] __udp_gso_segment+0x9ed/0x3bf0 [ 1053.087213][ T3021] ? __pfx_sock_wfree+0x10/0x10 [ 1053.087246][ T3021] ? udp4_ufo_fragment+0x520/0x8e0 [ 1053.087280][ T3021] inet_gso_segment+0x653/0x14c0 [ 1053.087315][ T3021] ? __pfx_inet_gso_segment+0x10/0x10 [ 1053.087338][ T3021] skb_mac_gso_segment+0x31c/0x690 [ 1053.087365][ T3021] ? skb_mac_gso_segment+0x182/0x690 [ 1053.087396][ T3021] ? __pfx_skb_mac_gso_segment+0x10/0x10 [ 1053.087423][ T3021] ? __pfx_netif_skb_features+0x10/0x10 [ 1053.087455][ T3021] __skb_gso_segment+0x371/0x550 [ 1053.087481][ T3021] ? __dev_queue_xmit+0x29b/0x37f0 [ 1053.087510][ T3021] validate_xmit_skb+0xa5b/0x14f0 [ 1053.087546][ T3021] __dev_queue_xmit+0xb04/0x37f0 [ 1053.087581][ T3021] ? ___neigh_create+0x1cd2/0x22b0 [ 1053.087600][ T3021] ? __dev_queue_xmit+0x29b/0x37f0 [ 1053.087625][ T3021] ? lockdep_hardirqs_on+0x7a/0x110 [ 1053.087651][ T3021] ? __pfx___dev_queue_xmit+0x10/0x10 [ 1053.087677][ T3021] ? neigh_connected_output+0x1e7/0x470 [ 1053.087700][ T3021] ? neigh_connected_output+0x1e7/0x470 [ 1053.087723][ T3021] ? read_seqbegin+0xac/0x180 [ 1053.087741][ T3021] ? neigh_connected_output+0x1e7/0x470 [ 1053.087787][ T3021] ? ip_finish_output2+0x3de/0x10b0 [ 1053.087815][ T3021] ip_finish_output2+0xc4b/0x10b0 [ 1053.087836][ T3021] ? skb_gso_validate_network_len+0x12f/0x2a0 [ 1053.087861][ T3021] ? ip_finish_output2+0x3de/0x10b0 [ 1053.087885][ T3021] ? ip_finish_output+0x1c6/0x530 [ 1053.087910][ T3021] ip_output+0x29f/0x450 [ 1053.087929][ T3021] ? ip_output+0x5a/0x450 [ 1053.087950][ T3021] ip_send_skb+0x45/0xc0 [ 1053.087972][ T3021] udp_send_skb+0x7f7/0xfb0 [ 1053.088007][ T3021] udp_sendmsg+0x1971/0x2140 [ 1053.088040][ T3021] ? tomoyo_check_inet_address+0x6b5/0x930 [ 1053.088076][ T3021] ? __pfx_udp_sendmsg+0x10/0x10 [ 1053.088095][ T3021] ? tomoyo_check_inet_address+0x27f/0x930 [ 1053.088163][ T3021] ? sock_rps_record_flow+0x19/0x350 [ 1053.088187][ T3021] ? inet_sendmsg+0x23e/0x320 [ 1053.088210][ T3021] ? __pfx_inet_sendmsg+0x10/0x10 [ 1053.088228][ T3021] sock_sendmsg_nosec+0x10e/0x180 [ 1053.088259][ T3021] ____sys_sendmsg+0x54e/0x850 [ 1053.088289][ T3021] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1053.088323][ T3021] ? import_iovec+0x73/0xa0 [ 1053.088350][ T3021] ___sys_sendmsg+0x2a5/0x360 [ 1053.088372][ T3021] ? __lock_acquire+0x683/0x2cf0 [ 1053.088402][ T3021] ? __pfx____sys_sendmsg+0x10/0x10 [ 1053.088432][ T3021] ? kstrtouint+0x6e/0xe0 [ 1053.088488][ T3021] ? __fget_files+0x2a/0x420 [ 1053.088512][ T3021] ? __fget_files+0x3a2/0x420 [ 1053.088548][ T3021] __sys_sendmmsg+0x273/0x4d0 [ 1053.088579][ T3021] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1053.088613][ T3021] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1053.088650][ T3021] ? ksys_write+0x242/0x270 [ 1053.088681][ T3021] ? __pfx_ksys_write+0x10/0x10 [ 1053.088716][ T3021] __x64_sys_sendmmsg+0xa0/0xc0 [ 1053.088740][ T3021] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.088760][ T3021] do_syscall_64+0x174/0x580 [ 1053.088780][ T3021] ? trace_irq_disable+0x3b/0x140 [ 1053.088819][ T3021] ? clear_bhb_loop+0x40/0x90 [ 1053.088843][ T3021] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1053.088863][ T3021] RIP: 0033:0x7f4690d9de59 [ 1053.088881][ T3021] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1053.088898][ T3021] RSP: 002b:00007f4691d33028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1053.088917][ T3021] RAX: ffffffffffffffda RBX: 00007f4691025fa0 RCX: 00007f4690d9de59 [ 1053.088932][ T3021] RDX: 0000000000000001 RSI: 00002000000051c0 RDI: 0000000000000003 [ 1053.088944][ T3021] RBP: 00007f4691d33090 R08: 0000000000000000 R09: 0000000000000000 [ 1053.088956][ T3021] R10: 0000000004000004 R11: 0000000000000246 R12: 0000000000000002 [ 1053.088968][ T3021] R13: 00007f4691026038 R14: 00007f4691025fa0 R15: 00007fff0c486108 [ 1053.089001][ T3021] [ 1054.238091][ T3026] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8643'. [ 1054.576827][ T1318] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1054.760084][ T3043] netlink: 204 bytes leftover after parsing attributes in process `syz.1.8651'. [ 1054.771987][ T3043] netlink: 84 bytes leftover after parsing attributes in process `syz.1.8651'. [ 1054.774010][ T3042] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8650'. [ 1054.918830][ T3042] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1054.965872][ T3046] bond6: (slave syz_tun): Enslaving as an active interface with an up link [ 1055.005330][ T3042] vlan4: entered allmulticast mode [ 1055.031726][ T3042] bond6: entered allmulticast mode [ 1055.097644][ T3052] SET target dimension over the limit! [ 1055.110231][ T3052] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8653'. [ 1055.119746][ T3052] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8653'. [ 1055.401765][ T3055] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.532509][ T3059] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1055.542141][ T3059] bond7: (slave bond8): Enslaving as an active interface with an up link [ 1056.208122][ T3055] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1056.413413][ T3096] bond7: entered promiscuous mode [ 1056.418867][ T3096] 8021q: adding VLAN 0 to HW filter on device bond7 [ 1056.461535][ T31] INFO: task udevd:26098 blocked in I/O wait for more than 143 seconds. [ 1056.484444][ T31] Not tainted syzkaller #0 [ 1056.500515][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1056.532133][ T31] task:udevd state:D stack:26160 pid:26098 tgid:26098 ppid:4992 task_flags:0x400140 flags:0x00080002 [ 1056.558738][ T31] Call Trace: [ 1056.562042][ T31] [ 1056.564985][ T31] __schedule+0x17d9/0x56c0 [ 1056.569529][ T31] ? __lock_acquire+0x683/0x2cf0 [ 1056.574499][ T31] ? __pfx___schedule+0x10/0x10 [ 1056.579380][ T31] ? schedule+0x90/0x2b0 [ 1056.583644][ T31] schedule+0x164/0x2b0 [ 1056.587818][ T31] io_schedule+0x7f/0xd0 [ 1056.592074][ T31] folio_wait_bit_common+0x836/0xbc0 [ 1056.597377][ T31] ? filemap_get_entry+0xcd/0x3f0 [ 1056.602421][ T31] ? __pfx_folio_wait_bit_common+0x10/0x10 [ 1056.608252][ T31] ? filemap_read_folio+0x234/0x3a0 [ 1056.613466][ T31] ? __pfx_wake_page_function+0x10/0x10 [ 1056.619077][ T31] ? __filemap_get_folio_mpol+0x7c8/0x1000 [ 1056.625068][ T31] do_read_cache_folio+0x1ac/0x590 [ 1056.633633][ T31] ? __pfx_blkdev_read_folio+0x10/0x10 [ 1056.639223][ T31] read_part_sector+0xb6/0x2b0 [ 1056.644232][ T31] adfspart_check_POWERTEC+0x9a/0x7a0 [ 1056.649758][ T31] ? __pfx_adfspart_check_ICS+0x10/0x10 [ 1056.655323][ T31] ? __pfx_adfspart_check_POWERTEC+0x10/0x10 [ 1056.661388][ T31] ? bdev_disk_changed+0x56c/0x17a0 [ 1056.666605][ T31] ? bdev_disk_changed+0x56c/0x17a0 [ 1056.671960][ T31] bdev_disk_changed+0x851/0x17a0 [ 1056.677013][ T31] ? __pfx_bdev_disk_changed+0x10/0x10 [ 1056.682608][ T31] blkdev_get_whole+0x372/0x510 [ 1056.687479][ T31] bdev_open+0x324/0xd70 [ 1056.691890][ T31] blkdev_open+0x461/0x600 [ 1056.696329][ T31] ? __pfx_blkdev_open+0x10/0x10 [ 1056.701621][ T31] do_dentry_open+0x816/0x1380 [ 1056.706409][ T31] vfs_open+0x3b/0x340 [ 1056.710471][ T31] ? path_openat+0x2e2d/0x3830 [ 1056.715222][ T31] path_openat+0x2e44/0x3830 [ 1056.719814][ T31] ? kasan_save_track+0x3e/0x80 [ 1056.724675][ T31] ? do_sys_openat2+0xcc/0x200 [ 1056.729450][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.744922][ T31] do_file_open+0x23e/0x4a0 [ 1056.749593][ T31] ? __pfx_do_file_open+0x10/0x10 [ 1056.754663][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1056.759530][ T31] ? alloc_fd+0x651/0x6c0 [ 1056.763883][ T31] do_sys_openat2+0x115/0x200 [ 1056.768575][ T31] ? net_tx_action+0x5bb/0xc30 [ 1056.773351][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1056.778562][ T31] ? __irq_exit_rcu+0xca/0x220 [ 1056.790356][ T31] ? handle_softirqs+0x70f/0x840 [ 1056.795328][ T31] __x64_sys_openat+0x138/0x170 [ 1056.800189][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.806241][ T31] do_syscall_64+0x174/0x580 [ 1056.810823][ T31] ? clear_bhb_loop+0x40/0x90 [ 1056.815498][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.821394][ T31] RIP: 0033:0x7fecd92a7407 [ 1056.825796][ T31] RSP: 002b:00007ffd151589e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1056.834189][ T31] RAX: ffffffffffffffda RBX: 00007fecd99f2880 RCX: 00007fecd92a7407 [ 1056.842145][ T31] RDX: 00000000000a0800 RSI: 000055e005ddd360 RDI: ffffffffffffff9c [ 1056.873342][ T31] RBP: 000055e005ddc910 R08: 0000000000000000 R09: 0000000000000000 [ 1056.881336][ T31] R10: 0000000000000000 R11: 0000000000000202 R12: 000055e005df1830 [ 1056.889315][ T31] R13: 000055e005dea190 R14: 0000000000000000 R15: 000055e005df1830 [ 1056.899418][ T31] [ 1056.902696][ T31] [ 1056.902696][ T31] Showing all locks held in the system: [ 1056.905279][ T3055] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1056.920757][ T31] 1 lock held by khungtaskd/31: [ 1056.930852][ T31] #0: ffffffff8eb59c20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1056.941312][ T31] 2 locks held by getty/5380: [ 1056.946055][ T31] #0: ffff888032b760a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1056.966014][ T31] #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 [ 1056.989153][ T31] 1 lock held by udevd/26098: [ 1056.995215][ T31] #0: ffff888028672350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xde/0xd70 [ 1057.004511][ T31] 5 locks held by kworker/u8:2/1601: [ 1057.009801][ T31] 3 locks held by kworker/u8:8/1608: [ 1057.015235][ T31] #0: ffff88801b06c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1057.026970][ T31] #1: ffffc90005a6fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 1057.038124][ T31] #2: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1057.047269][ T31] 5 locks held by syz.2.8654/3055: [ 1057.052377][ T31] #0: ffffffff90099f68 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1057.060596][ T31] #1: ffff888043b41128 (&dev->mutex){....}-{4:4}, at: devlink_get_from_attrs_lock+0x34a/0x490 [ 1057.080711][ T31] #2: ffff888078d39258 (&devlink->lock_key#13){+.+.}-{4:4}, at: devlink_get_from_attrs_lock+0x360/0x490 [ 1057.093305][ T31] #3: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x16b/0x800 [ 1057.102372][ T31] #4: ffffffff8eb5ff28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1057.113316][ T31] 2 locks held by syz.0.8664/3096: [ 1057.118429][ T31] #0: ffffffff90099f68 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1057.126648][ T31] #1: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5e/0x890 [ 1057.135902][ T31] 4 locks held by syz.0.8664/3102: [ 1057.141010][ T31] #0: ffffffff90099f68 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1057.149221][ T31] #1: ffff888038acd6e8 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xf4/0x7b0 [ 1057.159683][ T31] #2: ffffffff90099da0 (genl_mutex){+.+.}-{4:4}, at: genl_dumpit+0xdb/0x1b0 [ 1057.168494][ T31] #3: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: nl802154_prepare_wpan_dev_dump+0x4b/0x450 [ 1057.179059][ T31] 1 lock held by syz.1.8666/3104: [ 1057.184081][ T31] #0: ffffffff8eb5ff28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 1057.208221][ T31] 2 locks held by syz.3.8668/3112: [ 1057.213363][ T31] #0: ffffffff8f775248 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1057.222905][ T31] #1: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 1057.231940][ T31] 2 locks held by syz.3.8668/3115: [ 1057.237030][ T31] #0: ffffffff8f775248 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1057.246500][ T31] #1: ffffffff90029840 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 1057.260770][ T31] [ 1057.263878][ T31] ============================================= [ 1057.263878][ T31] [ 1057.272905][ T31] NMI backtrace for cpu 0 [ 1057.272920][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1057.272941][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1057.272951][ T31] Call Trace: [ 1057.272959][ T31] [ 1057.272967][ T31] dump_stack_lvl+0xe8/0x150 [ 1057.272997][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1057.273027][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1057.273081][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 1057.273109][ T31] sys_info+0x135/0x170 [ 1057.273132][ T31] watchdog+0xfd7/0x1030 [ 1057.273163][ T31] ? watchdog+0x1c7/0x1030 [ 1057.273191][ T31] kthread+0x388/0x470 [ 1057.273217][ T31] ? __pfx_watchdog+0x10/0x10 [ 1057.273236][ T31] ? __pfx_kthread+0x10/0x10 [ 1057.273262][ T31] ret_from_fork+0x514/0xb70 [ 1057.273290][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1057.273315][ T31] ? __switch_to+0xc89/0x1420 [ 1057.273341][ T31] ? __pfx_kthread+0x10/0x10 [ 1057.273367][ T31] ret_from_fork_asm+0x1a/0x30 [ 1057.273409][ T31] [ 1057.273418][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1057.394419][ C1] NMI backtrace for cpu 1 [ 1057.394434][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 1057.394454][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1057.394464][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1057.394488][ C1] Code: 7c 82 02 e9 53 04 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 a9 1c 00 fb f4 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 1057.394503][ C1] RSP: 0018:ffffc90000197e40 EFLAGS: 00000242 [ 1057.394518][ C1] RAX: 0000000000293d2f RBX: ffffffff819ac370 RCX: 0000000080000001 [ 1057.394531][ C1] RDX: 0000000000000001 RSI: ffffffff8e22653c RDI: ffffffff8c4bba80 [ 1057.394543][ C1] RBP: ffffc90000197f10 R08: ffff8880b87338db R09: 1ffff110170e671b [ 1057.394556][ C1] R10: dffffc0000000000 R11: ffffed10170e671c R12: 0000000000000000 [ 1057.394568][ C1] R13: 1ffff11003bdf000 R14: 1ffff92000032fd0 R15: dffffc0000000000 [ 1057.394581][ C1] FS: 0000000000000000(0000) GS:ffff888125063000(0000) knlGS:0000000000000000 [ 1057.394598][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1057.394610][ C1] CR2: 00007fd9c4fef4b8 CR3: 00000000334f6000 CR4: 00000000003526f0 [ 1057.394625][ C1] Call Trace: [ 1057.394632][ C1] [ 1057.394639][ C1] default_idle+0x9/0x20 [ 1057.394659][ C1] default_idle_call+0x72/0xb0 [ 1057.394680][ C1] do_idle+0x2e0/0x540 [ 1057.394703][ C1] ? __pfx_do_idle+0x10/0x10 [ 1057.394727][ C1] ? do_idle+0x4d1/0x540 [ 1057.394749][ C1] cpu_startup_entry+0x43/0x60 [ 1057.394771][ C1] start_secondary+0x101/0x110 [ 1057.394793][ C1] common_startup_64+0x13e/0x157 [ 1057.394821][ C1] [ 1057.450501][ T3096] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 1057.479575][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1057.479594][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1057.479616][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1057.479627][ T31] Call Trace: [ 1057.479636][ T31] [ 1057.479644][ T31] vpanic+0x56c/0xa60 [ 1057.479677][ T31] ? __pfx___schedule+0x10/0x10 [ 1057.479708][ T31] ? __pfx_vpanic+0x10/0x10 [ 1057.479735][ T31] ? nmi_trigger_cpumask_backtrace+0x207/0x380 [ 1057.479770][ T31] panic+0xc5/0xd0 [ 1057.479797][ T31] ? __pfx_panic+0x10/0x10 [ 1057.479822][ T31] ? preempt_schedule_common+0x82/0xd0 [ 1057.479842][ T31] ? preempt_schedule_thunk+0x16/0x40 [ 1057.479864][ T31] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 1057.479894][ T31] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 1057.479924][ T31] watchdog+0x1030/0x1030 [ 1057.479954][ T31] ? watchdog+0x1c7/0x1030 [ 1057.479983][ T31] kthread+0x388/0x470 [ 1057.480009][ T31] ? __pfx_watchdog+0x10/0x10 [ 1057.480030][ T31] ? __pfx_kthread+0x10/0x10 [ 1057.480056][ T31] ret_from_fork+0x514/0xb70 [ 1057.480086][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1057.480113][ T31] ? __switch_to+0xc89/0x1420 [ 1057.480138][ T31] ? __pfx_kthread+0x10/0x10 [ 1057.480165][ T31] ret_from_fork_asm+0x1a/0x30 [ 1057.480199][ T31] [ 1057.485090][ T31] Kernel Offset: disabled