last executing test programs: 3.560791685s ago: executing program 1 (id=11011): sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xf) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000100000000000000", @ANYRES32=r1, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 2.557715534s ago: executing program 4 (id=11024): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)={0x3c, r1, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x400003}]}, 0x3c}}, 0x20000018) 2.476271583s ago: executing program 4 (id=11025): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4040090) (async, rerun: 32) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async, rerun: 32) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) (async, rerun: 64) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000500)='syzkaller\x00'}, 0x94) (async, rerun: 64) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) (async) sendmsg$inet(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="f1", 0x1}], 0x1}, 0x40) (async) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000040)={r4, r3}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) r7 = socket$kcm(0x29, 0x5, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000000), 0xffffff6a) (async, rerun: 64) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r6) (async, rerun: 64) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x10, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000093000000000006000000859600006100000085000000070000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) sendfile(r7, r8, 0x0, 0xffffffff000) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="3f713da207af717f0c5093ff374fab062388a190874c355b0eafe13bf7a448a6201a662ed21e005abcb3c5631ca5988d2b1300b0ce34e71b26da95cf1c197aa39b8ba4d92d44738fa0a1d763966ff31f8cfc10bf7ab052f41834", @ANYRES16=r10, @ANYBLOB="7961fdffffff0004000000000000000099006c910000e02425a0af74e42b92d4c3b9adf5bfc424a4484b7b9ce94379d9edc4229361d1c68a489b6c9b349923dd4979a8cd2d50803d4a17fd197be907317cc24664b3fa328d7c5359c8037e1e9dc55703cd4c0e83cd20bc50285d697570b3828de9c44e6886c73ff36721fc1db017c42ac6b892ac1d"], 0x20}, 0x1, 0x0, 0x0, 0x20008081}, 0x4000054) (async) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r10, 0x4, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) r11 = socket$kcm(0x29, 0x5, 0x0) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) write$cgroup_pressure(r11, &(0x7f0000000140)={'full'}, 0xfffffdef) (async) ioctl$AUTOFS_IOC_CATATONIC(r5, 0x9362, 0x0) 2.435357402s ago: executing program 1 (id=11026): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000080)=0x9, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x8}}}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}, 0x11}], 0x400000000000172, 0x4001c00) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x20, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000009001008000000000095000500"/32], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) unshare(0x400) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="0000181100"/20, @ANYRES8=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @remote}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000040), 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x13, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000041fffff900000000080000009111"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xd50, 0xfffffffffffffee0, &(0x7f0000000000)="259a53f271a76d2608004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff3}, {0x7, 0xfff3}, {0xb, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x14, 0x2, [@TCA_BASIC_EMATCHES={0x10, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8}, @TCA_EMATCH_TREE_LIST={0x4}]}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000001100000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000c40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r6, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000280)="01000000f3ffffffde31c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$RDS_RECVERR(0xffffffffffffffff, 0x114, 0x5, &(0x7f0000000180)=0x1, 0x4) 2.321296291s ago: executing program 4 (id=11028): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000000700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6erspan0\x00', 0x0}) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05", @ANYRES64=r4, @ANYBLOB="4f4848d4b2f5ea1d1f5ce8ce5ad71fd2a413771ca105a136b88751fc5c6619ba751e12b9a174c3d695ea404535d0c66a692a54b6d67b271f3836c02f8d1061fe92adae262d63af14ce7a0e94c9e7c78966a206cf0f0da25f66fc8f658bb6b421b73441f3c29ec5f7ac8b1442ce9f4a8dbc901448c0a2474ad5b078a6fdc26287a45acfb9c82deb525a6fe36766931d7d7a709cf9fc4c"], 0x10) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000000c0)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05", @ANYRES64=r4, @ANYBLOB="4f4848d4b2f5ea1d1f5ce8ce5ad71fd2a413771ca105a136b88751fc5c6619ba751e12b9a174c3d695ea404535d0c66a692a54b6d67b271f3836c02f8d1061fe92adae262d63af14ce7a0e94c9e7c78966a206cf0f0da25f66fc8f658bb6b421b73441f3c29ec5f7ac8b1442ce9f4a8dbc901448c0a2474ad5b078a6fdc26287a45acfb9c82deb525a6fe36766931d7d7a709cf9fc4c"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 2.031645038s ago: executing program 4 (id=11030): r0 = epoll_create1(0x80000) r1 = socket(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) write$cgroup_pid(r2, &(0x7f00000004c0), 0x12) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) getsockopt(r1, 0x200000000114, 0x2710, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7, 0x11, r1, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000000)={0x20000000}) 1.879061921s ago: executing program 4 (id=11031): r0 = epoll_create1(0x80000) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)={0x20000000}) (fail_nth: 25) 1.486673116s ago: executing program 4 (id=11035): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket(0x1, 0x1, 0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x2c, r4, 0x100, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20004825}, 0x0) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000500)={0x3c, r3, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d5}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_STATICLIST(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r5, 0x20, 0x70bd27, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r6, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) 1.42829535s ago: executing program 2 (id=11036): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@dstopts_2292={{0x18, 0x29, 0x3b}}, @rthdr_2292={{0x28, 0x29, 0x5, {0x0, 0x2, 0x2, 0x1, 0x0, [@remote]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x3}}], 0x58}, 0x0) (fail_nth: 6) 1.327249279s ago: executing program 2 (id=11038): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd7000000000000200001708000300", @ANYRES32=r1, @ANYBLOB="08002600fd16"], 0x34}, 0x1, 0x0, 0x0, 0x48010}, 0x40044) 1.326746268s ago: executing program 1 (id=11039): sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004000}, 0x4005000) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000100)="480000001400195a85", 0x9}], 0x1) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x40040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000017000000540006803c00040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 1.279651996s ago: executing program 2 (id=11040): ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)={0x38, r2, 0x1, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x4, 0x5, 0x7, 0x7, 0x8000, 0x400, 0x4]}}]}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$kcm(0x15, 0x5, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x14, 0x66, 0xa01, 0x0, 0x0, {0x80}}, 0x14}}, 0x0) sendmsg$kcm(r4, &(0x7f0000000100)={&(0x7f0000000080)=@rc={0xa}, 0x80, 0x0}, 0x0) sendmsg$NL80211_CMD_SET_MPATH(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r2, 0x8, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x4a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x8000) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010102, @remote}, {0x11, 0xff, 0x0, @empty}}}}}, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001280)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0x1, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0xfffffffd}, 0x50) 1.227815705s ago: executing program 3 (id=11041): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x401, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0xfeffffff, 0x34}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xffffffffffffff58, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}, @IFLA_GRE_ENCAP_FLAGS={0x6}]}}}]}, 0x48}}, 0x0) 1.140998887s ago: executing program 1 (id=11043): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000003c0000810000000008000f0001000000", 0x24) 1.067543944s ago: executing program 3 (id=11044): socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@deltaction={0x14, 0x31, 0x8, 0x70bd26, 0x25dfdbfb}, 0x14}}, 0x0) (async, rerun: 32) r0 = socket$rxrpc(0x21, 0x2, 0xa) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) (async) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8}]}]}, 0x28}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32, @ANYRES8=r0], 0x28}}, 0x0) (async) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.067068252s ago: executing program 2 (id=11045): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000840000001"], 0x48) close(0x4) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000001000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 882.803464ms ago: executing program 1 (id=11047): r0 = socket$nl_rdma(0x10, 0x3, 0x14) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0x439, 0x0, 0x2, {0x0, 0x0, 0xe403, 0x0, 0x62a1}}, 0x20}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r1, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f00000003c0)=@framed={{}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}]}, &(0x7f0000000240)='GPL\x00', 0x4, 0x1009, &(0x7f0000002500)=""/4105, 0x0, 0x68}, 0x94) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="18000000071401"], 0x18}}, 0x0) 823.626281ms ago: executing program 0 (id=11048): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000040)={&(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback={0x7ffffff7}}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@dstopts_2292={{0x18, 0x29, 0x3b}}, @rthdr_2292={{0x28, 0x29, 0x5, {0x0, 0x2, 0x2, 0x1, 0x0, [@remote]}}}, @hoplimit={{0x14, 0x29, 0x34, 0x3}}], 0x58}, 0x0) 823.234704ms ago: executing program 3 (id=11049): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0xffffffff, 0x0, {{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x1}, {}, {}, 0x4, 0x0, 0x0, 0x0, 0x5ee76b3ce2b5fd32}, [@tmpl={0x44, 0x5, [{{@in6=@dev={0xfe, 0x80, '\x00', 0xa}, 0x0, 0x33}, 0x8, @in6=@private1, 0x80ffffff, 0x5}]}]}, 0xfc}}, 0x816) 777.183487ms ago: executing program 0 (id=11050): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000e00)=@newtaction={0x18, 0x32, 0x12f, 0x3f, 0x25dfdbfe, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4044840}, 0x44004) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000340), &(0x7f00000000c0)=0x1c, 0x800) ioctl$int_in(r1, 0x5452, &(0x7f0000000100)=0x5) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r6, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xdd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r3, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r4, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x91) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000002, 0x110, r2, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x577801, 0x100408) 720.359724ms ago: executing program 3 (id=11051): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x8, 0x3, 0x2f8, 0x0, 0xffffffff, 0xffffffff, 0xc8, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x37}, @ipv4={'\x00', '\xff\xff', @private=0xa010102}, [0xff000000, 0x0, 0xff000000, 0xffffff00], [0xffffffff, 0xffffffff, 0xffffffff], 'erspan0\x00', 'team_slave_0\x00', {}, {0xff}, 0x1d, 0x3, 0x3, 0xec1b610eadf03716}, 0x0, 0xa8, 0xc8, 0x60030000, {0x0, 0xff000000}}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@inet=@set2={{0x28}, {{0x2802, 0x2, 0x1}}}, @common=@hl={{0x28}, {0x2, 0x5}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1, 0x7, 0x9, 0x87, 'pptp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) 667.700806ms ago: executing program 1 (id=11052): sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0xf) socket$inet6_sctp(0xa, 0x5, 0x84) r0 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c00000010008506000000000200000000000000", @ANYRES32=r1, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 633.660341ms ago: executing program 2 (id=11053): socket$inet6(0xa, 0x800000000000002, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@ipv6_newrule={0x2c, 0x20, 0x1, 0x70bd27, 0x25dfdbfb, {0xa, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x7, 0x6}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x4, 0x4}, @FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x10}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24048860}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, 0x0, 0x8010) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newlink={0x3c, 0x10, 0x437, 0x70bd27, 0x0, {0x0, 0x0, 0x0, r3, 0x50561}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r1, &(0x7f0000000340)=[{{&(0x7f00000002c0)=@xdp={0x2c, 0xa888, r3, 0x7}, 0x14, 0x0}}], 0x1, 0x80) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x6, 0xc, &(0x7f00000008c0)=ANY=[@ANYBLOB="180200000400000000000000000000008500000041000000180100002020732500000000002020207b1af8ff00"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r5, 0x0, 0xe, 0x0, &(0x7f00000000c0)="5fd63edbfd8a4a6077fd87686f9a", 0x0, 0x700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@newtfilter={0x43c, 0x2c, 0xd27, 0x70bd25, 0x8000, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {0x0, 0xa}, {0xffff, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x40c, 0x2, [@TCA_FLOW_POLICE={0x408, 0xa, 0x0, 0x1, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x81, 0xffffffff, 0xda, 0x3, 0x0, 0x2a, 0x100, 0x73d, 0x3509, 0x3, 0x10000, 0x7, 0x1000, 0x9, 0x800003, 0x3, 0x882e, 0x8, 0x8, 0x2, 0x9, 0xfffffffb, 0x2, 0x6, 0x80000000, 0x400, 0x9, 0xffff, 0x7a, 0x6, 0x7, 0x7fff, 0xffffff43, 0x9, 0x6, 0x8, 0x2, 0x57, 0x0, 0x4, 0x80, 0x9, 0xfffffffb, 0x2, 0xcf9f, 0x0, 0x1, 0x8, 0x1, 0x5, 0xfffffff9, 0x8, 0x80000001, 0x8, 0x4, 0x9, 0x5, 0xfffffffd, 0x19, 0x7, 0xc, 0x8, 0x4, 0x1, 0xfffffe00, 0x7, 0x3, 0x800, 0x1, 0x4, 0x2, 0x1, 0x1, 0x801e, 0x7, 0x400004, 0x0, 0x8, 0x5, 0x48001, 0x5, 0x1, 0x1000, 0x9, 0x1, 0x7ff, 0xd0, 0x8, 0x0, 0x3, 0x1, 0x9, 0xe, 0x7fff, 0xfffffff8, 0x7, 0x0, 0xb1, 0x3, 0xffffff40, 0x1, 0x6ddd, 0xf, 0x6, 0x556, 0x1, 0x2e, 0x5, 0x80000001, 0x1, 0x0, 0x200, 0x3, 0x2, 0x6, 0x9, 0x1c00, 0x5, 0xa2, 0x3, 0x8, 0x0, 0x5, 0x8001, 0xbfffffff, 0x7, 0x80, 0xb, 0x0, 0x743, 0x5, 0x3, 0x0, 0x200, 0x5, 0x0, 0x8, 0x3, 0x200100, 0x2, 0x8, 0xfffffffe, 0x6, 0x8, 0xe, 0x5, 0x6, 0x4, 0x7ff, 0x5, 0xfffffffe, 0x1c0, 0xf80, 0x7, 0x116b, 0x2302, 0x9, 0x3ff, 0x2, 0x5, 0x1, 0x6, 0xffffffff, 0x4, 0x10001, 0x512d, 0x1, 0x5, 0x2, 0xa3c0, 0x4, 0x8000, 0x10001, 0x15a, 0x6, 0x120000, 0x9, 0x7fffffff, 0x7, 0x9, 0x80000004, 0x5, 0x7e5, 0x48, 0x9, 0x7, 0x10, 0x3, 0x6, 0xf, 0x5, 0x11, 0x6, 0x9, 0x0, 0x200, 0x9, 0xff, 0x4, 0x7, 0x7, 0x8, 0x4, 0x56, 0x4a82, 0xffff0000, 0x7ff, 0x3e1, 0x6, 0x80000000, 0x4c0, 0x5, 0xa, 0x6, 0x2, 0x1000000a, 0x8, 0x48, 0x81a, 0x2000000, 0x1ff, 0x844, 0x6, 0x3ff, 0x2, 0x100, 0x8, 0xffffffff, 0x200, 0xc26, 0x4, 0x5, 0x1, 0x7fff, 0xf, 0x401, 0x401, 0x6ba4, 0x7, 0x3565, 0x2, 0x2, 0xebf, 0x8, 0x1000, 0x0, 0x71f, 0x2, 0xc59, 0x6e8, 0x9, 0x101, 0x80000000, 0x6, 0xc, 0x2]}]}]}}]}, 0x43c}, 0x1, 0x0, 0x0, 0x1}, 0x800) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r8, @ANYBLOB="0000000003120100500012800b00010062726964676500004000028008000500010000000600270fff0000000800010015000800050025000000000008000400000000000c002e"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) 572.296842ms ago: executing program 3 (id=11054): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000240), &(0x7f0000000380)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000540)='\x00'/14, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0xf00}, 0x50) 494.654701ms ago: executing program 0 (id=11055): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_TX_TS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x38, r1, 0x2, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x8, 0x50}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x38}, 0x1, 0x0, 0x0, 0xc080}, 0x4004) (async) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) (async) r3 = socket(0x25, 0x3, 0x1) (async) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r4, 0x8983, &(0x7f0000000180)={0x7, 'veth1_to_hsr\x00', {0xfffffffa}, 0xa0}) (async) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000200), r0) sendmsg$FOU_CMD_ADD(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r5, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @private1={0xfc, 0x1, '\x00', 0x1}}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @multicast2}]}, 0x30}, 0x1, 0x0, 0x0, 0x40080}, 0x80) bind$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e20, 0xe0000000, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x9}, 0x1c) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xf9835403dfa8e97c, 0x6, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x5}]}, &(0x7f0000000540)='syzkaller\x00', 0x7, 0xcb, &(0x7f0000000580)=""/203, 0x41000, 0x20, '\x00', 0x0, @fallback=0x16, r2, 0x8, &(0x7f0000000680)={0x9, 0x2}, 0x8, 0x10, &(0x7f00000006c0)={0x4, 0x7, 0x90000000, 0x7}, 0x10, 0x0, r2, 0x3, &(0x7f0000000700)=[r2, r2, r2, 0xffffffffffffffff, r2, r2, r2], &(0x7f0000000740)=[{0x5, 0x2, 0xa, 0x4}, {0x4, 0x2, 0xf, 0x6}, {0x3, 0x3, 0x0, 0x2}], 0x10, 0x7}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x2, 0x1c, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2}, [@map_idx={0x18, 0xb, 0x5, 0x0, 0xf}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x2}, @ldst={0x3, 0x0, 0x0, 0x5, 0xb, 0x18, 0xfffffffffffffffc}, @exit, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @call={0x85, 0x0, 0x0, 0x9b}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x4}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @map_fd={0x18, 0x1, 0x1, 0x0, r2}, @func={0x85, 0x0, 0x1, 0x0, 0x7}]}, &(0x7f0000000440)='GPL\x00', 0x8, 0x0, 0x0, 0x40f00, 0x4c, '\x00', 0x0, @fallback=0x30, r2, 0x8, &(0x7f0000000480)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0xa, 0x1000, 0x9}, 0x10, 0xffffffffffffffff, r6, 0x9, 0x0, &(0x7f0000000840)=[{0x1, 0x5, 0x5, 0x5}, {0x2, 0x4, 0x5, 0x8}, {0x0, 0x5, 0x3, 0x9}, {0x1, 0x3, 0x5, 0x7}, {0x0, 0x2, 0xe, 0x7}, {0x2, 0x3, 0x2, 0x9}, {0x3, 0x1, 0xa, 0xc}, {0x2, 0x4, 0xd, 0x1b}, {0x4, 0x5, 0xe, 0x7}], 0x10, 0x9}, 0x94) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000009c0)={0x0}, &(0x7f0000000a00)=0xc) syz_open_procfs$namespace(r7, &(0x7f0000000a40)='ns/pid_for_children\x00') (async) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)={0x40, 0x140c, 0x30b, 0x70bd2b, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x4014041}, 0x4081) (async) pselect6(0x40, &(0x7f0000000b80)={0x7, 0x0, 0x8, 0x401, 0x200, 0x8000000000000001, 0x8, 0x8}, &(0x7f0000000bc0)={0xfffffffffffffff9, 0x8, 0xffff, 0x1, 0x7fffffff, 0x7, 0x3, 0x3}, &(0x7f0000000c00)={0x101, 0x3ff, 0x3, 0x7ff, 0x7fffffffffffffff, 0x1, 0x7, 0xffff}, &(0x7f0000000c40)={0x77359400}, &(0x7f0000000cc0)={&(0x7f0000000c80)={[0x8000000000000000]}, 0x8}) (async) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000d00)={0xf, {{0xa, 0x4e24, 0x6b3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x88) setsockopt$inet_int(r3, 0x0, 0x32, &(0x7f0000000dc0)=0xa, 0x4) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000e00), 0xffffffffffffffff) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000e40)={@dev={0xfe, 0x80, '\x00', 0x40}, 0xef, 0x2, 0xff, 0x3, 0x6, 0xc}, 0x20) (async) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000ec0)={0x5, &(0x7f0000000e80)=[{0x3ff, 0x2, 0xf, 0xec7}, {0xfe00, 0xff, 0x7f, 0x96b}, {0x7, 0xfc, 0x0, 0x7}, {0xfffa, 0x7f, 0x9, 0x2}, {0x0, 0x3, 0x5, 0x6}]}, 0x10) (async) setsockopt$inet6_group_source_req(r4, 0x29, 0x2f, &(0x7f0000000f00)={0x4, {{0xa, 0x4e23, 0x8, @private2={0xfc, 0x2, '\x00', 0x1}}}, {{0xa, 0x4e23, 0x401, @loopback, 0xab6}}}, 0x108) ioctl$sock_inet_SIOCSIFBRDADDR(r4, 0x891a, &(0x7f0000001040)={'caif0\x00', {0x2, 0x4e24, @remote}}) (async) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f00000010c0), r0) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000001180)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000001140)={&(0x7f0000001100)={0x1c, r8, 0x8, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2d}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f00000011c0), 0x4) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000001200)=0x401, 0x4) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000001240)={'batadv_slave_1\x00'}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 387.712915ms ago: executing program 0 (id=11056): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x648080, 0x0) unshare(0x400) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) sendmsg$NLBL_MGMT_C_PROTOCOLS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @local}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @rand_addr=0x64010101}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x8010) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fbdedf250a00004f0e0001006e657464657673696d74646576ffffffffffffffff030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40014}, 0x800) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140), 0x648080, 0x0) (async) unshare(0x400) (async) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r3, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) (async) sendmsg$NLBL_MGMT_C_PROTOCOLS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r2, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @local}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @rand_addr=0x64010101}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x8010) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) (async) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fbdedf250a00004f0e0001006e657464657673696d74646576ffffffffffffffff030002000000"], 0x3c}, 0x1, 0x0, 0x0, 0x40014}, 0x800) (async) 370.880705ms ago: executing program 3 (id=11057): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)}], 0x3) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000800000000000000000000000000000002"]) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r2, 0x1, 0x2, 0x0, 0x48) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000005c0)=0x98) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x41}, 0x3}}, 0x10) listen(r3, 0x0) socket$phonet(0x23, 0x2, 0x1) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, 0x0}, 0x4) close(r4) accept4(r3, &(0x7f0000000180)=@xdp, &(0x7f0000000100)=0x80, 0x80800) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0xd2}, 0xfffffffffffffe88) bind$inet6(r1, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x3, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r6 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r5, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000680)={r6, 0x23, 0x0}, 0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x1, 0x8001, 0x6}, 0x10) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000108feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="080000002f1c060008001b"], 0x28}}, 0x0) close(0x3) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c000280050021001e0000080500010004"], 0x4c}}, 0x0) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="900000000a06010200000000000000000a0000060800094942a79d400000000208000940000000000900000073797a32000000002c0008800c00078008000640000000070c0007800800094000000003100007800c001840000000000000000408000940ffff69f00900020073797a31000000000900020073797a000000000005000100070000000c0007800800279c00010001"], 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x20000044) 287.663845ms ago: executing program 2 (id=11058): getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0xe, 0x10, 0xe, 0xffff}, &(0x7f00000001c0)=0x18) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, 0x0, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a310000000054000000030a01020000000000000000010000000900030073797a320000040028000480080002400000000008000140000000051400030076"], 0xe8}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) recvmsg(r0, 0x0, 0x10022) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a0302000200000000000002000000090002"], 0x80}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a01000000000000000100010000000900010073797a30000000000400020073797a3000000000400003800800014000000000080002400000fbff2b0003801400010067656e6576653000000000000000000014000100776732000000000000000000c6e49c0f5c000000180a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380140001"], 0x110}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000240)={0x1f, 0xfffffffffffffffe, 0x0, 0x0, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, 0x0, &(0x7f00000007c0)=0x1e) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 215.297467ms ago: executing program 0 (id=11059): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) (async) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000280)={0x0, 0x9c, 0xb, 0x0, 0x1, 0x5392, 0xb, 0x9, {0x0, @in6={{0xa, 0x4e60, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x10}}, 0x81, 0x3, 0xc, 0x4b, 0x9}}, 0x0) (async) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r1 = accept4(r0, 0x0, 0x0, 0x80800) r2 = epoll_create1(0x80000) (async) sendmmsg$unix(r1, &(0x7f0000003600)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000006c0)='\aG0XI', 0x5}], 0x1, 0x0, 0x0, 0x24048005}}], 0x1, 0x400c8c0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)={0x2}) (async) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000080)={@loopback, @dev, 0x0}, &(0x7f0000000100)=0xc) sendmsg$DCCPDIAG_GETSOCK(r1, &(0x7f00000004c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000180)={&(0x7f0000000540)=ANY=[@ANYRESOCT=r3, @ANYRES32=r3, @ANYBLOB="0400000005000000ffffffffd70a00005d0001000c25c7fdf6205c928fa0125abe2b364e788a1b1c7927f692029c949def71119ef7565e1ec95f83e2486b316b31ffcf886dbb0db1d6ca5312de42d7a63af663e48a21a5174d5e8c50d76d34483b4a73e55b850a1d0aea32093d0000000e000100e57003eb3673e7051aad00005a0001008a0cfcead8cc80b1e1d5e68a18a6469c99689e68c8ff3335bb46df2233376133efef63ef49f9af852ae21bb295a303bd9903ec5af6db67d3600b18823b552de380e021ab6fa2d63f14e2e5288e16174fc87d664fc65b0000"], 0x118}, 0x1, 0x0, 0x0, 0x84e3248aef7b1a5f}, 0x4014) (async) socket$kcm(0x10, 0x2, 0x10) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x81}, 0x20050840) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000190001002cbd700000c8c3532d"], 0x24}}, 0x0) 0s ago: executing program 0 (id=11060): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000fffdffffb702000008dd6a2aa9e9e3ae000000b70300000000000085000000c700000095"], &(0x7f0000000200)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x82000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000980)=""/4096, 0x1000}], 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x50}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x42}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001f40)=ANY=[@ANYBLOB="2c0000003a04010024bd7000fddfdf2502808000fc000072d99da87990610d0739374a28d4a23ae750dd047d980691ce71ab2f94c63967c56dc63410121da99ccaaed69c65df60caef1917", @ANYRES32=r3, @ANYBLOB="0600150007000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8800}, 0xea5bc50b6199d77e) ioctl$TUNSETDEBUG(r0, 0x400454c9, &(0x7f0000000000)=0x5) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) r5 = socket$qrtr(0x2a, 0x2, 0x0) sendmsg$qrtr(r5, &(0x7f0000001ec0)={&(0x7f0000000540)={0x2a, 0x4, 0x2}, 0xc, &(0x7f0000001ac0)=[{&(0x7f0000000580)="52c0147e8a4290b9368b971aaa9bf9b671", 0x11}, {&(0x7f0000000700)="5418d108998d0d505fafc43a1c7b4c7bede0696f46c25d38b365d399ff292e65111aa950acd4a506609ca26ecdc23d5dfdf3bf65d08b255795e73ca2baaf289274d856366c05ce17407b945006670570b38e876eab46a0dacb58721a1deb7ea97639a76364750b47c9de8ba73c4d57a2e55c6d709b3ba2677188430e135936aed833c7304808275b3fe4ca654dec7d307536d371ec980cde36b71f5a574f5b5120039cbed99ad7d53863f66a2bdda1c1a4f7c81a21", 0xb5}, {&(0x7f00000007c0)="2194297e987ee3b881ef632f3a2ec06be95f2a686f472414c03d5d6b23694d80aa99c3ebfb81bd9981df7fb4dd27080d13309865268f97bf7f1e4a4cba5705bf9cf6f20c0f0f7d3c3f98d9d7b0007282c8ddf85308d71432196dc65f5326b93a42f63b56692afdc908afb736d43670", 0x6f}, {&(0x7f0000000840)="770c88dde439c48098faf8b43cb22b83edfac010c3fe01dc8de1068a53d6cc0522f7465237334e165897226c67c672dcd05b181e2468eee1f77c1d46c47a26a2f590b2f633c9d2261f70e76f3e101a9273e1a1390decd6c73f4861c89e331a138b4a4f6dde51529515a749553b4454ba0d392df07888663be8d1b2503c923057ff7adea9b77f8131fe5cb3e527b9a9d085c28953a1f249deb626cfeabef02aec36339ac3d72bdddf27", 0xa9}, {&(0x7f0000000900)="01ec8c787667df5719f1a4104a325acabc", 0x11}, {&(0x7f0000001980)="40faf1c0f2207b72a56572aff7ba28a9d2098d79b631d5d4d8f5458f8a36268b7447ebe9e2e1f2ebc0fb6a8f7be75c88e1ee4d4d258f383f6efb887de561c42ca2fda41534df657c448d3d2e4bbc0e88bd0e5255da2a12d43336d4b054604d1f953fbbd48f4d409195c36c9da4fe72c6bb94baed078b4b1f1ff12530bcc6753717ecd76499114958513e3e7a7f78e0fa3bf5bae15b45e47c76cb458c769eadbc0140a4de960ae0", 0xa7}, {&(0x7f0000001a40)="d3871f341a57b545fa77ff5229a8cc", 0xf}, {&(0x7f0000001a80)="6d7bc0e80b13a033612c16eda99418532b08eaa2721d665c", 0x18}], 0x8, &(0x7f0000001b40)=[{0x108, 0x116, 0x9e5, "874fb64e5162715130786dfa4a8dd071af5fa50f70592f6c40d056dec3545c878e27788237cb67a9f3398701984a4d12122418307e004a85301d1e13fee62e3a5a299eeff9077affacca50090dc5cfa164d1551bfa2a2afb644786f150367162e6cd95aa9165d6fe90fb87179e7f62afb5bfe53021b4453b5feca6ede49ee91459495c20ee8dda6ff156402ba44e3911cfe6196846c4df206cdc6a19c46bce1f20f9117e7317df6bffbcb18d8017d42ea1c1008e2574ae2ce2215706c3d29e1b20c67c776e80813fa2229ab6c25167dc97e66d77339a275deb3a3d4efb9732ab4d698240eeee14dedf5890442431c49c4f0d0e69c7"}, {0xb0, 0x103, 0x7, "252654d8997cd210cf47840b1618fb1dcecc4f8effaf1901a46c4404b84ab76b22c445744c59c59473c1fbdd8f0bb3cde4eeca104a358708f9d94a3802e04201cc94442275e46428042f00a3e09d5188218339dfc5bee4c56a29980184a4d09cfb7f43f9a6230b2b1687dcbdeed0a74f6307f717c8045c225865373c81095f72822b28644aa3d1abff6308bfb07a5d551bea2e2152667d181096"}, {0xd0, 0x31ae95cbb61fe82c, 0x7, "a615d2d63fc67cf5be596612915e5860680d07f1fd402f2c5faf32964bb4941e058dcb53c06b3a6adf665919adc82df4f9b24c1fd5e28dc1b7d97197e0b41d297c31e4d13e26cfb1f6d108e99fbef76d8973651eabda5417707d1b89cbd5e5a85e4ca8415a55ad4ce5d5ee056fdf09a3caa4de0949af7c03854cbaf79227ae637c9ed3373936bfc3f949b3c1b7be4c6d11f6f971330f34aa06f1303f15f9fbdb74a56388b310e47cbc56693c953085bdd98547a391199c637865f0"}, {0x48, 0x3a, 0x2, "f6e397934c1175424c5a245269ff52786ce7deba80432d2fde8b80794e936c051591ed39d4cb567185a74459e24bee57db1d821cbd96"}, {0x90, 0x113, 0x7, "c4dbe686d94de72f94ec5ad6a13ffdd1a40d02e60e90d875782bed0afa72ddef8d3cb643fe2f94460073794e2742118f1f58e158c305422d07118915e740268ec638cded5c28aaa9af9b3691c2f6c3f1ab023acbba3cd709bfb708ebfc8a448aab9705a4f094efb76d96e53684c1576e3c770452a9a78c2190a5851b"}], 0x360, 0x51}, 0x38) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r4, 0x0, 0x0, 0x80800) setsockopt$sock_int(r6, 0x1, 0x20, &(0x7f0000000940)=0x1000008, 0x4) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000001f00)={&(0x7f00000005c0)=""/5, 0x5, 0x3, 0x7}) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) sendmsg$NL80211_CMD_DISASSOCIATE(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={0x0}, 0x1, 0x0, 0x0, 0x4}, 0x4010) r7 = socket(0x2a, 0x2, 0x0) getsockname$packet(r7, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x1, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) socket$packet(0x11, 0x3, 0x300) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x403, 0x0, 0x80000000, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}, @IFLA_BOND_LP_INTERVAL={0x8, 0x13, 0x6}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8044}, 0x8000) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r10, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688474c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r7, 0x84, 0x8, &(0x7f0000000240), &(0x7f0000000300)=0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newtfilter={0x60, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r8, {0xe}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0x8, 0x2, [@TCA_BASIC_POLICE={0x4}]}}, @filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ENC_UDP_SRC_PORT={0x6}, @TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @multicast2}, @TCA_FLOWER_KEY_CT_ZONE={0x6, 0x5d, 0x8000}]}}]}, 0x60}}, 0x4000) kernel console output (not intermixed with test programs): 6605][ T8268] crypto_create_tfm_node+0x8b/0x3d0 [ 1160.426621][ T8268] crypto_spawn_tfm2+0x5c/0x90 [ 1160.426705][ T8268] crypto_gcm_init_tfm+0x48/0x140 [ 1160.426768][ T8268] crypto_create_tfm_node+0x150/0x3d0 [ 1160.426784][ T8268] crypto_alloc_tfm_node+0x172/0x3f0 [ 1160.426799][ T8268] ? tipc_crypto_key_init+0x221/0x870 [ 1160.426816][ T8268] tipc_crypto_key_init+0x143/0x870 [ 1160.426838][ T8268] tipc_nl_node_set_key+0x725/0x9d0 [ 1160.426866][ T8268] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1160.426893][ T8268] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1160.426919][ T8268] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1160.426952][ T8268] genl_family_rcv_msg_doit+0x22a/0x330 [ 1160.426976][ T8268] ? __asan_memcpy+0x40/0x70 [ 1160.426993][ T8268] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1160.427020][ T8268] genl_rcv_msg+0x61c/0x7a0 [ 1160.427047][ T8268] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1160.427069][ T8268] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1160.427089][ T8268] ? __pfx_ref_tracker_free+0x10/0x10 [ 1160.427117][ T8268] netlink_rcv_skb+0x232/0x4b0 [ 1160.427137][ T8268] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1160.427161][ T8268] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1160.427197][ T8268] ? down_read+0x270/0x2e0 [ 1160.427217][ T8268] ? genl_rcv+0xd/0x40 [ 1160.427252][ T8268] genl_rcv+0x28/0x40 [ 1160.427275][ T8268] netlink_unicast+0x75c/0x8e0 [ 1160.427306][ T8268] netlink_sendmsg+0x813/0xb40 [ 1160.427338][ T8268] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1160.427362][ T8268] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1160.427390][ T8268] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1160.427418][ T8268] ____sys_sendmsg+0x972/0x9f0 [ 1160.427439][ T8268] ? __might_fault+0xaf/0x130 [ 1160.427470][ T8268] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1160.427502][ T8268] ? import_iovec+0x73/0xa0 [ 1160.427529][ T8268] ___sys_sendmsg+0x2a5/0x360 [ 1160.427550][ T8268] ? __lock_acquire+0x6b5/0x2cf0 [ 1160.427575][ T8268] ? __pfx____sys_sendmsg+0x10/0x10 [ 1160.427633][ T8268] ? __fget_files+0x2a/0x420 [ 1160.427655][ T8268] ? __fget_files+0x3a0/0x420 [ 1160.427688][ T8268] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1160.427713][ T8268] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1160.427744][ T8268] ? __pfx_ksys_write+0x10/0x10 [ 1160.427778][ T8268] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.427800][ T8268] do_syscall_64+0x174/0x580 [ 1160.427818][ T8268] ? trace_irq_disable+0x3b/0x140 [ 1160.427844][ T8268] ? clear_bhb_loop+0x40/0x90 [ 1160.427867][ T8268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.427885][ T8268] RIP: 0033:0x7fa55959ce59 [ 1160.427904][ T8268] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1160.427921][ T8268] RSP: 002b:00007fa55a377028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1160.427941][ T8268] RAX: ffffffffffffffda RBX: 00007fa559815fa0 RCX: 00007fa55959ce59 [ 1160.427955][ T8268] RDX: 0000000004008014 RSI: 0000200000000240 RDI: 0000000000000003 [ 1160.427967][ T8268] RBP: 00007fa55a377090 R08: 0000000000000000 R09: 0000000000000000 [ 1160.427978][ T8268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1160.427988][ T8268] R13: 00007fa559816038 R14: 00007fa559815fa0 R15: 00007ffc119ed2d8 [ 1160.428020][ T8268] [ 1160.855122][ T8275] netlink: 'syz.3.9825': attribute type 13 has an invalid length. [ 1160.965133][ T8275] bridge0: port 2(bridge_slave_1) entered disabled state [ 1160.972888][ T8275] bridge0: port 1(bridge_slave_0) entered disabled state [ 1161.182138][ T8275] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1161.203643][ T8275] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1161.403828][ T2121] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1161.414933][ T2121] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1161.451029][ T2121] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1161.474368][ T2121] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1161.507379][ T2121] net_ratelimit: 39 callbacks suppressed [ 1161.507400][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1161.547289][ T5792] bond2: (slave batadv0): failed to get link speed/duplex [ 1161.629629][ T8302] xfrm1: entered allmulticast mode [ 1161.647365][ T5792] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1161.657260][ T5792] bond2: (slave batadv0): failed to get link speed/duplex [ 1161.730845][ T8308] syzkaller0: entered promiscuous mode [ 1161.736368][ T8308] syzkaller0: entered allmulticast mode [ 1161.749015][ T8308] tipc: Enabled bearer , priority 0 [ 1161.756838][ T8307] tipc: Resetting bearer [ 1161.791502][ T8307] tipc: Disabling bearer [ 1161.808075][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1161.817271][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1161.918312][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1161.947480][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1161.994110][ T8316] hmac(sha224: entered promiscuous mode [ 1162.037204][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1162.078819][ T5792] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1162.108761][ T8325] netlink: 'syz.1.9843': attribute type 10 has an invalid length. [ 1162.475623][ T8349] Cannot find set identified by id 0 to match [ 1162.613409][ T8354] __nla_validate_parse: 8 callbacks suppressed [ 1162.613431][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1162.648351][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1162.699795][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1162.717297][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1162.724712][ C1] bridge0: topology change detected, propagating [ 1162.731714][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1162.739245][ C1] bridge0: topology change detected, propagating [ 1162.804523][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1162.851600][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1162.953872][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1163.002673][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1163.080105][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1163.117843][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1163.163692][ T8354] netlink: 36 bytes leftover after parsing attributes in process `syz.2.9851'. [ 1163.326737][ T8354] bridge0: port 2(bridge_slave_1) entered disabled state [ 1163.334490][ T8354] bridge0: port 1(bridge_slave_0) entered disabled state [ 1163.885680][ T8354] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1163.919875][ T8354] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1164.318872][ T5078] Bluetooth: hci0: command 0x0401 tx timeout [ 1164.325010][ T50] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1164.603345][ T1044] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.615852][ T1044] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.666982][ T1044] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.692177][ T1044] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.718955][ T8427] tipc: Enabling of bearer rejected, failed to enable media [ 1164.729974][ T8425] syzkaller0: entered promiscuous mode [ 1164.735620][ T8425] syzkaller0: entered allmulticast mode [ 1164.814233][ T8425] tipc: Enabled bearer , priority 0 [ 1164.832471][ T8424] tipc: Resetting bearer [ 1164.883584][ T8424] tipc: Disabling bearer [ 1165.502426][ T8476] netlink: 'syz.4.9880': attribute type 1 has an invalid length. [ 1166.050388][ T8508] lo speed is unknown, defaulting to 1000 [ 1166.447210][ T8525] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1166.545499][ T8525] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1166.647178][ T2121] net_ratelimit: 39 callbacks suppressed [ 1166.647200][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1166.703024][ T8530] nbd4: detected capacity change from 0 to 63 [ 1166.732705][ T8531] block nbd4: NBD_DISCONNECT [ 1166.745219][ T8531] block nbd4: Disconnected due to user request. [ 1166.757127][ T8531] block nbd4: shutting down sockets [ 1166.773336][ T8511] netlink: 'syz.2.9889': attribute type 1 has an invalid length. [ 1166.774320][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.790524][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1166.800652][ T5792] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1166.812535][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.821709][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1166.829548][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1166.843210][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.852465][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1166.865380][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.874556][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1166.886749][ T7034] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.897513][ T7034] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1166.908059][ T7034] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.917714][ T7034] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1166.928251][ T7034] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.937758][ T7034] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1166.948440][ T7034] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.957716][ T7034] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1166.965712][ T7034] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.975164][ T7034] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1166.983417][ T7034] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1166.993470][ T7034] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1167.005214][ T7034] ldm_validate_partition_table(): Disk read failed. [ 1167.021061][ T7034] Dev nbd4: unable to read RDB block 0 [ 1167.031442][ T7034] nbd4: unable to read partition table [ 1167.067785][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1167.107395][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1167.151296][ T7034] ldm_validate_partition_table(): Disk read failed. [ 1167.180371][ T7034] Dev nbd4: unable to read RDB block 0 [ 1167.200196][ T7034] nbd4: unable to read partition table [ 1167.374860][ T8548] syzkaller0: entered promiscuous mode [ 1167.397847][ T8548] syzkaller0: entered allmulticast mode [ 1167.573485][ T8548] tipc: Enabled bearer , priority 0 [ 1167.595188][ T8547] tipc: Resetting bearer [ 1167.706803][ T8547] tipc: Disabling bearer [ 1167.746174][ T8559] __nla_validate_parse: 136 callbacks suppressed [ 1167.746193][ T8559] netlink: 68 bytes leftover after parsing attributes in process `syz.0.9905'. [ 1167.762319][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1167.778763][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1167.853099][ T8563] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9907'. [ 1167.877886][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1167.897306][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1167.929980][ T8566] syzkaller0: entered promiscuous mode [ 1167.942122][ T8566] syzkaller0: entered allmulticast mode [ 1168.067612][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1168.230634][ T8577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1168.239800][ T8577] 8021q: adding VLAN 0 to HW filter on device team0 [ 1168.257347][ T8577] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1168.419181][ T8577] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1168.428978][ T8577] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1168.441707][ T8577] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1168.452562][ T8577] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1168.475206][ T8577] veth1_vlan: left promiscuous mode [ 1168.482260][ T8577] veth0_vlan: left promiscuous mode [ 1168.488556][ T8577] veth0_vlan: entered promiscuous mode [ 1168.496865][ T8577] veth1_vlan: entered promiscuous mode [ 1168.506835][ T8577] veth1_macvtap: left promiscuous mode [ 1168.513742][ T8577] veth0_macvtap: left promiscuous mode [ 1168.520625][ T8577] veth0_macvtap: entered promiscuous mode [ 1168.527823][ T8577] veth1_macvtap: entered promiscuous mode [ 1168.538406][ T8577] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1168.546580][ T8577] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1168.555121][ T8577] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1168.564427][ T8577] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1168.618113][ T2126] bridge0: port 1(bridge_slave_0) entered blocking state [ 1168.625421][ T2126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1168.659832][ T2126] bridge0: port 2(bridge_slave_1) entered blocking state [ 1168.667253][ T2126] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1168.712078][T24198] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.741616][T24198] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.766469][ T8592] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9918'. [ 1168.786037][T24198] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.805000][T24198] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1168.838334][ T8592] macvlan3: entered allmulticast mode [ 1168.872353][ T8594] syzkaller0: entered promiscuous mode [ 1168.901178][ T8594] syzkaller0: entered allmulticast mode [ 1168.929857][ T8594] tipc: Enabled bearer , priority 0 [ 1168.962221][ T8593] tipc: Resetting bearer [ 1169.214325][ T8593] tipc: Disabling bearer [ 1169.490751][ T8621] bond1: up delay (2) is not a multiple of miimon (80), value rounded to 0 ms [ 1169.503102][ T8621] bond1: entered promiscuous mode [ 1169.508858][ T8621] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1169.561979][ T8615] lo speed is unknown, defaulting to 1000 [ 1169.592632][ T8632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9931'. [ 1169.659413][ T8634] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1169.676304][ T8635] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9930'. [ 1169.780968][ T8635] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9930'. [ 1169.882427][ T8642] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9934'. [ 1169.977230][ T8635] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9930'. [ 1170.131258][ T8651] syzkaller0: entered promiscuous mode [ 1170.150135][ T8651] syzkaller0: entered allmulticast mode [ 1170.183072][ T8649] syzkaller0: entered promiscuous mode [ 1170.194629][ T8649] syzkaller0: entered allmulticast mode [ 1170.245681][ T8649] tipc: Started in network mode [ 1170.254474][ T8649] tipc: Node identity 22e5a10b24c8, cluster identity 4711 [ 1170.263784][ T8649] tipc: Enabled bearer , priority 0 [ 1170.306483][ T8651] tipc: Enabled bearer , priority 0 [ 1170.343515][ T8666] netlink: 88 bytes leftover after parsing attributes in process `syz.3.9943'. [ 1170.356870][ T8650] tipc: Resetting bearer [ 1170.390845][ T8650] tipc: Disabling bearer [ 1170.484370][ T8649] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1170.498640][ T8649] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1170.521165][ T8670] netlink: 52 bytes leftover after parsing attributes in process `syz.2.9945'. [ 1170.754793][ T8649] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1170.777001][ T8684] netlink: 'syz.2.9949': attribute type 1 has an invalid length. [ 1170.781343][ T8649] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1170.943955][ T8684] bond2: entered promiscuous mode [ 1170.951174][ T8684] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1170.988726][ T8648] tipc: Resetting bearer [ 1171.020130][ T8690] netlink: 'syz.3.9950': attribute type 1 has an invalid length. [ 1171.031128][ T8648] tipc: Disabling bearer [ 1171.195636][ T8649] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1171.207615][ T8649] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.227549][ T8703] netlink: 'syz.1.9951': attribute type 1 has an invalid length. [ 1171.235559][ T8703] netlink: 'syz.1.9951': attribute type 4 has an invalid length. [ 1171.250010][ T8703] sctp: [Deprecated]: syz.1.9951 (pid 8703) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1171.250010][ T8703] Use struct sctp_sack_info instead [ 1171.293480][ T8704] syzkaller0: renamed from batadv_slave_1 [ 1171.477953][ T8649] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1171.488427][ T8649] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1171.507621][ T8714] bridge0: port 2(bridge_slave_1) entered disabled state [ 1171.515111][ T8714] bridge0: port 1(bridge_slave_0) entered disabled state [ 1171.554762][ T8712] syzkaller0: entered promiscuous mode [ 1171.560639][ T8712] syzkaller0: entered allmulticast mode [ 1171.569625][ T8712] batman_adv: batadv0: Interface activated: syzkaller0 [ 1171.589095][ T8712] tipc: Enabled bearer , priority 0 [ 1171.753003][ T8717] bridge0: port 2(bridge_slave_1) entered disabled state [ 1171.760413][ T8717] bridge0: port 1(bridge_slave_0) entered disabled state [ 1171.900393][ T8717] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1171.922310][ T8717] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1172.124438][ T1044] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.151029][ T1044] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.183224][ T1044] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.269712][ T1044] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.303153][ T1044] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1172.321256][ T1044] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1172.418459][ T1044] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1172.431158][ T1044] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1172.495607][ T8759] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_hsr, syncid = 4, id = 0 [ 1172.506436][ T35] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1172.529117][ T35] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1172.559854][ T35] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1172.570537][ T35] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1172.597726][ T2126] net_ratelimit: 20 callbacks suppressed [ 1172.597745][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1172.637584][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1172.707682][T23508] tipc: Node number set to 2602867091 [ 1172.737440][ T35] bond2: (slave batadv0): failed to get link speed/duplex [ 1172.767208][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1172.877825][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1172.922768][ T35] bond2: (slave batadv0): failed to get link speed/duplex [ 1173.007612][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1173.057596][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1173.096713][ T8805] __nla_validate_parse: 10 callbacks suppressed [ 1173.096735][ T8805] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9983'. [ 1173.138272][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1173.187502][ T5792] bond2: (slave batadv0): failed to get link speed/duplex [ 1173.529812][ T8820] netlink: 'syz.4.9992': attribute type 83 has an invalid length. [ 1173.819334][ T8829] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9994'. [ 1173.925831][ T8829] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9994'. [ 1173.992793][ T8837] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9997'. [ 1174.090393][ T8829] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9994'. [ 1174.260462][ T8846] netlink: 'syz.1.10001': attribute type 10 has an invalid length. [ 1174.390054][ T8850] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 1174.775891][ T8859] netlink: 43 bytes leftover after parsing attributes in process `syz.4.10007'. [ 1174.908461][ T8866] IPVS: set_ctl: invalid protocol: 47 10.1.1.0:20000 [ 1175.001381][ T8868] syzkaller0: entered promiscuous mode [ 1175.027339][ T8868] syzkaller0: entered allmulticast mode [ 1175.104328][ T8868] tipc: Enabled bearer , priority 0 [ 1175.133420][ T8867] tipc: Resetting bearer [ 1175.200038][ T8867] tipc: Disabling bearer [ 1175.210915][ T8873] netlink: 'syz.1.10013': attribute type 1 has an invalid length. [ 1175.399277][ T8878] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10015'. [ 1175.606245][ T8886] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1175.788077][ T8897] netlink: 'syz.1.10023': attribute type 1 has an invalid length. [ 1175.800172][ T8897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10023'. [ 1175.801946][ T8898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10022'. [ 1175.886968][ T8898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10022'. [ 1176.073880][ T8906] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1176.425966][ T8924] erspan0: entered promiscuous mode [ 1176.434238][ T8924] gretap0: entered promiscuous mode [ 1176.443902][ T8924] debugfs: 'hsr1' already exists in 'hsr' [ 1176.463606][ T8924] Cannot create hsr debugfs directory [ 1176.479020][ T8924] hsr1: Slave A (erspan0) is not up; please bring it up to get a fully working HSR network [ 1176.499390][ T8924] hsr1: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 1176.580118][ T8937] netlink: 'syz.1.10038': attribute type 2 has an invalid length. [ 1176.591048][ T8937] netlink: 'syz.1.10038': attribute type 1 has an invalid length. [ 1176.724708][ T8945] netlink: 'syz.1.10043': attribute type 11 has an invalid length. [ 1176.846456][ T8950] netlink: 'syz.0.10045': attribute type 13 has an invalid length. [ 1176.873875][ T8945] mac80211_hwsim hwsim181 wlan0: entered promiscuous mode [ 1176.881667][ T8945] mac80211_hwsim hwsim181 wlan0: entered allmulticast mode [ 1176.972264][ T8964] netlink: 'syz.2.10049': attribute type 10 has an invalid length. [ 1177.135750][ T8950] bridge0: port 2(bridge_slave_1) entered disabled state [ 1177.143099][ T8950] bridge0: port 1(bridge_slave_0) entered disabled state [ 1177.362662][ T8950] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1177.388643][ T8950] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1177.677459][ T8950] gretap0: left allmulticast mode [ 1177.715608][ T8964] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1177.732209][ T2121] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1177.756313][ T2121] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1177.779633][ T2121] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1177.807630][ T2121] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1177.826642][ T2121] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1177.839655][ T2121] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1177.851048][ T2121] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1177.861979][ T2121] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1177.872507][ T8977] netlink: 'syz.4.10053': attribute type 9 has an invalid length. [ 1177.924460][ T8974] sctp: [Deprecated]: syz.3.10052 (pid 8974) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1177.924460][ T8974] Use struct sctp_sack_info instead [ 1177.925556][ T8982] netlink: 'syz.4.10053': attribute type 9 has an invalid length. [ 1177.953165][ T5792] net_ratelimit: 61 callbacks suppressed [ 1177.953185][ T5792] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1177.978679][ T5792] bond2: (slave batadv0): failed to get link speed/duplex [ 1178.074608][ T8986] FAULT_INJECTION: forcing a failure. [ 1178.074608][ T8986] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1178.083048][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1178.118123][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1178.132013][ T8986] CPU: 1 UID: 0 PID: 8986 Comm: syz.1.10057 Not tainted syzkaller #0 PREEMPT(full) [ 1178.132040][ T8986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1178.132051][ T8986] Call Trace: [ 1178.132057][ T8986] [ 1178.132065][ T8986] dump_stack_lvl+0xe8/0x150 [ 1178.132092][ T8986] should_fail_ex+0x412/0x560 [ 1178.132117][ T8986] _copy_from_user+0x2d/0xb0 [ 1178.132140][ T8986] ___sys_sendmsg+0x1c6/0x360 [ 1178.132161][ T8986] ? __lock_acquire+0x6b5/0x2cf0 [ 1178.132185][ T8986] ? __pfx____sys_sendmsg+0x10/0x10 [ 1178.132238][ T8986] ? __fget_files+0x2a/0x420 [ 1178.132259][ T8986] ? __fget_files+0x3a0/0x420 [ 1178.132288][ T8986] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1178.132312][ T8986] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1178.132341][ T8986] ? __pfx_ksys_write+0x10/0x10 [ 1178.132373][ T8986] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1178.132393][ T8986] do_syscall_64+0x174/0x580 [ 1178.132411][ T8986] ? trace_irq_disable+0x3b/0x140 [ 1178.132435][ T8986] ? clear_bhb_loop+0x40/0x90 [ 1178.132457][ T8986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1178.132476][ T8986] RIP: 0033:0x7fba03d9ce59 [ 1178.132501][ T8986] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1178.132516][ T8986] RSP: 002b:00007fba04ce0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1178.132536][ T8986] RAX: ffffffffffffffda RBX: 00007fba04015fa0 RCX: 00007fba03d9ce59 [ 1178.132549][ T8986] RDX: 0000000000000000 RSI: 0000200000000400 RDI: 000000000000000a [ 1178.132560][ T8986] RBP: 00007fba04ce0090 R08: 0000000000000000 R09: 0000000000000000 [ 1178.132572][ T8986] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1178.132582][ T8986] R13: 00007fba04016038 R14: 00007fba04015fa0 R15: 00007fff468f6238 [ 1178.132612][ T8986] [ 1178.321485][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1178.387656][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1178.402632][ T8991] __nla_validate_parse: 11 callbacks suppressed [ 1178.402653][ T8991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10058'. [ 1178.437677][ T9000] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10063'. [ 1178.577793][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1178.587317][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1178.687486][ T5792] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1178.718569][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1178.999324][ T9027] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10072'. [ 1179.146220][ T9027] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10072'. [ 1179.189029][ T9033] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10076'. [ 1179.250699][ T5792] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1179.264267][ T5792] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1179.293925][ T9027] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10072'. [ 1179.303414][ T5792] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1179.336215][ T5792] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1179.367488][ T9042] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10079'. [ 1179.442829][ T9047] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10082'. [ 1179.511294][ T9048] syzkaller0: entered promiscuous mode [ 1179.517636][ T9048] syzkaller0: entered allmulticast mode [ 1179.528093][ T9046] sctp: [Deprecated]: syz.2.10081 (pid 9046) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1179.528093][ T9046] Use struct sctp_sack_info instead [ 1179.573672][ T9046] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10081'. [ 1179.588027][ T9051] syzkaller0: entered promiscuous mode [ 1179.599151][ T9051] syzkaller0: entered allmulticast mode [ 1179.746889][ T9061] netlink: 32 bytes leftover after parsing attributes in process `syz.3.10086'. [ 1179.912639][ T9051] tipc: Enabled bearer , priority 0 [ 1179.962609][ T9050] tipc: Resetting bearer [ 1180.058523][ T9050] tipc: Disabling bearer [ 1180.122043][ T9079] netlink: 'syz.0.10089': attribute type 4 has an invalid length. [ 1180.156474][ T9083] macvlan2: entered allmulticast mode [ 1180.187930][ T9083] gretap0: entered allmulticast mode [ 1180.500774][ T9109] bond0: (slave vxlan0): Enslaving as an active interface with an up link [ 1180.518718][ T2121] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1180.530677][ T2121] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1180.552072][ T2121] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1180.576974][ T2121] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1180.628584][ T9123] netlink: 'syz.3.10101': attribute type 1 has an invalid length. [ 1180.912492][ T9134] netlink: 'syz.0.10104': attribute type 13 has an invalid length. [ 1180.926922][ T137] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.938455][ T137] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.947703][ T137] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1180.956604][ T137] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1182.977699][ T2126] net_ratelimit: 61 callbacks suppressed [ 1182.977726][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1183.057577][ T137] bond2: (slave batadv0): failed to get link speed/duplex [ 1183.097503][ T137] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1183.167396][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1183.207920][ T137] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1183.238827][ T9094] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1183.301316][ T137] bond2: (slave batadv0): failed to get link speed/duplex [ 1183.324472][ T137] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1183.403077][ T9161] sctp: [Deprecated]: syz.4.10112 (pid 9161) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1183.403077][ T9161] Use struct sctp_sack_info instead [ 1183.430032][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1183.468529][ T137] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1183.586216][ T9163] __nla_validate_parse: 15 callbacks suppressed [ 1183.586239][ T9163] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.10114'. [ 1183.606330][ T137] bond2: (slave batadv0): failed to get link speed/duplex [ 1183.640775][ T9172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10116'. [ 1183.701771][ T9178] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10115'. [ 1183.718640][ T9178] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1183.726231][ T9178] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1183.780764][ T9180] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10118'. [ 1183.883777][ T9190] syzkaller0: entered promiscuous mode [ 1183.891888][ T9190] syzkaller0: entered allmulticast mode [ 1184.029949][ T9195] netlink: 'syz.4.10123': attribute type 1 has an invalid length. [ 1184.059930][ T9195] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1184.072360][ T9195] netlink: 'syz.4.10123': attribute type 18 has an invalid length. [ 1184.097211][ T9195] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10123'. [ 1184.127023][ T9195] bond2: (slave geneve2): making interface the new active one [ 1184.153975][ T9195] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 1184.154047][ T9200] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10125'. [ 1184.320154][ T9207] netlink: 'syz.0.10126': attribute type 12 has an invalid length. [ 1184.337662][ T9207] netlink: 'syz.0.10126': attribute type 29 has an invalid length. [ 1184.350680][ T9207] netlink: 148 bytes leftover after parsing attributes in process `syz.0.10126'. [ 1184.485662][ T9216] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10131'. [ 1184.679962][ T9220] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1184.694740][ T9220] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1184.712528][ T9220] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1184.743169][ T9220] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1185.174560][ T9239] netlink: 'syz.0.10138': attribute type 10 has an invalid length. [ 1185.197694][ T9239] dummy0: left promiscuous mode [ 1185.244792][ T9239] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1185.383051][ T9243] syzkaller0: entered promiscuous mode [ 1185.396398][ T9248] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10142'. [ 1185.398171][ T9243] syzkaller0: entered allmulticast mode [ 1185.416464][ T9248] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10142'. [ 1185.466837][ T9248] erspan0: entered promiscuous mode [ 1185.501785][ T9248] erspan0: left promiscuous mode [ 1185.594846][ T9254] syzkaller1: entered promiscuous mode [ 1185.612868][ T9254] syzkaller1: entered allmulticast mode [ 1186.040168][ T9276] syzkaller0: entered promiscuous mode [ 1186.061757][ T9276] syzkaller0: entered allmulticast mode [ 1186.198498][ T9276] tipc: Enabled bearer , priority 0 [ 1186.210477][ T9275] tipc: Resetting bearer [ 1186.285392][ T9275] tipc: Disabling bearer [ 1186.332570][ T9281] lo speed is unknown, defaulting to 1000 [ 1186.397354][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1186.404659][ C0] bridge0: topology change detected, propagating [ 1186.411402][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1186.418691][ C0] bridge0: topology change detected, propagating [ 1186.494642][ T9286] syzkaller0: entered promiscuous mode [ 1186.527843][ T9286] syzkaller0: entered allmulticast mode [ 1186.559775][ T9292] tipc: Enabled bearer , priority 0 [ 1186.699424][ T9285] tipc: Resetting bearer [ 1186.821668][ T9285] tipc: Disabling bearer [ 1186.959767][ T9287] netlink: 'syz.2.10155': attribute type 1 has an invalid length. [ 1187.431918][ T9353] ÿ: renamed from bond_slave_0 [ 1188.047362][ T2126] net_ratelimit: 51 callbacks suppressed [ 1188.047394][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1188.077609][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1188.167354][ T137] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1188.187367][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1188.277193][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1188.297208][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1188.397869][ T6445] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1188.417802][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1188.517239][ T6445] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1188.527696][ T6445] bond2: (slave batadv0): failed to get link speed/duplex [ 1189.850441][ T9316] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1190.069573][ T9382] __nla_validate_parse: 9 callbacks suppressed [ 1190.069591][ T9382] netlink: 32 bytes leftover after parsing attributes in process `syz.0.10174'. [ 1190.098419][ T9385] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10172'. [ 1190.233265][ T9376] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input5 [ 1190.431969][ T9384] lo speed is unknown, defaulting to 1000 [ 1190.457165][ T9402] netlink: 'syz.2.10179': attribute type 10 has an invalid length. [ 1190.523162][ T9402] bond0: (slave dummy0): Releasing backup interface [ 1190.758675][ T9412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10183'. [ 1190.842262][ T9418] Bluetooth: MGMT ver 1.23 [ 1190.848544][ T9417] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10185'. [ 1190.880471][ T50] block nbd3: Receive control failed (result -1) [ 1190.905283][ T9420] netlink: 244 bytes leftover after parsing attributes in process `syz.2.10185'. [ 1190.982445][ T9417] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10185'. [ 1191.153030][ T9417] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10185'. [ 1191.479704][ T9439] netlink: 'syz.2.10190': attribute type 1 has an invalid length. [ 1191.582796][ T9443] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10191'. [ 1191.598843][ T9439] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1191.637019][ T9443] netlink: 'syz.4.10191': attribute type 13 has an invalid length. [ 1191.705740][ T9445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10191'. [ 1191.750255][ T9442] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1191.767987][ T9442] bond4: (slave gre1): The slave device specified does not support setting the MAC address [ 1191.799005][ T9442] bond4: (slave gre1): Error -95 calling set_mac_address [ 1192.564448][ T9443] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1193.292638][ T9439] gretap1: entered promiscuous mode [ 1193.302175][ T9439] bond4: (slave gretap1): making interface the new active one [ 1193.310980][ T9439] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 1193.358100][ T2126] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1193.395456][ T2126] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1193.421792][ T2126] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1193.446969][ T2126] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1193.477930][ T2126] net_ratelimit: 48 callbacks suppressed [ 1193.477949][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1193.485219][ T9468] FAULT_INJECTION: forcing a failure. [ 1193.485219][ T9468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1193.505888][ T9468] CPU: 1 UID: 0 PID: 9468 Comm: syz.3.10198 Not tainted syzkaller #0 PREEMPT(full) [ 1193.505911][ T9468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1193.505921][ T9468] Call Trace: [ 1193.505929][ T9468] [ 1193.505936][ T9468] dump_stack_lvl+0xe8/0x150 [ 1193.505962][ T9468] should_fail_ex+0x412/0x560 [ 1193.505990][ T9468] _copy_from_user+0x2d/0xb0 [ 1193.506014][ T9468] kstrtouint_from_user+0xd6/0x180 [ 1193.506035][ T9468] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1193.506068][ T9468] proc_fail_nth_write+0x8e/0x210 [ 1193.506092][ T9468] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1193.506118][ T9468] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1193.506140][ T9468] vfs_write+0x29a/0xb90 [ 1193.506172][ T9468] ? __pfx_vfs_write+0x10/0x10 [ 1193.506198][ T9468] ? __fget_files+0x2a/0x420 [ 1193.506223][ T9468] ? __fget_files+0x3a0/0x420 [ 1193.506243][ T9468] ? __fget_files+0x2a/0x420 [ 1193.506273][ T9468] ksys_write+0x150/0x270 [ 1193.506312][ T9468] ? __pfx_ksys_write+0x10/0x10 [ 1193.506345][ T9468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.506367][ T9468] do_syscall_64+0x174/0x580 [ 1193.506384][ T9468] ? trace_irq_disable+0x3b/0x140 [ 1193.506409][ T9468] ? clear_bhb_loop+0x40/0x90 [ 1193.506431][ T9468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.506448][ T9468] RIP: 0033:0x7f264375d68e [ 1193.506464][ T9468] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1193.506477][ T9468] RSP: 002b:00007f26446c0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1193.506492][ T9468] RAX: ffffffffffffffda RBX: 00007f26446c16c0 RCX: 00007f264375d68e [ 1193.506503][ T9468] RDX: 0000000000000001 RSI: 00007f26446c10a0 RDI: 0000000000000004 [ 1193.506512][ T9468] RBP: 00007f26446c1090 R08: 0000000000000000 R09: 0000000000000000 [ 1193.506522][ T9468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1193.506532][ T9468] R13: 00007f2643a16038 R14: 00007f2643a15fa0 R15: 00007ffeb41dd578 [ 1193.506559][ T9468] [ 1193.710773][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1193.817157][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1193.830415][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1193.929571][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1193.939873][ T9475] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10202'. [ 1193.968540][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1194.062699][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1194.097795][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1194.187706][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1194.217750][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1194.642853][ T9518] netlink: 'syz.4.10217': attribute type 13 has an invalid length. [ 1195.065138][ T9547] tipc: Enabling of bearer rejected, failed to enable media [ 1195.139536][ T9553] __nla_validate_parse: 2 callbacks suppressed [ 1195.139554][ T9553] netlink: 20 bytes leftover after parsing attributes in process `syz.3.10224'. [ 1195.162571][ T9554] netlink: 128 bytes leftover after parsing attributes in process `syz.2.10225'. [ 1195.208831][ T9554] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10225'. [ 1195.218175][ T9555] ipip0: entered promiscuous mode [ 1195.451373][ T9576] netlink: 180 bytes leftover after parsing attributes in process `syz.2.10228'. [ 1195.599909][ T9584] netlink: 180 bytes leftover after parsing attributes in process `syz.2.10228'. [ 1195.739489][ T9594] netlink: 244 bytes leftover after parsing attributes in process `syz.0.10232'. [ 1195.910776][ T9603] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10235'. [ 1196.420726][ T9646] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10247'. [ 1196.630743][ T9656] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1196.674170][ T9654] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10250'. [ 1196.724590][ T9661] netlink: 'syz.4.10253': attribute type 1 has an invalid length. [ 1197.017481][ T9677] netlink: 80 bytes leftover after parsing attributes in process `syz.1.10258'. [ 1197.759266][ T9722] netlink: 'syz.3.10277': attribute type 268 has an invalid length. [ 1197.773744][ T9724] FAULT_INJECTION: forcing a failure. [ 1197.773744][ T9724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1197.804280][ T9722] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 1197.807218][ T9724] CPU: 0 UID: 0 PID: 9724 Comm: syz.1.10278 Not tainted syzkaller #0 PREEMPT(full) [ 1197.807244][ T9724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1197.807257][ T9724] Call Trace: [ 1197.807266][ T9724] [ 1197.807274][ T9724] dump_stack_lvl+0xe8/0x150 [ 1197.807303][ T9724] should_fail_ex+0x412/0x560 [ 1197.807328][ T9724] _copy_from_user+0x2d/0xb0 [ 1197.807359][ T9724] __x64_sys_epoll_ctl+0x128/0x1b0 [ 1197.807386][ T9724] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 1197.807418][ T9724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1197.807438][ T9724] do_syscall_64+0x174/0x580 [ 1197.807457][ T9724] ? trace_irq_disable+0x3b/0x140 [ 1197.807483][ T9724] ? clear_bhb_loop+0x40/0x90 [ 1197.807504][ T9724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1197.807522][ T9724] RIP: 0033:0x7fba03d9ce59 [ 1197.807540][ T9724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1197.807556][ T9724] RSP: 002b:00007fba04ce0028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 1197.807575][ T9724] RAX: ffffffffffffffda RBX: 00007fba04015fa0 RCX: 00007fba03d9ce59 [ 1197.807588][ T9724] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 1197.807599][ T9724] RBP: 00007fba04ce0090 R08: 0000000000000000 R09: 0000000000000000 [ 1197.807610][ T9724] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1197.807621][ T9724] R13: 00007fba04016038 R14: 00007fba04015fa0 R15: 00007fff468f6238 [ 1197.807651][ T9724] [ 1198.122902][ T9728] lo speed is unknown, defaulting to 1000 [ 1198.149604][ T9741] Cannot find set identified by id 0 to match [ 1198.473015][ T9753] syzkaller0: entered promiscuous mode [ 1198.483164][ T9753] syzkaller0: entered allmulticast mode [ 1198.518623][ T9761] netlink: 'syz.3.10295': attribute type 15 has an invalid length. [ 1198.627464][ T9733] netlink: 'syz.2.10280': attribute type 1 has an invalid length. [ 1198.668180][ T35] net_ratelimit: 66 callbacks suppressed [ 1198.668201][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1198.698531][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1198.818633][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1199.072533][ T9792] netlink: 'syz.1.10307': attribute type 13 has an invalid length. [ 1200.067338][ T35] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.101503][ T35] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.130856][ T35] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.162013][ T35] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1200.218218][ T9821] __nla_validate_parse: 16 callbacks suppressed [ 1200.218241][ T9821] netlink: 128 bytes leftover after parsing attributes in process `syz.0.10316'. [ 1200.252363][ T9821] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10316'. [ 1200.262137][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1200.362089][ T9826] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10318'. [ 1200.418649][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1200.437881][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1200.486973][ T9831] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10320'. [ 1200.538959][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1200.587411][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1200.611582][ T9839] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10324'. [ 1200.667220][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1200.720175][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1200.792060][ T9851] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10328'. [ 1200.801535][ T9851] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10328'. [ 1200.840117][ T9851] erspan0: entered promiscuous mode [ 1200.860193][ T9851] erspan0: left promiscuous mode [ 1200.883297][ T9855] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10330'. [ 1201.061470][ T9865] syzkaller0: entered promiscuous mode [ 1201.079104][ T9865] syzkaller0: entered allmulticast mode [ 1201.173634][ T9865] tipc: Enabled bearer , priority 0 [ 1201.222692][ T9863] tipc: Resetting bearer [ 1201.352942][ T9863] tipc: Disabling bearer [ 1201.814407][ T9905] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 1202.266094][ T9928] netlink: 'syz.2.10351': attribute type 10 has an invalid length. [ 1202.461599][ T9942] netlink: 80 bytes leftover after parsing attributes in process `syz.4.10356'. [ 1202.769008][ T9955] lo speed is unknown, defaulting to 1000 [ 1202.769077][ T9959] netlink: 212396 bytes leftover after parsing attributes in process `syz.3.10359'. [ 1202.886195][ T9968] macvlan3: entered allmulticast mode [ 1202.977922][ T9972] syzkaller0: entered promiscuous mode [ 1202.998971][ T9972] syzkaller0: entered allmulticast mode [ 1203.069282][ T9972] tipc: Enabled bearer , priority 0 [ 1203.091601][ T9970] tipc: Resetting bearer [ 1203.156514][ T9970] tipc: Disabling bearer [ 1203.413992][ T9995] netlink: 'syz.4.10369': attribute type 83 has an invalid length. [ 1203.687338][ T58] net_ratelimit: 43 callbacks suppressed [ 1203.687358][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1203.717462][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1203.817875][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1203.840064][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1204.060485][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1204.091611][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1204.271554][T10029] tipc: Enabling of bearer rejected, already enabled [ 1204.317161][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1204.347215][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1204.393704][T10040] netlink: 'syz.4.10382': attribute type 10 has an invalid length. [ 1204.588574][T10052] geneve3: entered promiscuous mode [ 1204.610430][ T2121] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 47805 - 0 [ 1204.672799][ T2121] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 47805 - 0 [ 1204.861170][ T2121] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 47805 - 0 [ 1204.913056][ T2121] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 47805 - 0 [ 1204.947335][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1204.959279][T10054] lo speed is unknown, defaulting to 1000 [ 1204.969907][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1205.043390][T10075] netlink: 'syz.2.10386': attribute type 10 has an invalid length. [ 1205.121971][ T5078] Bluetooth: hci5: command 0x0406 tx timeout [ 1205.454499][T10092] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 1205.469442][T10092] bond6 (unregistering): Released all slaves [ 1205.509223][T10100] __nla_validate_parse: 4 callbacks suppressed [ 1205.509245][T10100] netlink: 27 bytes leftover after parsing attributes in process `syz.0.10393'. [ 1205.510586][T10091] syzkaller0: entered promiscuous mode [ 1205.564761][T10101] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10393'. [ 1205.592680][T10091] syzkaller0: entered allmulticast mode [ 1205.625779][T10091] tipc: Enabled bearer , priority 0 [ 1205.687628][T10105] netlink: 56 bytes leftover after parsing attributes in process `syz.2.10394'. [ 1205.704983][T10089] tipc: Resetting bearer [ 1205.843097][T10089] tipc: Disabling bearer [ 1205.899617][T10064] netlink: 'syz.1.10384': attribute type 1 has an invalid length. [ 1206.024266][T10116] tipc: Enabling of bearer rejected, already enabled [ 1206.141270][T10131] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10400'. [ 1206.174610][T10136] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.10399'. [ 1206.372811][T10145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10403'. [ 1206.598341][T10152] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10405'. [ 1206.680984][T10158] netlink: 'syz.3.10404': attribute type 10 has an invalid length. [ 1206.716861][T10158] netlink: 41 bytes leftover after parsing attributes in process `syz.3.10404'. [ 1206.756196][T10158] netlink: 140 bytes leftover after parsing attributes in process `syz.3.10404'. [ 1206.810808][T10158] netlink: 41 bytes leftover after parsing attributes in process `syz.3.10404'. [ 1207.368303][T10189] tipc: Enabling of bearer rejected, already enabled [ 1208.558517][T10265] gretap0: left promiscuous mode [ 1208.633718][T10265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1208.668733][T10265] 8021q: adding VLAN 0 to HW filter on device team0 [ 1208.690869][T10265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1208.762699][T10265] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1208.778378][T10265] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1208.793874][T10265] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1208.809291][T10265] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1208.829473][T10265] veth1_vlan: left promiscuous mode [ 1208.836917][T10265] veth0_vlan: left promiscuous mode [ 1208.844349][T10265] veth0_vlan: entered promiscuous mode [ 1208.855457][T10265] veth1_vlan: entered promiscuous mode [ 1208.921083][T10265] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1208.933018][T10265] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1208.948129][T10265] gretap0: entered promiscuous mode [ 1208.955272][T10265] gretap0: entered allmulticast mode [ 1208.979926][T10265] 8021q: adding VLAN 0 to HW filter on device eth0 [ 1208.995378][T10265] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1209.014285][T10265] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1209.034900][T10265] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1209.087946][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 1209.095160][ T35] bridge0: port 1(bridge_slave_0) entered listening state [ 1209.126188][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 1209.133362][ T35] bridge0: port 2(bridge_slave_1) entered listening state [ 1209.214327][T10290] netlink: 'syz.4.10450': attribute type 10 has an invalid length. [ 1209.251571][T10281] mac80211_hwsim hwsim165 wlan0: entered promiscuous mode [ 1209.275095][T10281] mac80211_hwsim hwsim165 wlan0: entered allmulticast mode [ 1209.298682][ T2126] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1209.320915][ T2126] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1209.341812][ T2126] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1209.367236][ T2126] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1209.390714][ T2126] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1209.409479][ T2126] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1209.431770][T24188] bond2: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 1209.454914][T24188] net_ratelimit: 46 callbacks suppressed [ 1209.454933][T24188] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 1209.502403][T24188] bond2: active interface up! [ 1209.544678][ T2126] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1209.576642][ T2126] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1209.609142][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1209.757216][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1209.807222][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1209.853362][T10317] tipc: Resetting bearer [ 1209.887577][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1209.938968][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1210.007420][T24188] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1210.033289][T10323] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1210.068304][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1210.130173][ T2119] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1210.198631][ T2119] bond2: (slave batadv0): failed to get link speed/duplex [ 1210.221857][T10332] netlink: 'syz.4.10467': attribute type 1 has an invalid length. [ 1210.222270][T10335] syzkaller0: entered promiscuous mode [ 1210.236579][T10335] syzkaller0: entered allmulticast mode [ 1210.367840][T10346] netlink: 'syz.2.10471': attribute type 13 has an invalid length. [ 1210.446215][T10346] tipc: Resetting bearer [ 1210.452590][T10346] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 1210.597019][T10346] gretap0: left allmulticast mode [ 1210.754889][T10358] netlink: 'syz.4.10475': attribute type 10 has an invalid length. [ 1210.830446][T10361] batman_adv: batadv0: Interface activated: syzkaller0 [ 1210.870100][T10361] tipc: Enabling of bearer rejected, already enabled [ 1210.995022][T10369] FAULT_INJECTION: forcing a failure. [ 1210.995022][T10369] name failslab, interval 1, probability 0, space 0, times 0 [ 1211.014011][T10369] CPU: 0 UID: 0 PID: 10369 Comm: syz.2.10478 Not tainted syzkaller #0 PREEMPT(full) [ 1211.014039][T10369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1211.014051][T10369] Call Trace: [ 1211.014059][T10369] [ 1211.014068][T10369] dump_stack_lvl+0xe8/0x150 [ 1211.014097][T10369] should_fail_ex+0x412/0x560 [ 1211.014124][T10369] should_failslab+0xa8/0x100 [ 1211.014146][T10369] __kmalloc_node_noprof+0xf0/0x7c0 [ 1211.014173][T10369] ? crypto_create_tfm_node+0x8b/0x3d0 [ 1211.014205][T10369] crypto_create_tfm_node+0x8b/0x3d0 [ 1211.014234][T10369] crypto_alloc_tfm_node+0x172/0x3f0 [ 1211.014261][T10369] ? tipc_crypto_key_init+0x221/0x870 [ 1211.014291][T10369] tipc_crypto_key_init+0x143/0x870 [ 1211.014327][T10369] tipc_nl_node_set_key+0x725/0x9d0 [ 1211.014356][T10369] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1211.014381][T10369] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 1211.014406][T10369] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 1211.014436][T10369] genl_family_rcv_msg_doit+0x22a/0x330 [ 1211.014461][T10369] ? __asan_memcpy+0x40/0x70 [ 1211.014495][T10369] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1211.014531][T10369] ? __lock_acquire+0x6b5/0x2cf0 [ 1211.014560][T10369] genl_rcv_msg+0x61c/0x7a0 [ 1211.014592][T10369] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1211.014616][T10369] ? __pfx_tipc_nl_node_set_key+0x10/0x10 [ 1211.014653][T10369] netlink_rcv_skb+0x232/0x4b0 [ 1211.014676][T10369] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1211.014703][T10369] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1211.014742][T10369] ? down_read+0x270/0x2e0 [ 1211.014764][T10369] ? genl_rcv+0xd/0x40 [ 1211.014789][T10369] genl_rcv+0x28/0x40 [ 1211.014815][T10369] netlink_unicast+0x75c/0x8e0 [ 1211.014847][T10369] netlink_sendmsg+0x813/0xb40 [ 1211.014889][T10369] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1211.014915][T10369] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1211.014942][T10369] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1211.014969][T10369] ____sys_sendmsg+0x972/0x9f0 [ 1211.014992][T10369] ? __might_fault+0xaf/0x130 [ 1211.015022][T10369] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1211.015054][T10369] ? import_iovec+0x73/0xa0 [ 1211.015079][T10369] ___sys_sendmsg+0x2a5/0x360 [ 1211.015096][T10369] ? __lock_acquire+0x6b5/0x2cf0 [ 1211.015118][T10369] ? __pfx____sys_sendmsg+0x10/0x10 [ 1211.015173][T10369] ? __fget_files+0x2a/0x420 [ 1211.015195][T10369] ? __fget_files+0x3a0/0x420 [ 1211.015228][T10369] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1211.015252][T10369] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1211.015284][T10369] ? __pfx_ksys_write+0x10/0x10 [ 1211.015318][T10369] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1211.015338][T10369] do_syscall_64+0x174/0x580 [ 1211.015357][T10369] ? trace_irq_disable+0x3b/0x140 [ 1211.015383][T10369] ? clear_bhb_loop+0x40/0x90 [ 1211.015407][T10369] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1211.015425][T10369] RIP: 0033:0x7fd3e459ce59 [ 1211.015444][T10369] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1211.015459][T10369] RSP: 002b:00007fd3e53b8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1211.015488][T10369] RAX: ffffffffffffffda RBX: 00007fd3e4815fa0 RCX: 00007fd3e459ce59 [ 1211.015502][T10369] RDX: 0000000004008014 RSI: 0000200000000240 RDI: 0000000000000003 [ 1211.015515][T10369] RBP: 00007fd3e53b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1211.015527][T10369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1211.015539][T10369] R13: 00007fd3e4816038 R14: 00007fd3e4815fa0 R15: 00007ffce8155438 [ 1211.015573][T10369] [ 1211.528406][T10376] __nla_validate_parse: 12 callbacks suppressed [ 1211.528437][T10376] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10480'. [ 1211.608940][T10377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10480'. [ 1211.861415][T10384] syzkaller0: entered promiscuous mode [ 1211.874821][T10384] syzkaller0: entered allmulticast mode [ 1212.148677][T10394] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10488'. [ 1212.220845][T10394] macvlan4: entered allmulticast mode [ 1212.268352][T10398] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10490'. [ 1212.321008][T10400] block nbd4: Unsupported socket: should be TCP or UNIX. [ 1212.526608][T10405] syzkaller0: entered promiscuous mode [ 1212.537686][T10405] syzkaller0: entered allmulticast mode [ 1212.569141][T10409] netlink: 'syz.4.10495': attribute type 83 has an invalid length. [ 1212.616189][T10405] tipc: Enabled bearer , priority 0 [ 1212.639258][T10404] tipc: Resetting bearer [ 1212.732205][T10404] tipc: Disabling bearer [ 1212.801441][T10418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10497'. [ 1212.918160][T10424] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10500'. [ 1213.087293][T10418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10497'. [ 1213.252258][T10418] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10497'. [ 1213.535718][T10447] Cannot find set identified by id 0 to match [ 1213.652610][T10452] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 1213.655350][T10454] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10514'. [ 1214.189814][T10488] netlink: 'syz.0.10522': attribute type 12 has an invalid length. [ 1214.254754][T10493] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10524'. [ 1214.458093][ T2119] net_ratelimit: 60 callbacks suppressed [ 1214.458113][ T2119] bond2: (slave batadv0): failed to get link speed/duplex [ 1214.503926][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1214.530687][T10503] netlink: 'syz.1.10528': attribute type 13 has an invalid length. [ 1214.589699][ T2119] bond2: (slave batadv0): failed to get link speed/duplex [ 1214.629679][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1214.750716][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1214.782545][T10517] FAULT_INJECTION: forcing a failure. [ 1214.782545][T10517] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1214.818308][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1214.821354][T10517] CPU: 0 UID: 0 PID: 10517 Comm: syz.3.10530 Not tainted syzkaller #0 PREEMPT(full) [ 1214.821380][T10517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1214.821392][T10517] Call Trace: [ 1214.821400][T10517] [ 1214.821408][T10517] dump_stack_lvl+0xe8/0x150 [ 1214.821436][T10517] should_fail_ex+0x412/0x560 [ 1214.821462][T10517] _copy_from_user+0x2d/0xb0 [ 1214.821485][T10517] hci_sock_setsockopt+0x5fa/0xad0 [ 1214.821511][T10517] ? __fget_files+0x2a/0x420 [ 1214.821538][T10517] ? __pfx_aa_sk_perm+0x10/0x10 [ 1214.821562][T10517] ? __pfx_hci_sock_setsockopt+0x10/0x10 [ 1214.821595][T10517] ? __fget_files+0x2a/0x420 [ 1214.821614][T10517] ? aa_sock_opt_perm+0xff/0x1a0 [ 1214.821643][T10517] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1214.821666][T10517] ? __pfx_hci_sock_setsockopt+0x10/0x10 [ 1214.821692][T10517] do_sock_setsockopt+0x17c/0x1b0 [ 1214.821717][T10517] __x64_sys_setsockopt+0x13d/0x1b0 [ 1214.821742][T10517] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.821762][T10517] do_syscall_64+0x174/0x580 [ 1214.821782][T10517] ? trace_irq_disable+0x3b/0x140 [ 1214.821807][T10517] ? clear_bhb_loop+0x40/0x90 [ 1214.821829][T10517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1214.821848][T10517] RIP: 0033:0x7f264379ce59 [ 1214.821865][T10517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1214.821879][T10517] RSP: 002b:00007f26446c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1214.821898][T10517] RAX: ffffffffffffffda RBX: 00007f2643a15fa0 RCX: 00007f264379ce59 [ 1214.821912][T10517] RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000004 [ 1214.821925][T10517] RBP: 00007f26446c1090 R08: 0000000000000004 R09: 0000000000000000 [ 1214.821937][T10517] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1214.821948][T10517] R13: 00007f2643a16038 R14: 00007f2643a15fa0 R15: 00007ffeb41dd578 [ 1214.821978][T10517] [ 1215.036815][T10519] netlink: 'syz.1.10531': attribute type 1 has an invalid length. [ 1215.120244][T10519] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1215.128430][ T2119] bond2: (slave batadv0): failed to get link speed/duplex [ 1215.159867][T10524] bond2: (slave veth5): Enslaving as a backup interface with a down link [ 1215.182669][T10519] netlink: 'syz.1.10531': attribute type 10 has an invalid length. [ 1215.198488][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1215.237236][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1215.329831][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1215.376037][ T50] Bluetooth: hci1: command 0x0406 tx timeout [ 1215.719126][T10546] syzkaller0: entered promiscuous mode [ 1215.732708][T10546] syzkaller0: entered allmulticast mode [ 1215.743599][T10551] tipc: Enabling of bearer rejected, failed to enable media [ 1215.838499][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056cbc800: rx timeout, send abort [ 1215.855740][T10546] tipc: Enabled bearer , priority 0 [ 1215.907707][T10545] tipc: Resetting bearer [ 1216.001526][T10545] tipc: Disabling bearer [ 1216.338657][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055d3e000: rx timeout, send abort [ 1216.350121][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056cbc800: abort rx timeout. Force session deactivation [ 1216.447846][T10580] syzkaller0: entered promiscuous mode [ 1216.464207][T10580] syzkaller0: entered allmulticast mode [ 1216.492290][T10580] tipc: Enabled bearer , priority 0 [ 1216.581498][T10579] tipc: Resetting bearer [ 1216.666918][T10579] tipc: Disabling bearer [ 1216.708383][T10586] netlink: 'syz.3.10550': attribute type 1 has an invalid length. [ 1216.747930][T10588] __nla_validate_parse: 11 callbacks suppressed [ 1216.747953][T10588] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10551'. [ 1216.846640][T10592] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10553'. [ 1216.846946][ C0] vcan0: j1939_tp_rxtimer: 0xffff888055d3e000: abort rx timeout. Force session deactivation [ 1216.882967][T10596] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10554'. [ 1216.904683][T10597] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10552'. [ 1216.916563][T10596] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10554'. [ 1217.142827][T10605] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10560'. [ 1217.203895][T10610] netlink: 40 bytes leftover after parsing attributes in process `syz.0.10561'. [ 1217.330034][T10612] netlink: 22476 bytes leftover after parsing attributes in process `syz.1.10562'. [ 1217.377149][T10614] syzkaller0: entered promiscuous mode [ 1217.407535][T10614] syzkaller0: entered allmulticast mode [ 1217.503654][T10614] tipc: Enabled bearer , priority 0 [ 1217.532415][T10613] tipc: Resetting bearer [ 1217.615108][T10613] tipc: Disabling bearer [ 1217.653146][T10628] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7 [ 1218.055194][T10641] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10569'. [ 1218.095914][T10641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10569'. [ 1219.418624][T10679] hmac(sha224: left promiscuous mode [ 1219.487506][T10682] syzkaller0: entered promiscuous mode [ 1219.497207][T10682] syzkaller0: entered allmulticast mode [ 1219.579469][T23508] IPVS: starting estimator thread 0... [ 1219.647310][ T35] net_ratelimit: 46 callbacks suppressed [ 1219.647333][ T35] bond2: (slave batadv0): failed to get link speed/duplex [ 1219.680843][T10687] IPVS: using max 38 ests per chain, 91200 per kthread [ 1219.697784][T10682] tipc: Enabled bearer , priority 0 [ 1219.769959][T10681] tipc: Resetting bearer [ 1219.829160][T10681] tipc: Disabling bearer [ 1219.917954][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1219.959256][ T35] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1220.016323][T10704] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1220.048698][ T35] bond2: (slave batadv0): failed to get link speed/duplex [ 1220.147316][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1220.187582][ T2119] bond2: (slave batadv0): failed to get link speed/duplex [ 1220.267592][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1220.307428][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1220.325529][T10720] syzkaller0: entered promiscuous mode [ 1220.344009][T10720] syzkaller0: entered allmulticast mode [ 1220.430436][T10720] tipc: Enabled bearer , priority 0 [ 1220.452694][T10718] tipc: Resetting bearer [ 1220.515549][T10718] tipc: Disabling bearer [ 1220.557235][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1220.565320][T10731] netlink: 'syz.1.10598': attribute type 13 has an invalid length. [ 1220.579419][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1220.640499][T10733] netlink: 'syz.0.10599': attribute type 4 has an invalid length. [ 1220.784630][T10731] netlink: 'syz.1.10598': attribute type 2 has an invalid length. [ 1220.881590][T10753] FAULT_INJECTION: forcing a failure. [ 1220.881590][T10753] name failslab, interval 1, probability 0, space 0, times 0 [ 1220.894725][T10753] CPU: 1 UID: 0 PID: 10753 Comm: syz.4.10605 Not tainted syzkaller #0 PREEMPT(full) [ 1220.894753][T10753] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1220.894766][T10753] Call Trace: [ 1220.894774][T10753] [ 1220.894782][T10753] dump_stack_lvl+0xe8/0x150 [ 1220.894810][T10753] should_fail_ex+0x412/0x560 [ 1220.894836][T10753] should_failslab+0xa8/0x100 [ 1220.894857][T10753] __kmalloc_noprof+0xe8/0x760 [ 1220.894882][T10753] ? bpf_test_init+0x9f/0x150 [ 1220.894908][T10753] bpf_test_init+0x9f/0x150 [ 1220.894932][T10753] bpf_prog_test_run_xdp+0x529/0x1160 [ 1220.894969][T10753] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1220.894996][T10753] ? __fget_files+0x2a/0x420 [ 1220.895024][T10753] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1220.895047][T10753] bpf_prog_test_run+0x2c7/0x340 [ 1220.895071][T10753] __sys_bpf+0x643/0x950 [ 1220.895098][T10753] ? __pfx___sys_bpf+0x10/0x10 [ 1220.895140][T10753] ? ksys_write+0x242/0x270 [ 1220.895166][T10753] ? __pfx_ksys_write+0x10/0x10 [ 1220.895194][T10753] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.895213][T10753] __x64_sys_bpf+0x7c/0x90 [ 1220.895234][T10753] do_syscall_64+0x174/0x580 [ 1220.895253][T10753] ? trace_irq_disable+0x3b/0x140 [ 1220.895278][T10753] ? clear_bhb_loop+0x40/0x90 [ 1220.895301][T10753] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1220.895319][T10753] RIP: 0033:0x7fa55959ce59 [ 1220.895337][T10753] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1220.895353][T10753] RSP: 002b:00007fa55a377028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1220.895372][T10753] RAX: ffffffffffffffda RBX: 00007fa559815fa0 RCX: 00007fa55959ce59 [ 1220.895386][T10753] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1220.895398][T10753] RBP: 00007fa55a377090 R08: 0000000000000000 R09: 0000000000000000 [ 1220.895411][T10753] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1220.895422][T10753] R13: 00007fa559816038 R14: 00007fa559815fa0 R15: 00007ffc119ed2d8 [ 1220.895461][T10753] [ 1221.104461][T10757] netlink: 'syz.0.10604': attribute type 1 has an invalid length. [ 1221.157922][T10757] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1221.279841][T10750] bond3: (slave erspan0): Enslaving as a backup interface with an up link [ 1222.059551][T10811] __nla_validate_parse: 20 callbacks suppressed [ 1222.059575][T10811] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10619'. [ 1222.233804][T10821] syzkaller0: entered promiscuous mode [ 1222.251929][T10821] syzkaller0: entered allmulticast mode [ 1222.278202][T10824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10624'. [ 1222.351826][T10821] tipc: Enabled bearer , priority 0 [ 1222.372697][T10819] tipc: Resetting bearer [ 1222.446972][T10819] tipc: Disabling bearer [ 1222.570867][T10831] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.10626'. [ 1223.605833][T10886] netlink: 324 bytes leftover after parsing attributes in process `syz.0.10639'. [ 1223.956728][T10910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10642'. [ 1224.078857][T10910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10642'. [ 1224.207755][T10910] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10642'. [ 1224.771602][ T6445] net_ratelimit: 48 callbacks suppressed [ 1224.771624][ T6445] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1224.817251][ T6445] bond2: (slave batadv0): failed to get link speed/duplex [ 1224.903329][T10932] netlink: 56 bytes leftover after parsing attributes in process `syz.0.10652'. [ 1225.096697][T10935] tipc: Enabling of bearer rejected, already enabled [ 1225.115907][T10938] geneve0: Caught tx_queue_len zero misconfig [ 1225.177366][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1225.219636][T24198] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1225.309400][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1225.407658][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1225.443645][ T6445] bond2: (slave batadv0): failed to get link speed/duplex [ 1225.488129][T10963] syzkaller0: entered promiscuous mode [ 1225.494338][T10963] syzkaller0: entered allmulticast mode [ 1225.517928][ T6445] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1225.549981][T10969] netlink: 'syz.3.10663': attribute type 8 has an invalid length. [ 1225.593856][T10973] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10665'. [ 1225.636202][T10978] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1225.644526][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1225.657306][ T6445] bond2: (slave batadv0): failed to get link speed/duplex [ 1225.796471][T10989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10671'. [ 1225.851350][T10989] netlink: 'syz.4.10671': attribute type 13 has an invalid length. [ 1225.895830][ T6445] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 47805 - 0 [ 1225.916209][ T6445] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 47805 - 0 [ 1226.340688][ T6445] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 47805 - 0 [ 1226.371910][ T6445] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 47805 - 0 [ 1226.466634][T11030] xt_TCPMSS: Only works on TCP SYN packets [ 1226.566574][T11037] FAULT_INJECTION: forcing a failure. [ 1226.566574][T11037] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1226.583903][T11037] CPU: 0 UID: 0 PID: 11037 Comm: syz.4.10686 Not tainted syzkaller #0 PREEMPT(full) [ 1226.583931][T11037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1226.583943][T11037] Call Trace: [ 1226.583951][T11037] [ 1226.583960][T11037] dump_stack_lvl+0xe8/0x150 [ 1226.584012][T11037] should_fail_ex+0x412/0x560 [ 1226.584040][T11037] _copy_from_user+0x2d/0xb0 [ 1226.584065][T11037] __sys_bpf+0x229/0x950 [ 1226.584095][T11037] ? __pfx___sys_bpf+0x10/0x10 [ 1226.584138][T11037] ? ksys_write+0x242/0x270 [ 1226.584166][T11037] ? __pfx_ksys_write+0x10/0x10 [ 1226.584197][T11037] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.584219][T11037] __x64_sys_bpf+0x7c/0x90 [ 1226.584245][T11037] do_syscall_64+0x174/0x580 [ 1226.584265][T11037] ? trace_irq_disable+0x3b/0x140 [ 1226.584292][T11037] ? clear_bhb_loop+0x40/0x90 [ 1226.584316][T11037] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.584336][T11037] RIP: 0033:0x7fa55959ce59 [ 1226.584363][T11037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.584380][T11037] RSP: 002b:00007fa55a377028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1226.584400][T11037] RAX: ffffffffffffffda RBX: 00007fa559815fa0 RCX: 00007fa55959ce59 [ 1226.584414][T11037] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1226.584427][T11037] RBP: 00007fa55a377090 R08: 0000000000000000 R09: 0000000000000000 [ 1226.584440][T11037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1226.584452][T11037] R13: 00007fa559816038 R14: 00007fa559815fa0 R15: 00007ffc119ed2d8 [ 1226.584482][T11037] [ 1226.770049][T11039] syzkaller0: entered promiscuous mode [ 1226.775609][T11039] syzkaller0: entered allmulticast mode [ 1226.810167][T11039] tipc: Enabled bearer , priority 0 [ 1226.831542][T11038] tipc: Resetting bearer [ 1226.922892][T11045] FAULT_INJECTION: forcing a failure. [ 1226.922892][T11045] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1226.936853][T11045] CPU: 1 UID: 0 PID: 11045 Comm: syz.3.10690 Not tainted syzkaller #0 PREEMPT(full) [ 1226.936878][T11045] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1226.936889][T11045] Call Trace: [ 1226.936896][T11045] [ 1226.936904][T11045] dump_stack_lvl+0xe8/0x150 [ 1226.936932][T11045] should_fail_ex+0x412/0x560 [ 1226.936959][T11045] _copy_from_user+0x2d/0xb0 [ 1226.936982][T11045] hidp_sock_ioctl+0x244/0x650 [ 1226.937085][T11045] ? __pfx_hidp_sock_ioctl+0x10/0x10 [ 1226.937146][T11045] ? do_vfs_ioctl+0x1166/0x1530 [ 1226.937175][T11045] sock_do_ioctl+0x101/0x320 [ 1226.937199][T11045] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1226.937220][T11045] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 1226.937255][T11045] sock_ioctl+0x5c6/0x7f0 [ 1226.937279][T11045] ? __pfx_sock_ioctl+0x10/0x10 [ 1226.937302][T11045] ? __fget_files+0x2a/0x420 [ 1226.937321][T11045] ? __fget_files+0x3a0/0x420 [ 1226.937340][T11045] ? __fget_files+0x2a/0x420 [ 1226.937362][T11045] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1226.937386][T11045] ? __pfx_sock_ioctl+0x10/0x10 [ 1226.937407][T11045] __se_sys_ioctl+0xfc/0x170 [ 1226.937431][T11045] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.937451][T11045] do_syscall_64+0x174/0x580 [ 1226.937468][T11045] ? trace_irq_disable+0x3b/0x140 [ 1226.937493][T11045] ? clear_bhb_loop+0x40/0x90 [ 1226.937515][T11045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1226.937534][T11045] RIP: 0033:0x7f264379ce59 [ 1226.937552][T11045] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.937567][T11045] RSP: 002b:00007f26446c1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1226.937586][T11045] RAX: ffffffffffffffda RBX: 00007f2643a15fa0 RCX: 00007f264379ce59 [ 1226.937600][T11045] RDX: 0000200000000000 RSI: 00000000400448c9 RDI: 0000000000000004 [ 1226.937613][T11045] RBP: 00007f26446c1090 R08: 0000000000000000 R09: 0000000000000000 [ 1226.937625][T11045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1226.937636][T11045] R13: 00007f2643a16038 R14: 00007f2643a15fa0 R15: 00007ffeb41dd578 [ 1226.937664][T11045] [ 1227.161414][T11038] tipc: Disabling bearer [ 1227.254678][T11050] tipc: Failed to remove unknown binding: 66,1,1/0:3669152490/3669152492 [ 1227.276105][T11050] tipc: Failed to remove unknown binding: 66,1,1/0:3669152490/3669152492 [ 1227.290454][T11050] tipc: Failed to remove unknown binding: 66,1,1/0:3669152490/3669152492 [ 1227.325780][T11050] __nla_validate_parse: 7 callbacks suppressed [ 1227.325801][T11050] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10693'. [ 1227.781956][T11088] FAULT_INJECTION: forcing a failure. [ 1227.781956][T11088] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1227.815722][T11088] CPU: 0 UID: 0 PID: 11088 Comm: syz.0.10704 Not tainted syzkaller #0 PREEMPT(full) [ 1227.815750][T11088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1227.815762][T11088] Call Trace: [ 1227.815770][T11088] [ 1227.815778][T11088] dump_stack_lvl+0xe8/0x150 [ 1227.815817][T11088] should_fail_ex+0x412/0x560 [ 1227.815842][T11088] _copy_from_user+0x2d/0xb0 [ 1227.815866][T11088] __copy_msghdr+0x3c5/0x5b0 [ 1227.815893][T11088] ___sys_sendmsg+0x213/0x360 [ 1227.815913][T11088] ? __lock_acquire+0x6b5/0x2cf0 [ 1227.815938][T11088] ? __pfx____sys_sendmsg+0x10/0x10 [ 1227.815994][T11088] ? __fget_files+0x2a/0x420 [ 1227.816015][T11088] ? __fget_files+0x3a0/0x420 [ 1227.816044][T11088] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1227.816068][T11088] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1227.816098][T11088] ? __pfx_ksys_write+0x10/0x10 [ 1227.816131][T11088] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1227.816151][T11088] do_syscall_64+0x174/0x580 [ 1227.816171][T11088] ? trace_irq_disable+0x3b/0x140 [ 1227.816198][T11088] ? clear_bhb_loop+0x40/0x90 [ 1227.816221][T11088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1227.816240][T11088] RIP: 0033:0x7f3405d9ce59 [ 1227.816262][T11088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1227.816279][T11088] RSP: 002b:00007f3406cd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1227.816299][T11088] RAX: ffffffffffffffda RBX: 00007f3406015fa0 RCX: 00007f3405d9ce59 [ 1227.816313][T11088] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1227.816325][T11088] RBP: 00007f3406cd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1227.816337][T11088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1227.816348][T11088] R13: 00007f3406016038 R14: 00007f3406015fa0 R15: 00007ffd78b598f8 [ 1227.816379][T11088] [ 1228.294643][T11110] FAULT_INJECTION: forcing a failure. [ 1228.294643][T11110] name failslab, interval 1, probability 0, space 0, times 0 [ 1228.308240][T11110] CPU: 0 UID: 0 PID: 11110 Comm: syz.2.10713 Not tainted syzkaller #0 PREEMPT(full) [ 1228.308267][T11110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1228.308279][T11110] Call Trace: [ 1228.308287][T11110] [ 1228.308295][T11110] dump_stack_lvl+0xe8/0x150 [ 1228.308322][T11110] should_fail_ex+0x412/0x560 [ 1228.308347][T11110] should_failslab+0xa8/0x100 [ 1228.308368][T11110] __kmalloc_noprof+0xe8/0x760 [ 1228.308394][T11110] ? bpf_test_init+0x9f/0x150 [ 1228.308420][T11110] bpf_test_init+0x9f/0x150 [ 1228.308445][T11110] bpf_prog_test_run_xdp+0x529/0x1160 [ 1228.308482][T11110] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1228.308508][T11110] ? __fget_files+0x2a/0x420 [ 1228.308536][T11110] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1228.308558][T11110] bpf_prog_test_run+0x2c7/0x340 [ 1228.308581][T11110] __sys_bpf+0x643/0x950 [ 1228.308609][T11110] ? __pfx___sys_bpf+0x10/0x10 [ 1228.308649][T11110] ? ksys_write+0x242/0x270 [ 1228.308677][T11110] ? __pfx_ksys_write+0x10/0x10 [ 1228.308705][T11110] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1228.308725][T11110] __x64_sys_bpf+0x7c/0x90 [ 1228.308749][T11110] do_syscall_64+0x174/0x580 [ 1228.308769][T11110] ? trace_irq_disable+0x3b/0x140 [ 1228.308794][T11110] ? clear_bhb_loop+0x40/0x90 [ 1228.308817][T11110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1228.308836][T11110] RIP: 0033:0x7fd3e459ce59 [ 1228.308853][T11110] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1228.308869][T11110] RSP: 002b:00007fd3e53b8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1228.308889][T11110] RAX: ffffffffffffffda RBX: 00007fd3e4815fa0 RCX: 00007fd3e459ce59 [ 1228.308903][T11110] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1228.308915][T11110] RBP: 00007fd3e53b8090 R08: 0000000000000000 R09: 0000000000000000 [ 1228.308927][T11110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1228.308938][T11110] R13: 00007fd3e4816038 R14: 00007fd3e4815fa0 R15: 00007ffce8155438 [ 1228.308969][T11110] [ 1228.331309][T11113] netlink: 'syz.3.10714': attribute type 1 has an invalid length. [ 1228.543381][T11113] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10714'. [ 1228.812026][T11129] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10720'. [ 1229.321635][T11165] netlink: 'syz.2.10732': attribute type 1 has an invalid length. [ 1229.390187][T11168] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10735'. [ 1229.436622][T11168] netlink: 'syz.0.10735': attribute type 3 has an invalid length. [ 1229.444832][T11165] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1229.481485][T11177] netlink: 'syz.1.10734': attribute type 83 has an invalid length. [ 1229.538992][T11180] syzkaller1: entered promiscuous mode [ 1229.567961][T11180] syzkaller1: entered allmulticast mode [ 1229.832578][T11198] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10745'. [ 1229.848284][T11198] netlink: 28 bytes leftover after parsing attributes in process `syz.3.10745'. [ 1229.857617][ T2126] net_ratelimit: 47 callbacks suppressed [ 1229.857639][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1229.857694][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1229.968886][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1229.987232][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1230.073621][T11209] netlink: 'syz.2.10750': attribute type 83 has an invalid length. [ 1230.087331][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1230.107227][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1230.132864][T11211] netlink: 'syz.0.10749': attribute type 1 has an invalid length. [ 1230.154362][T11211] netlink: 224 bytes leftover after parsing attributes in process `syz.0.10749'. [ 1230.247516][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1230.374911][T11229] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10758'. [ 1230.390495][T11227] batman_adv: batadv0: Adding interface: ipvlan2 [ 1230.396979][T11227] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1230.439915][T11227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1230.451323][T11227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1230.461950][T11227] batman_adv: batadv0: Not using interface ipvlan2 (retrying later): interface not active [ 1230.478161][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1230.514662][T11224] lo speed is unknown, defaulting to 1000 [ 1230.520698][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1230.597588][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1230.608036][T11235] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10760'. [ 1230.660174][T11237] netlink: 244 bytes leftover after parsing attributes in process `syz.1.10760'. [ 1231.976391][T11305] FAULT_INJECTION: forcing a failure. [ 1231.976391][T11305] name failslab, interval 1, probability 0, space 0, times 0 [ 1231.989277][T11300] netlink: 'syz.3.10779': attribute type 1 has an invalid length. [ 1232.021499][T11305] CPU: 0 UID: 0 PID: 11305 Comm: syz.4.10780 Not tainted syzkaller #0 PREEMPT(full) [ 1232.021521][T11305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1232.021530][T11305] Call Trace: [ 1232.021537][T11305] [ 1232.021544][T11305] dump_stack_lvl+0xe8/0x150 [ 1232.021566][T11305] should_fail_ex+0x412/0x560 [ 1232.021588][T11305] should_failslab+0xa8/0x100 [ 1232.021604][T11305] __kvmalloc_node_noprof+0x178/0x8a0 [ 1232.021626][T11305] ? page_pool_create_percpu+0x304/0xc80 [ 1232.021649][T11305] ? page_pool_create_percpu+0xaf/0xc80 [ 1232.021671][T11305] page_pool_create_percpu+0x304/0xc80 [ 1232.021696][T11305] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 1232.021728][T11305] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1232.021757][T11305] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1232.021781][T11305] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1232.021813][T11305] ? 0xffffffffa0201a50 [ 1232.021826][T11305] ? 0xffffffffa02039ec [ 1232.021836][T11305] ? 0xffffffffa0203ad0 [ 1232.021867][T11305] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1232.021892][T11305] ? _copy_from_user+0x94/0xb0 [ 1232.021909][T11305] ? bpf_test_init+0x113/0x150 [ 1232.021923][T11305] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1232.021941][T11305] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1232.021969][T11305] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1232.021989][T11305] ? __fget_files+0x2a/0x420 [ 1232.022011][T11305] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1232.022027][T11305] bpf_prog_test_run+0x2c7/0x340 [ 1232.022045][T11305] __sys_bpf+0x643/0x950 [ 1232.022067][T11305] ? __pfx___sys_bpf+0x10/0x10 [ 1232.022098][T11305] ? ksys_write+0x242/0x270 [ 1232.022120][T11305] ? __pfx_ksys_write+0x10/0x10 [ 1232.022142][T11305] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.022157][T11305] __x64_sys_bpf+0x7c/0x90 [ 1232.022175][T11305] do_syscall_64+0x174/0x580 [ 1232.022193][T11305] ? trace_irq_disable+0x3b/0x140 [ 1232.022215][T11305] ? clear_bhb_loop+0x40/0x90 [ 1232.022232][T11305] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.022245][T11305] RIP: 0033:0x7fa55959ce59 [ 1232.022259][T11305] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1232.022270][T11305] RSP: 002b:00007fa55a377028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1232.022286][T11305] RAX: ffffffffffffffda RBX: 00007fa559815fa0 RCX: 00007fa55959ce59 [ 1232.022297][T11305] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 1232.022306][T11305] RBP: 00007fa55a377090 R08: 0000000000000000 R09: 0000000000000000 [ 1232.022314][T11305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1232.022322][T11305] R13: 00007fa559816038 R14: 00007fa559815fa0 R15: 00007ffc119ed2d8 [ 1232.022345][T11305] [ 1232.022352][T11305] page_pool_create_percpu() gave up with errno -12 [ 1232.362811][T11318] FAULT_INJECTION: forcing a failure. [ 1232.362811][T11318] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1232.376357][T11318] CPU: 0 UID: 0 PID: 11318 Comm: syz.1.10782 Not tainted syzkaller #0 PREEMPT(full) [ 1232.376382][T11318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1232.376394][T11318] Call Trace: [ 1232.376402][T11318] [ 1232.376410][T11318] dump_stack_lvl+0xe8/0x150 [ 1232.376438][T11318] should_fail_ex+0x412/0x560 [ 1232.376463][T11318] _copy_from_user+0x2d/0xb0 [ 1232.376487][T11318] ____sys_sendmsg+0x308/0x9f0 [ 1232.376517][T11318] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1232.376548][T11318] ? import_iovec+0x73/0xa0 [ 1232.376573][T11318] ___sys_sendmsg+0x2a5/0x360 [ 1232.376592][T11318] ? __lock_acquire+0x6b5/0x2cf0 [ 1232.376617][T11318] ? __pfx____sys_sendmsg+0x10/0x10 [ 1232.376671][T11318] ? __fget_files+0x2a/0x420 [ 1232.376693][T11318] ? __fget_files+0x3a0/0x420 [ 1232.376724][T11318] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1232.376756][T11318] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1232.376784][T11318] ? __pfx_ksys_write+0x10/0x10 [ 1232.376818][T11318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.376836][T11318] do_syscall_64+0x174/0x580 [ 1232.376853][T11318] ? trace_irq_disable+0x3b/0x140 [ 1232.376878][T11318] ? clear_bhb_loop+0x40/0x90 [ 1232.376901][T11318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1232.376919][T11318] RIP: 0033:0x7fba03d9ce59 [ 1232.376936][T11318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1232.376952][T11318] RSP: 002b:00007fba04ce0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1232.376972][T11318] RAX: ffffffffffffffda RBX: 00007fba04015fa0 RCX: 00007fba03d9ce59 [ 1232.376985][T11318] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1232.376997][T11318] RBP: 00007fba04ce0090 R08: 0000000000000000 R09: 0000000000000000 [ 1232.377008][T11318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1232.377019][T11318] R13: 00007fba04016038 R14: 00007fba04015fa0 R15: 00007fff468f6238 [ 1232.377049][T11318] [ 1232.781433][T11333] __nla_validate_parse: 8 callbacks suppressed [ 1232.781454][T11333] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10789'. [ 1232.802447][T11333] netlink: 'syz.0.10789': attribute type 13 has an invalid length. [ 1232.844949][T11333] bridge0: port 2(bridge_slave_1) entered disabled state [ 1232.852317][T11333] bridge0: port 1(bridge_slave_0) entered disabled state [ 1232.860820][T11338] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10789'. [ 1232.956076][T11333] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1232.969381][T11333] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1232.986288][T11342] netlink: 'syz.4.10791': attribute type 1 has an invalid length. [ 1233.091512][T11333] gretap0: left allmulticast mode [ 1233.105851][T24191] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.114689][T24191] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.125830][T24191] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.148757][T24191] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.165540][T24191] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.175092][T24191] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.183574][T24191] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1233.192073][T24191] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1233.219453][T11346] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1233.346436][T11354] netlink: 'syz.0.10796': attribute type 1 has an invalid length. [ 1233.398148][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10797'. [ 1233.445838][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10797'. [ 1233.507009][T11358] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10797'. [ 1233.589000][T11368] syzkaller0: entered promiscuous mode [ 1233.594980][T11368] syzkaller0: entered allmulticast mode [ 1234.897280][T24191] net_ratelimit: 60 callbacks suppressed [ 1234.897302][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1234.904438][T11300] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1234.920455][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1235.024475][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1235.087585][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1235.106952][T11378] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10806'. [ 1235.110539][T11373] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10804'. [ 1235.138479][T11379] netlink: 44 bytes leftover after parsing attributes in process `syz.2.10803'. [ 1235.149754][T11377] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10805'. [ 1235.159236][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1235.179142][T11379] netlink: 'syz.2.10803': attribute type 1 has an invalid length. [ 1235.190386][T11379] netlink: 280 bytes leftover after parsing attributes in process `syz.2.10803'. [ 1235.218292][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1235.287473][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1235.327264][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1235.417320][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1235.459008][T24198] bond2: (slave batadv0): failed to get link speed/duplex [ 1236.009424][T11424] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1236.207940][ T9] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1236.247014][T11438] geneve1: entered promiscuous mode [ 1236.275637][T11435] netlink: 'syz.4.10826': attribute type 2 has an invalid length. [ 1236.343520][T11435] IPv6: NLM_F_REPLACE set, but no existing node found! [ 1236.537387][ T9] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1236.834254][T11468] netlink: 'syz.2.10840': attribute type 1 has an invalid length. [ 1236.891233][ T2121] smbdirect: ib_dev[syz2] removed [ 1236.902848][T11468] team0 (unregistering): Port device team_slave_0 removed [ 1236.933149][T11468] team0 (unregistering): Port device team_slave_1 removed [ 1237.117757][T24198] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1237.387758][T11502] ip6tnl3: entered allmulticast mode [ 1237.437224][ T5078] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1237.437699][ T50] Bluetooth: hci0: command 0x0401 tx timeout [ 1237.525314][T11507] xt_NFQUEUE: number of total queues is 0 [ 1237.956124][T11507] __nla_validate_parse: 24 callbacks suppressed [ 1237.956173][T11507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10852'. [ 1237.986936][T11507] netlink: 348 bytes leftover after parsing attributes in process `syz.0.10852'. [ 1237.990089][T11533] netlink: 60 bytes leftover after parsing attributes in process `syz.4.10857'. [ 1238.012934][T11507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10852'. [ 1238.027765][T11507] netlink: 348 bytes leftover after parsing attributes in process `syz.0.10852'. [ 1238.044581][T11536] netlink: 'syz.2.10855': attribute type 3 has an invalid length. [ 1238.056988][T11507] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10852'. [ 1238.123315][T11541] netlink: 'syz.4.10860': attribute type 3 has an invalid length. [ 1238.188208][T24198] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1238.226218][T24198] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1238.253426][ T2121] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1238.271457][ T2121] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1238.296810][T11546] FAULT_INJECTION: forcing a failure. [ 1238.296810][T11546] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1238.308709][T11548] netlink: 32 bytes leftover after parsing attributes in process `syz.2.10862'. [ 1238.353438][T11544] block nbd4: NBD_DISCONNECT [ 1238.406578][T11546] CPU: 1 UID: 0 PID: 11546 Comm: syz.0.10861 Not tainted syzkaller #0 PREEMPT(full) [ 1238.406603][T11546] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1238.406624][T11546] Call Trace: [ 1238.406632][T11546] [ 1238.406640][T11546] dump_stack_lvl+0xe8/0x150 [ 1238.406666][T11546] should_fail_ex+0x412/0x560 [ 1238.406691][T11546] _copy_from_user+0x2d/0xb0 [ 1238.406714][T11546] ___sys_sendmsg+0x1c6/0x360 [ 1238.406734][T11546] ? __lock_acquire+0x6b5/0x2cf0 [ 1238.406756][T11546] ? __pfx____sys_sendmsg+0x10/0x10 [ 1238.406808][T11546] ? __fget_files+0x2a/0x420 [ 1238.406830][T11546] ? __fget_files+0x3a0/0x420 [ 1238.406858][T11546] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1238.406882][T11546] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1238.406912][T11546] ? __pfx_ksys_write+0x10/0x10 [ 1238.406944][T11546] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1238.406963][T11546] do_syscall_64+0x174/0x580 [ 1238.406983][T11546] ? trace_irq_disable+0x3b/0x140 [ 1238.407007][T11546] ? clear_bhb_loop+0x40/0x90 [ 1238.407031][T11546] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1238.407048][T11546] RIP: 0033:0x7f3405d9ce59 [ 1238.407064][T11546] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1238.407079][T11546] RSP: 002b:00007f3406cd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1238.407096][T11546] RAX: ffffffffffffffda RBX: 00007f3406015fa0 RCX: 00007f3405d9ce59 [ 1238.407109][T11546] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1238.407121][T11546] RBP: 00007f3406cd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1238.407132][T11546] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1238.407143][T11546] R13: 00007f3406016038 R14: 00007f3406015fa0 R15: 00007ffd78b598f8 [ 1238.407174][T11546] [ 1238.619251][T11541] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1238.628460][T11541] 8021q: adding VLAN 0 to HW filter on device team0 [ 1238.642236][T11541] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1238.747476][T11541] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1238.769141][T11541] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1238.779682][T11541] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1238.803725][T11541] veth1_vlan: left promiscuous mode [ 1238.811036][T11541] veth0_vlan: left promiscuous mode [ 1238.818151][T11541] veth0_vlan: entered promiscuous mode [ 1238.832527][T11541] veth1_vlan: entered promiscuous mode [ 1238.843758][T11541] veth1_macvtap: left promiscuous mode [ 1238.853404][T11541] veth0_macvtap: left promiscuous mode [ 1238.861537][T11541] veth0_macvtap: entered promiscuous mode [ 1238.869718][T11541] veth1_macvtap: entered promiscuous mode [ 1238.885114][T23508] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1238.891698][T11541] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1238.915435][T11541] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1238.934790][T11541] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1238.966452][T11541] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1239.053080][T11541] bond1: left promiscuous mode [ 1239.069085][T11541] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1239.112520][T11541] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1239.126973][T11541] geneve3: left promiscuous mode [ 1239.139686][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 1239.146914][ T58] bridge0: port 1(bridge_slave_0) entered listening state [ 1239.158857][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 1239.166079][ T58] bridge0: port 2(bridge_slave_1) entered listening state [ 1239.184338][T11569] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10866'. [ 1239.219007][ T2126] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1239.230316][ T2126] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1239.239750][ T2126] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 54726 - 0 [ 1239.282335][ T2126] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1239.304805][ T2126] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1239.349617][ T2126] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 54726 - 0 [ 1239.380714][ T2126] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1239.404082][ T2126] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1239.419503][T11576] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10870'. [ 1239.429615][ T2126] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 54726 - 0 [ 1239.464490][ T2126] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1239.486793][ T2126] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1239.516872][ T2126] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 54726 - 0 [ 1239.586129][T11587] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10876'. [ 1239.977428][ T2121] net_ratelimit: 53 callbacks suppressed [ 1239.977450][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1240.026412][T11614] syzkaller0: entered promiscuous mode [ 1240.044465][T11614] syzkaller0: entered allmulticast mode [ 1240.097267][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1240.124765][T11614] tipc: Enabled bearer , priority 0 [ 1240.162319][T11612] tipc: Resetting bearer [ 1240.229858][T11612] tipc: Disabling bearer [ 1240.288107][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1240.320448][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1240.407254][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1240.438662][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1240.528877][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1240.559359][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1240.605804][T11633] syzkaller1: entered promiscuous mode [ 1240.611993][T11633] syzkaller1: entered allmulticast mode [ 1240.633773][T11633] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1ùà^!‚Y‡°”®˜sûÞ‘§c´ÃõËí [ 1240.633773][T11633] 3 [ 1240.727898][ T1044] bond2: (slave batadv0): failed to get link speed/duplex [ 1240.839983][ T1044] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1241.085519][T11664] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 1241.594281][T11692] tipc: Enabling of bearer rejected, already enabled [ 1241.677426][ T50] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1241.677747][ T5078] Bluetooth: hci0: command 0x0401 tx timeout [ 1241.999030][ T2121] wlan1: Trigger new scan to find an IBSS to join [ 1242.146676][T11717] macvlan4: entered allmulticast mode [ 1242.165811][T11717] gretap0: entered allmulticast mode [ 1242.237268][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1242.362898][T11724] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1242.386165][T11732] netlink: 'syz.4.10928': attribute type 13 has an invalid length. [ 1242.406470][T11728] bond4: entered allmulticast mode [ 1242.716592][T11732] bridge0: port 2(bridge_slave_1) entered disabled state [ 1242.724054][T11732] bridge0: port 1(bridge_slave_0) entered disabled state [ 1243.129263][T11767] Cannot find set identified by id 200 to match [ 1243.169785][T11732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1243.233497][T11771] sctp: [Deprecated]: syz.1.10940 (pid 11771) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1243.233497][T11771] Use struct sctp_sack_info instead [ 1243.837808][T24191] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1243.858793][T24191] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1243.887208][T24191] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 54726 - 0 [ 1243.905166][T24191] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1243.914301][T24191] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1243.928965][T24191] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 54726 - 0 [ 1244.253564][T11794] __nla_validate_parse: 8 callbacks suppressed [ 1244.253582][T11794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10947'. [ 1244.283932][T24191] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1244.303250][T24191] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1244.316065][T11794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10947'. [ 1244.331340][T24191] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 54726 - 0 [ 1244.355191][T24191] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1244.376282][T24191] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1244.392719][T24191] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 54726 - 0 [ 1244.461994][T11794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10947'. [ 1244.620939][T11807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10949'. [ 1244.790160][T11813] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10953'. [ 1244.914129][ T6377] IPVS: starting estimator thread 0... [ 1244.969099][ T2121] wlan1: Trigger new scan to find an IBSS to join [ 1245.007989][T11819] IPVS: using max 32 ests per chain, 76800 per kthread [ 1245.197698][ T2121] net_ratelimit: 31 callbacks suppressed [ 1245.197717][ T2121] bond2: (slave batadv0): failed to get link speed/duplex [ 1245.227741][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1245.230918][T11833] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10960'. [ 1245.296046][T11838] Cannot find set identified by id 552 to match [ 1245.327324][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1245.337977][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1245.364949][T11841] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1245.437543][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1245.458012][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1245.547461][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1245.577238][ T2126] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1245.648583][T11855] netlink: 52 bytes leftover after parsing attributes in process `syz.0.10967'. [ 1245.667774][ T2126] bond2: (slave batadv0): failed to get link speed/duplex [ 1245.694996][T11855] netlink: 'syz.0.10967': attribute type 3 has an invalid length. [ 1245.695683][T11859] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10968'. [ 1245.716743][T11855] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10967'. [ 1245.717375][ T2121] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1245.883091][ T2121] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1246.390899][T11895] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10981'. [ 1246.837724][T11914] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 1247.441257][T11936] syzkaller0: entered promiscuous mode [ 1247.457448][T11936] syzkaller0: entered allmulticast mode [ 1247.544642][T11943] vxcan2: entered allmulticast mode [ 1247.623250][T11952] macvlan5: entered allmulticast mode [ 1247.764481][T11960] FAULT_INJECTION: forcing a failure. [ 1247.764481][T11960] name failslab, interval 1, probability 0, space 0, times 0 [ 1247.779487][T11960] CPU: 1 UID: 0 PID: 11960 Comm: syz.0.11005 Not tainted syzkaller #0 PREEMPT(full) [ 1247.779514][T11960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1247.779526][T11960] Call Trace: [ 1247.779535][T11960] [ 1247.779543][T11960] dump_stack_lvl+0xe8/0x150 [ 1247.779573][T11960] should_fail_ex+0x412/0x560 [ 1247.779599][T11960] should_failslab+0xa8/0x100 [ 1247.779619][T11960] ? dst_alloc+0x105/0x170 [ 1247.779651][T11960] kmem_cache_alloc_noprof+0x87/0x650 [ 1247.779675][T11960] ? ip6_pol_route+0x160/0x13d0 [ 1247.779783][T11960] ? __pfx_ip6_dst_gc+0x10/0x10 [ 1247.779885][T11960] dst_alloc+0x105/0x170 [ 1247.779913][T11960] ip6_pol_route+0xafb/0x13d0 [ 1247.779934][T11960] ? ip6_pol_route+0x160/0x13d0 [ 1247.779959][T11960] ? __pfx_ip6_pol_route+0x10/0x10 [ 1247.779985][T11960] ? is_bpf_text_address+0x26/0x2b0 [ 1247.780017][T11960] fib6_rule_action+0x265/0xc00 [ 1247.780067][T11960] ? fib_rules_lookup+0x9b/0xea0 [ 1247.780091][T11960] ? __pfx_fib6_rule_action+0x10/0x10 [ 1247.780115][T11960] ? kernel_text_address+0xa5/0xe0 [ 1247.780140][T11960] ? __kernel_text_address+0xd/0x30 [ 1247.780158][T11960] ? fib6_rule_match+0x79a/0xa80 [ 1247.780175][T11960] ? __pfx_fib6_rule_action+0x10/0x10 [ 1247.780197][T11960] fib_rules_lookup+0x768/0xea0 [ 1247.780223][T11960] ? fib_rules_lookup+0x9b/0xea0 [ 1247.780251][T11960] ? __pfx_fib_rules_lookup+0x10/0x10 [ 1247.780272][T11960] ? l3mdev_update_flow+0x29/0x640 [ 1247.780328][T11960] ? l3mdev_update_flow+0x4d1/0x640 [ 1247.780355][T11960] fib6_rule_lookup+0x1a0/0x730 [ 1247.780376][T11960] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 1247.780399][T11960] ? __pfx_fib6_rule_lookup+0x10/0x10 [ 1247.780421][T11960] ? ip6_route_output_flags+0x2e/0x5d0 [ 1247.780444][T11960] ? __pfx_ip6_pol_route_output+0x10/0x10 [ 1247.780483][T11960] ip6_route_output_flags+0x364/0x5d0 [ 1247.780505][T11960] ? ip6_route_output_flags+0x2e/0x5d0 [ 1247.780529][T11960] ip6_dst_lookup_tail+0x1c3/0x15a0 [ 1247.780618][T11960] ? __pfx_ip6_dst_lookup_tail+0x10/0x10 [ 1247.780649][T11960] ? sk_dst_check+0x25/0x480 [ 1247.780681][T11960] ? sk_dst_check+0x25/0x480 [ 1247.780710][T11960] ? sk_dst_check+0x25/0x480 [ 1247.780733][T11960] ? sk_dst_check+0x30e/0x480 [ 1247.780762][T11960] ip6_sk_dst_lookup_flow+0x765/0xa20 [ 1247.780797][T11960] udpv6_sendmsg+0x1a69/0x25c0 [ 1247.780867][T11960] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 1247.780887][T11960] ? udp_lib_get_port+0x177a/0x1c60 [ 1247.780951][T11960] ? ip6_datagram_release_cb+0x7c/0x550 [ 1247.781041][T11960] ? inet_send_prepare+0x1b9/0x270 [ 1247.781068][T11960] ? inet_send_prepare+0x1b9/0x270 [ 1247.781098][T11960] ? inet_send_prepare+0x1b9/0x270 [ 1247.781121][T11960] ? __local_bh_enable_ip+0xd0/0x130 [ 1247.781141][T11960] ? inet_send_prepare+0x1b9/0x270 [ 1247.781170][T11960] ? inet6_sendmsg+0xe4/0x120 [ 1247.781191][T11960] ____sys_sendmsg+0x5c7/0x9f0 [ 1247.781219][T11960] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1247.781250][T11960] ? import_iovec+0x73/0xa0 [ 1247.781277][T11960] ___sys_sendmsg+0x2a5/0x360 [ 1247.781297][T11960] ? __lock_acquire+0x6b5/0x2cf0 [ 1247.781323][T11960] ? __pfx____sys_sendmsg+0x10/0x10 [ 1247.781383][T11960] ? __fget_files+0x2a/0x420 [ 1247.781404][T11960] ? __fget_files+0x3a0/0x420 [ 1247.781438][T11960] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1247.781462][T11960] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1247.781495][T11960] ? __pfx_ksys_write+0x10/0x10 [ 1247.781531][T11960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1247.781552][T11960] do_syscall_64+0x174/0x580 [ 1247.781572][T11960] ? trace_irq_disable+0x3b/0x140 [ 1247.781597][T11960] ? clear_bhb_loop+0x40/0x90 [ 1247.781621][T11960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1247.781647][T11960] RIP: 0033:0x7f3405d9ce59 [ 1247.781666][T11960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1247.781682][T11960] RSP: 002b:00007f3406cd0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1247.781702][T11960] RAX: ffffffffffffffda RBX: 00007f3406015fa0 RCX: 00007f3405d9ce59 [ 1247.781716][T11960] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1247.781728][T11960] RBP: 00007f3406cd0090 R08: 0000000000000000 R09: 0000000000000000 [ 1247.781740][T11960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1247.781751][T11960] R13: 00007f3406016038 R14: 00007f3406015fa0 R15: 00007ffd78b598f8 [ 1247.781801][T11960] [ 1248.254135][T11960] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1248.393279][T11980] netlink: 'syz.2.11009': attribute type 83 has an invalid length. [ 1248.469996][T11982] lo speed is unknown, defaulting to 1000 [ 1248.754330][T11986] netlink: 'syz.1.11011': attribute type 1 has an invalid length. [ 1249.031514][T12005] gre1: entered allmulticast mode [ 1249.102292][T12007] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input8 [ 1249.282493][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1249.402897][T12023] __nla_validate_parse: 10 callbacks suppressed [ 1249.402915][T12023] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11023'. [ 1250.102667][T12052] FAULT_INJECTION: forcing a failure. [ 1250.102667][T12052] name failslab, interval 1, probability 0, space 0, times 0 [ 1250.116162][T12052] CPU: 0 UID: 0 PID: 12052 Comm: syz.4.11031 Not tainted syzkaller #0 PREEMPT(full) [ 1250.116188][T12052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1250.116200][T12052] Call Trace: [ 1250.116208][T12052] [ 1250.116216][T12052] dump_stack_lvl+0xe8/0x150 [ 1250.116244][T12052] should_fail_ex+0x412/0x560 [ 1250.116270][T12052] should_failslab+0xa8/0x100 [ 1250.116289][T12052] ? __kernfs_new_node+0xea/0x970 [ 1250.116314][T12052] kmem_cache_alloc_noprof+0x87/0x650 [ 1250.116347][T12052] __kernfs_new_node+0xea/0x970 [ 1250.116377][T12052] ? __pfx___kernfs_new_node+0x10/0x10 [ 1250.116405][T12052] ? kernfs_root+0x1c/0x230 [ 1250.116434][T12052] ? kernfs_root+0x1c/0x230 [ 1250.116456][T12052] ? kernfs_root+0x1c/0x230 [ 1250.116476][T12052] ? kernfs_root+0x1c/0x230 [ 1250.116504][T12052] kernfs_new_node+0x102/0x210 [ 1250.116533][T12052] __kernfs_create_file+0x4b/0x2e0 [ 1250.116556][T12052] sysfs_add_file_mode_ns+0x238/0x300 [ 1250.116586][T12052] internal_create_group+0x673/0x1190 [ 1250.116622][T12052] ? __pfx_internal_create_group+0x10/0x10 [ 1250.116642][T12052] ? kernfs_add_one+0x477/0x5c0 [ 1250.116667][T12052] ? up_write+0x1ab/0x410 [ 1250.116692][T12052] sysfs_create_groups+0x59/0x120 [ 1250.116715][T12052] device_add_attrs+0x1bf/0x5b0 [ 1250.116747][T12052] ? __pfx_device_add_attrs+0x10/0x10 [ 1250.116769][T12052] ? kobject_put+0x516/0x560 [ 1250.116797][T12052] ? device_add_class_symlinks+0x21f/0x240 [ 1250.116825][T12052] device_add+0x496/0xbb0 [ 1250.116850][T12052] ? device_initialize+0x26a/0x460 [ 1250.116878][T12052] wakeup_source_sysfs_add+0x1d3/0x2c0 [ 1250.116909][T12052] wakeup_source_register+0x18a/0x380 [ 1250.116940][T12052] ep_insert+0xf34/0x1a40 [ 1250.116978][T12052] ? __pfx_ep_insert+0x10/0x10 [ 1250.117014][T12052] ? bpf_lsm_capable+0x9/0x20 [ 1250.117040][T12052] do_epoll_ctl+0x7f4/0xe80 [ 1250.117069][T12052] __x64_sys_epoll_ctl+0x165/0x1b0 [ 1250.117095][T12052] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 1250.117127][T12052] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.117148][T12052] do_syscall_64+0x174/0x580 [ 1250.117167][T12052] ? trace_irq_disable+0x3b/0x140 [ 1250.117192][T12052] ? clear_bhb_loop+0x40/0x90 [ 1250.117215][T12052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1250.117233][T12052] RIP: 0033:0x7fa55959ce59 [ 1250.117250][T12052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1250.117266][T12052] RSP: 002b:00007fa55a377028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 1250.117285][T12052] RAX: ffffffffffffffda RBX: 00007fa559815fa0 RCX: 00007fa55959ce59 [ 1250.117299][T12052] RDX: 0000000000000004 RSI: 0000000000000001 RDI: 0000000000000003 [ 1250.117309][T12052] RBP: 00007fa55a377090 R08: 0000000000000000 R09: 0000000000000000 [ 1250.117321][T12052] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1250.117332][T12052] R13: 00007fa559816038 R14: 00007fa559815fa0 R15: 00007ffc119ed2d8 [ 1250.117364][T12052] [ 1250.327415][ C1] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1250.335691][ T58] net_ratelimit: 1084 callbacks suppressed [ 1250.335709][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1250.450151][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1250.452653][T12055] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11033'. [ 1250.524720][T12059] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 1250.587885][T12064] netlink: 16 bytes leftover after parsing attributes in process `syz.2.11038'. [ 1250.607327][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1250.627560][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1250.657361][T12063] block nbd4: server does not support multiple connections per device. [ 1250.666795][T12063] block nbd4: shutting down sockets [ 1250.719571][T12076] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11041'. [ 1250.747203][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1250.767156][T24191] bond2: (slave batadv0): failed to get link speed/duplex [ 1250.857229][T24191] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1250.868283][T12080] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11043'. [ 1250.965055][T12086] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11044'. [ 1250.979696][T12088] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11045'. [ 1250.995486][T12088] netlink: 28 bytes leftover after parsing attributes in process `syz.2.11045'. [ 1251.037457][ C0] ip6_tunnel: ip6gretap1 xmit: Local address not yet configured! [ 1251.080025][T12088] erspan0: entered promiscuous mode [ 1251.105498][T12088] gretap0: entered promiscuous mode [ 1251.118172][ T50] Bluetooth: hci0: command 0x0401 tx timeout [ 1251.126345][ T5078] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1251.129244][T12088] gretap0: left promiscuous mode [ 1251.151383][T12094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11047'. [ 1251.160777][T12088] erspan0: left promiscuous mode [ 1251.268795][T12103] Cannot find set identified by id 10242 to match [ 1251.270018][T12098] tc_dump_action: action bad kind [ 1251.439588][ T58] bond2: (slave batadv0): failed to get link speed/duplex [ 1251.448693][T12100] lo speed is unknown, defaulting to 1000 [ 1251.448980][T12073] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1251.467452][ T58] bond11: (slave ip6gretap1): failed to get link speed/duplex [ 1251.499044][T12073] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 1251.558373][T24188] bond2: (slave batadv0): failed to get link speed/duplex [ 1251.650287][T12073] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1251.658164][T12073] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 1251.769024][T12130] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11058'. [ 1251.816115][T12073] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1251.824279][T24191] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.844046][T12073] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1251.853418][T24191] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.878584][T24191] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.902102][T24191] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1251.949209][ C1] ------------[ cut here ]------------ [ 1251.956413][ C1] refcount_t: underflow; use-after-free. [ 1251.962157][ C1] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110, CPU#1: modprobe/12135 [ 1251.972126][ C1] Modules linked in: [ 1251.976643][ C1] CPU: 1 UID: 0 PID: 12135 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) [ 1251.985925][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1251.996032][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 1252.002381][ C1] Code: e4 f0 89 0b 67 48 0f b9 3a eb 4a e8 78 f5 13 fd 48 8d 3d e1 f0 89 0b 67 48 0f b9 3a eb 37 e8 65 f5 13 fd 48 8d 3d de f0 89 0b <67> 48 0f b9 3a eb 24 e8 52 f5 13 fd 48 8d 3d db f0 89 0b 67 48 0f [ 1252.022039][ C1] RSP: 0000:ffffc90000a08c68 EFLAGS: 00010246 [ 1252.028175][ C1] RAX: ffffffff84b1c14b RBX: 0000000000000003 RCX: ffff88802c84be00 [ 1252.036166][ C1] RDX: 0000000000000100 RSI: ffffffff8f1110a0 RDI: ffffffff903bb230 [ 1252.044388][ C1] RBP: ffffc90000a08d70 R08: ffff88802c84be00 R09: 0000000000000005 [ 1252.052588][ C1] R10: 0000000000000004 R11: 0000000000000100 R12: 0000000000000001 [ 1252.060727][ C1] R13: 000000010001731b R14: ffff888057fa1020 R15: ffff888057fa11b8 [ 1252.068762][ C1] FS: 0000000000000000(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000 [ 1252.077769][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1252.084402][ C1] CR2: 00007f3aac14c048 CR3: 000000006faf4000 CR4: 00000000003526f0 [ 1252.092467][ C1] Call Trace: [ 1252.095765][ C1] [ 1252.098698][ C1] call_timer_fn+0x192/0x5e0 [ 1252.103327][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10 [ 1252.110174][ C1] ? call_timer_fn+0xd4/0x5e0 [ 1252.115245][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1252.120671][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1252.125963][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10 [ 1252.132647][ C1] __run_timer_base+0x652/0x8b0 [ 1252.137575][ C1] ? ktime_get+0x45/0x220 [ 1252.144744][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 1252.150225][ C1] run_timer_softirq+0xb7/0x170 [ 1252.155116][ C1] handle_softirqs+0x22a/0x840 [ 1252.160055][ C1] ? __irq_exit_rcu+0xca/0x220 [ 1252.164873][ C1] __irq_exit_rcu+0xca/0x220 [ 1252.169534][ C1] irq_exit_rcu+0x9/0x30 [ 1252.173814][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1252.179529][ C1] [ 1252.182498][ C1] [ 1252.185442][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1252.191503][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 1252.197645][ C1] Code: 89 fb e8 23 00 00 00 48 8b 3d 64 09 61 0c 48 89 de 5b e9 c3 06 60 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 48 a9 73 11 65 8b 15 69 a9 73 [ 1252.217312][ C1] RSP: 0000:ffffc9000da27670 EFLAGS: 00000246 [ 1252.223407][ C1] RAX: ffffffff823c8ec3 RBX: 0000000000000001 RCX: ffff88802c84be00 [ 1252.231547][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 1252.239676][ C1] RBP: dffffc0000000000 R08: ffff88801ea3072f R09: 1ffff11003d460e5 [ 1252.247767][ C1] R10: dffffc0000000000 R11: ffffed1003d460e6 R12: 0000000000000001 [ 1252.255853][ C1] R13: 000000000007f017 R14: dffffc0000000000 R15: ffff88801ea30730 [ 1252.263960][ C1] ? __page_table_check_zero+0x1a3/0x3e0 [ 1252.265383][T12104] netlink: 'syz.1.11052': attribute type 1 has an invalid length. [ 1252.271684][ C1] __page_table_check_zero+0x302/0x3e0 [ 1252.283275][ C1] ? __page_table_check_zero+0x6a/0x3e0 [ 1252.288905][ C1] post_alloc_hook+0x23c/0x280 [ 1252.293717][ C1] get_page_from_freelist+0x2593/0x2610 [ 1252.299327][ C1] ? stack_trace_save+0xa9/0x100 [ 1252.304315][ C1] ? fs_reclaim_acquire+0x7c/0x100 [ 1252.309527][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1252.315373][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1252.321786][ C1] ? __pfx_policy_nodemask+0x10/0x10 [ 1252.327303][ C1] ? __anon_vma_prepare+0x21c/0x4a0 [ 1252.332642][ C1] alloc_pages_mpol+0x235/0x490 [ 1252.337567][ C1] folio_alloc_mpol_noprof+0x39/0x160 [ 1252.343068][ C1] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1252.348532][ C1] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1252.354464][ C1] do_pte_missing+0x520/0x33f0 [ 1252.359345][ C1] ? handle_mm_fault+0xf1/0x3170 [ 1252.364324][ C1] handle_mm_fault+0x1bf2/0x3170 [ 1252.369338][ C1] ? handle_mm_fault+0xf1/0x3170 [ 1252.374318][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 1252.379669][ C1] ? lock_vma_under_rcu+0x45a/0x500 [ 1252.384924][ C1] ? __fget_files+0x2a/0x420 [ 1252.389586][ C1] do_user_addr_fault+0xa73/0x1340 [ 1252.394790][ C1] ? rcu_is_watching+0x15/0xb0 [ 1252.399614][ C1] ? trace_page_fault_user+0x84/0x1e0 [ 1252.405027][ C1] exc_page_fault+0x6a/0xc0 [ 1252.409688][ C1] asm_exc_page_fault+0x26/0x30 [ 1252.414571][ C1] RIP: 0033:0x7f3aac477ff2 [ 1252.419054][ C1] Code: 0f 60 c0 66 0f 61 c0 66 0f 70 c0 00 48 83 fa 10 72 76 48 83 fa 20 77 12 0f 11 44 17 f0 0f 11 07 c3 0f 11 47 e0 0f 11 47 f0 c3 <0f> 11 07 0f 11 47 10 48 01 d7 48 83 fa 40 76 e7 0f 11 40 20 0f 11 [ 1252.438894][ C1] RSP: 002b:00007ffe6aa01398 EFLAGS: 00010202 [ 1252.444991][ C1] RAX: 00007f3aac14c048 RBX: 0000000000000004 RCX: 00007f3aac14d088 [ 1252.453109][ C1] RDX: 0000000000000fb8 RSI: 0000000000000000 RDI: 00007f3aac14c048 [ 1252.461148][ C1] RBP: 00007ffe6aa01720 R08: 00007f3aac14c048 R09: 0000000000000003 [ 1252.469182][ C1] R10: 0000000000000812 R11: 00007ffe6aa01808 R12: 00007ffe6aa01448 [ 1252.477207][ C1] R13: 00007f3aac14e0c0 R14: 00007ffe6aa017c0 R15: 00007f3aac14d000 [ 1252.485310][ C1] [ 1252.488400][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1252.495782][ C1] CPU: 1 UID: 0 PID: 12135 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) [ 1252.505021][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 1252.515198][ C1] Call Trace: [ 1252.518577][ C1] [ 1252.521424][ C1] vpanic+0x56c/0xa60 [ 1252.525410][ C1] ? __pfx__printk+0x10/0x10 [ 1252.529999][ C1] ? __pfx_vpanic+0x10/0x10 [ 1252.534492][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 1252.539771][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 1252.545067][ C1] panic+0xc5/0xd0 [ 1252.548870][ C1] ? __pfx_panic+0x10/0x10 [ 1252.553294][ C1] __warn+0x315/0x4c0 [ 1252.557362][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 1252.562840][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 1252.568399][ C1] __report_bug+0x29a/0x540 [ 1252.572975][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 1252.578429][ C1] ? __pfx___report_bug+0x10/0x10 [ 1252.583462][ C1] report_bug_entry+0x19a/0x290 [ 1252.588311][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 1252.593869][ C1] ? refcount_warn_saturate+0xb7/0x110 [ 1252.599411][ C1] handle_bug+0xce/0x200 [ 1252.603651][ C1] exc_invalid_op+0x1a/0x50 [ 1252.608162][ C1] asm_exc_invalid_op+0x1a/0x20 [ 1252.613011][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 1252.619074][ C1] Code: e4 f0 89 0b 67 48 0f b9 3a eb 4a e8 78 f5 13 fd 48 8d 3d e1 f0 89 0b 67 48 0f b9 3a eb 37 e8 65 f5 13 fd 48 8d 3d de f0 89 0b <67> 48 0f b9 3a eb 24 e8 52 f5 13 fd 48 8d 3d db f0 89 0b 67 48 0f [ 1252.638682][ C1] RSP: 0000:ffffc90000a08c68 EFLAGS: 00010246 [ 1252.644826][ C1] RAX: ffffffff84b1c14b RBX: 0000000000000003 RCX: ffff88802c84be00 [ 1252.652811][ C1] RDX: 0000000000000100 RSI: ffffffff8f1110a0 RDI: ffffffff903bb230 [ 1252.660778][ C1] RBP: ffffc90000a08d70 R08: ffff88802c84be00 R09: 0000000000000005 [ 1252.668763][ C1] R10: 0000000000000004 R11: 0000000000000100 R12: 0000000000000001 [ 1252.676725][ C1] R13: 000000010001731b R14: ffff888057fa1020 R15: ffff888057fa11b8 [ 1252.684784][ C1] ? refcount_warn_saturate+0xab/0x110 [ 1252.690255][ C1] ? refcount_warn_saturate+0xab/0x110 [ 1252.695713][ C1] call_timer_fn+0x192/0x5e0 [ 1252.700297][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10 [ 1252.706801][ C1] ? call_timer_fn+0xd4/0x5e0 [ 1252.711473][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 1252.716591][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 1252.722004][ C1] ? __pfx_sctp_generate_heartbeat_event+0x10/0x10 [ 1252.728567][ C1] __run_timer_base+0x652/0x8b0 [ 1252.733538][ C1] ? ktime_get+0x45/0x220 [ 1252.737898][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 1252.743276][ C1] run_timer_softirq+0xb7/0x170 [ 1252.748205][ C1] handle_softirqs+0x22a/0x840 [ 1252.752964][ C1] ? __irq_exit_rcu+0xca/0x220 [ 1252.757725][ C1] __irq_exit_rcu+0xca/0x220 [ 1252.762305][ C1] irq_exit_rcu+0x9/0x30 [ 1252.766539][ C1] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 1252.772176][ C1] [ 1252.775118][ C1] [ 1252.778046][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1252.784138][ C1] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 [ 1252.790211][ C1] Code: 89 fb e8 23 00 00 00 48 8b 3d 64 09 61 0c 48 89 de 5b e9 c3 06 60 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 48 a9 73 11 65 8b 15 69 a9 73 [ 1252.809838][ C1] RSP: 0000:ffffc9000da27670 EFLAGS: 00000246 [ 1252.815914][ C1] RAX: ffffffff823c8ec3 RBX: 0000000000000001 RCX: ffff88802c84be00 [ 1252.823903][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 1252.831894][ C1] RBP: dffffc0000000000 R08: ffff88801ea3072f R09: 1ffff11003d460e5 [ 1252.840475][ C1] R10: dffffc0000000000 R11: ffffed1003d460e6 R12: 0000000000000001 [ 1252.848451][ C1] R13: 000000000007f017 R14: dffffc0000000000 R15: ffff88801ea30730 [ 1252.856514][ C1] ? __page_table_check_zero+0x1a3/0x3e0 [ 1252.862513][ C1] __page_table_check_zero+0x302/0x3e0 [ 1252.867977][ C1] ? __page_table_check_zero+0x6a/0x3e0 [ 1252.873525][ C1] post_alloc_hook+0x23c/0x280 [ 1252.878345][ C1] get_page_from_freelist+0x2593/0x2610 [ 1252.883908][ C1] ? stack_trace_save+0xa9/0x100 [ 1252.888862][ C1] ? fs_reclaim_acquire+0x7c/0x100 [ 1252.893997][ C1] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1252.899804][ C1] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1252.906140][ C1] ? __pfx_policy_nodemask+0x10/0x10 [ 1252.911452][ C1] ? __anon_vma_prepare+0x21c/0x4a0 [ 1252.916679][ C1] alloc_pages_mpol+0x235/0x490 [ 1252.921535][ C1] folio_alloc_mpol_noprof+0x39/0x160 [ 1252.926914][ C1] vma_alloc_folio_noprof+0xe1/0x1e0 [ 1252.932198][ C1] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1252.938180][ C1] do_pte_missing+0x520/0x33f0 [ 1252.943305][ C1] ? handle_mm_fault+0xf1/0x3170 [ 1252.948243][ C1] handle_mm_fault+0x1bf2/0x3170 [ 1252.953191][ C1] ? handle_mm_fault+0xf1/0x3170 [ 1252.958137][ C1] ? __pfx_handle_mm_fault+0x10/0x10 [ 1252.963425][ C1] ? lock_vma_under_rcu+0x45a/0x500 [ 1252.968636][ C1] ? __fget_files+0x2a/0x420 [ 1252.973237][ C1] do_user_addr_fault+0xa73/0x1340 [ 1252.978349][ C1] ? rcu_is_watching+0x15/0xb0 [ 1252.983194][ C1] ? trace_page_fault_user+0x84/0x1e0 [ 1252.988561][ C1] exc_page_fault+0x6a/0xc0 [ 1252.993063][ C1] asm_exc_page_fault+0x26/0x30 [ 1252.997910][ C1] RIP: 0033:0x7f3aac477ff2 [ 1253.002342][ C1] Code: 0f 60 c0 66 0f 61 c0 66 0f 70 c0 00 48 83 fa 10 72 76 48 83 fa 20 77 12 0f 11 44 17 f0 0f 11 07 c3 0f 11 47 e0 0f 11 47 f0 c3 <0f> 11 07 0f 11 47 10 48 01 d7 48 83 fa 40 76 e7 0f 11 40 20 0f 11 [ 1253.021948][ C1] RSP: 002b:00007ffe6aa01398 EFLAGS: 00010202 [ 1253.028021][ C1] RAX: 00007f3aac14c048 RBX: 0000000000000004 RCX: 00007f3aac14d088 [ 1253.035984][ C1] RDX: 0000000000000fb8 RSI: 0000000000000000 RDI: 00007f3aac14c048 [ 1253.043946][ C1] RBP: 00007ffe6aa01720 R08: 00007f3aac14c048 R09: 0000000000000003 [ 1253.051999][ C1] R10: 0000000000000812 R11: 00007ffe6aa01808 R12: 00007ffe6aa01448 [ 1253.059972][ C1] R13: 00007f3aac14e0c0 R14: 00007ffe6aa017c0 R15: 00007f3aac14d000 [ 1253.067960][ C1] [ 1253.071394][ C1] Kernel Offset: disabled [ 1253.075713][ C1] Rebooting in 86400 seconds..