last executing test programs: 2.656813489s ago: executing program 3 (id=6789): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000002600)=@delchain={0x388, 0x65, 0x400, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0x0, 0x1}, {0xb}}, [@filter_kind_options=@f_bpf={{0x8}, {0x35c, 0x2, [@TCA_BPF_ACT={0x358, 0x1, [@m_xt={0x80, 0x5, 0x0, 0x0, {{0x7}, {0x4}, {0x58, 0x6, "a5fd64840366fd7ad44f3f053221ded9ced495590e2bc8690a2765e56ded8425cb3eb0e04bbcfec50e639bf373167e617b24eccd260f28bb850873b1e2154b158987d6e585e10ffeaba32641bae47de041e1169d"}, {0xc, 0x7, {0x1, 0xeb0757422c733451}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_skbmod={0x1d8, 0x0, 0x0, 0x0, {{0xb}, {0xb4, 0x2, 0x0, 0x1, [@TCA_SKBMOD_DMAC={0xa, 0x3, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x4, 0xe27, 0x10000000, 0x4bc5, 0x1}, 0xf}}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x5, 0x2, 0x5, 0x5, 0x400}, 0xa}}, @TCA_SKBMOD_DMAC={0xa, 0x3, @local}, @TCA_SKBMOD_DMAC={0xa, 0x3, @local}, @TCA_SKBMOD_DMAC={0xa, 0x3, @remote}, @TCA_SKBMOD_PARMS={0x24, 0x2, {{0x6, 0x3, 0x20000000, 0x3, 0x9}, 0xf}}, @TCA_SKBMOD_SMAC={0xa, 0x4, @multicast}, @TCA_SKBMOD_ETYPE={0x6, 0x5, 0xf7e5}]}, {0xf9, 0x6, "a1b660f5208936232cda86dbc72ce07ea965ef6ba1d1d09844721c7c4a99215f65588f37144130a0cfe892f40c7bd1b1c60c0ae07d055bb7d54c8481900754b36455377c7ddafad62bd905b87e203cd85441766254f1fb76d106fc2ab3b535bd37b963914a3937078f08fe2b215c53ac1637586d19d3179be2480bd4560f5f3df8af92646dcc1fbd383420085b4c07db2f0413025ad48ce3b346d0decc2020a76819621adf129187c02cc25e2c07331a44b29b6bee81ecbc147aa5d146be79432192fc1574145998b7d3b55d80dd7464335395b4f37be9047482b255b6f0dec2c748724aa49cbfa5ba9725d35fc7540b4a32031dc5"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_bpf={0xd0, 0x8, 0x0, 0x0, {{0x8}, {0x4}, {0xa5, 0x6, "5d3aee85a6264cff4a2163adaec321e008985cfa435b8922eeb16f1932265618158a3fe72c442a68b182e8f673f9251a03dc831c5947be17ca906c3dcb99adb55bc5f0ad8886f235f45d7e29bb727715f2e7a3200ac63eb79f7a023835874514b60b0177c40370157c0c21b37875e7e4a2e75b3cc54be7d719fa695469336b975cb56bf3667e66922c0cf263fb2e4901e74673ec3bf8e140cb438b8aae24d0722b"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_nat={0x2c, 0x4, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}]}}]}, 0x388}, 0x1, 0x0, 0x0, 0x2404c080}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 2.4343933s ago: executing program 3 (id=6795): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b400000000004100791028000000000069002600000000009500740000000000", @ANYRESDEC], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/164, 0x0, 0x25, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff8f}, 0x48) 2.281998556s ago: executing program 3 (id=6799): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c00001408b5fbc81e00000100000800"/26], 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) recvmsg(r0, &(0x7f000000c1c0)={0x0, 0x0, &(0x7f000000c080)=[{&(0x7f000000acc0)=""/4096, 0x1000}, {&(0x7f000000bec0)=""/27, 0x1b}], 0x2}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$unix(0x1, 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xa, 0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x0, 0x0, 0x1, 0x7ff, 0x2}, {0x6, 0x0, 0x8, 0x6, 0x8, 0x401}, 0x40, 0xd, 0x8ef}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40098}, 0x4054) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) 2.061806528s ago: executing program 0 (id=6803): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r0) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000a40)=""/137, 0x89}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f00000004c0)=""/155, 0x9b}, {&(0x7f0000000840)=""/206, 0xce}, {&(0x7f0000000bc0)=""/4036, 0xfc4}, {&(0x7f0000000180)=""/111, 0x6f}, {&(0x7f0000000340)=""/147, 0x93}], 0x7, 0x0, 0x8900}, 0x401}], 0x1, 0x40000180, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) 1.894282831s ago: executing program 0 (id=6805): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000180)=@ccm_128={{0x303}, "e4fffffffffffbff", "ffff5288bc32f80300", "b6730761", "f3ffffffffffffff"}, 0x28) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f5d937e5523", "4705a7b6113b967d0300", "1d1cbe23", "ecba06893bcdc493"}, 0x28) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7020000010000008500000086000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r3, 0x0, 0x10, 0x10, &(0x7f00000002c0)="00f0000000000000", &(0x7f0000000300)=""/8, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112c1000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 1.788403633s ago: executing program 1 (id=6808): r0 = socket$inet6(0xa, 0x5, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000180), 0xc, &(0x7f0000000600)={&(0x7f0000000280)={0x18, r3, 0x800, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_EEE_MODES_OURS={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x44095}, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000040)={r2, 0xe869, 0x30, 0x7fff, 0x1}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000280)='bbr', 0x65) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000000) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000002c0)={r4, 0xc0, "21efe704a8265782f4aab038f0dc2be41441b1a86d79931bca33a8cf95b81c7baed643e6d5d8072e07df7c5ec2249c93566207a6d034b0586d6661a9f7f99b49b56fadd6dbbec228b5fea784a97680039fb790a562b77474ab340901994b8f949daa27caef24aad5c8523efe0d6ba42451234799473d856ac61f5a5b7538f3ada547d24506ffd65acef536ec79453694613779bccad318ca8578b8e0f15698a1a762726ce9fbea72a3049e60f32fb24e1fd5430648afea42964b8f03810e4af0"}, &(0x7f00000003c0)=0xc8) sendmsg$NFT_MSG_GETOBJ(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x10}, 0x82) 1.622127765s ago: executing program 1 (id=6811): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x4008}, 0x40000) 1.62159957s ago: executing program 4 (id=6812): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000009b80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x30, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x58}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x7, 0x4, 0x8, 0x3ff, 0x0, 0x1}, 0x48) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0xa8, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x7c, 0x4, 0x0, 0x1, [{0x78, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x68, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x50, 0x3, "cd4b6abe42031763d02899c77f99ff5fe87a9d3ac869f3a860917523679a5eb46131471826390d810593448ba1ecbf4579f9cd6564e64066681fb945bfe585ab6933a6f6514a0eebad4e3537"}, @NFTA_TARGET_NAME={0xa, 0x1, 'NFLOG\x00'}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xd0}, 0x1, 0x0, 0x0, 0x10}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket(0x10, 0x3, 0x0) socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) r4 = socket(0x8, 0x3, 0x3) ioctl$sock_inet6_udp_SIOCINQ(r4, 0x541b, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f0000000440)=""/96, 0x60}, {&(0x7f00000004c0)=""/77, 0xfffffffffffffe9d}, {&(0x7f0000002800)=""/4096, 0x1000}], 0x5}, 0x1}], 0x1, 0x22, 0x0) listen(r3, 0x9) 1.562763509s ago: executing program 1 (id=6813): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x0) recvmsg$unix(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000240)=""/54, 0x36}], 0x1}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028"], 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 1.413367479s ago: executing program 4 (id=6814): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r1, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e67}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) (fail_nth: 10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) 1.081275494s ago: executing program 2 (id=6819): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010100000000000000002b00000008000300", @ANYRES32=r3, @ANYBLOB="04004600070034004031e300080026006c0900002c00518028000080090001"], 0x5c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000007c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000010000002c0004800500030080ff00000500030005080000050003000600faff05000300000000000500030000f3000008000100ffffffff0800020002"], 0x50}}, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) (async) r7 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000002740)=@newchain={0x24, 0x64, 0xf09d2fbf8b68c555, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x8}, {0xfff1, 0xe}, {0x9, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004880}, 0x44000) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a74000000060a010400000000000000000200000048000480440001800a0001006d61746368000000340002800900010074696d65000000001c00030007682c020b7b37f27f5101007f51010049f4e34e860200eb08000240000000000900010073797a30000000000900020073797a32"], 0x9c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmsg$NFT_BATCH(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a74000000060a010400000000000000000200000048000480440001800a0001006d61746368000000340002800900010074696d65000000001c00030007682c020b7b37f27f5101007f51010049f4e34e860200eb08000240000000000900010073797a30000000000900020073797a32"], 0x9c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(r8, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x8c, 0x3, 0x7, 0x3, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x38}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xffffff81}, @NFACCT_FILTER_MASK={0x8}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x8001}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x46da241d}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1ff}]}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x6}]}, 0x8c}, 0x1, 0x0, 0x0, 0x50}, 0x1) (async) sendmsg$NFNL_MSG_ACCT_DEL(r8, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0x8c, 0x3, 0x7, 0x3, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFACCT_FILTER={0x1c, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x38}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0xffffff81}, @NFACCT_FILTER_MASK={0x8}]}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x8001}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x46da241d}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x8}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfffffffe}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfff}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x1ff}]}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x6}]}, 0x8c}, 0x1, 0x0, 0x0, 0x50}, 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r7) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r7) 925.691761ms ago: executing program 0 (id=6820): syz_emit_ethernet(0x6a, &(0x7f0000000140)={@broadcast, @random="17043a73dbde", @void, {@ipv4={0x8fe, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @empty=0xac1414aa, @private=0xa010102, {[@lsrr={0x83, 0x3}, @rr={0x7, 0x3, 0xf5}, @timestamp_prespec={0x44, 0x24, 0xd2, 0x3, 0x0, [{@private=0xa010102, 0x10000}, {@loopback}, {@local}, {@remote}]}]}}}}}}}, 0x0) 872.584637ms ago: executing program 2 (id=6821): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) recvmsg(r2, 0x0, 0x0) ioctl$BTRFS_IOC_SET_FEATURES(r1, 0x40309439, &(0x7f0000000080)={0x0, 0x3}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4, 0x70bd29, 0x25dfdbfe, {0x60, 0x0, 0x0, r3, {0x0, 0xfff2}, {0xffff, 0xffff}, {0x4, 0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x1d4}, 0x8840) 871.616749ms ago: executing program 1 (id=6822): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000001600)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf200000000000002600020007ffffffbd0310000000000095002000000000006916000000000000bf6700000000000004070000b964b01a4607feff00200000540700000ee61e00bf150000000000000f5700000000000065070000d23700002c030000000000001f75000000000000bf54000000000000070000000400f9ffad430100000000007c000000000000000500000000000000950000000000000032ed3c5be95e5db67754bb12dc8c4ed68ecf264e0f84f9f17d3c30e3c7bdd2d17f2f175455000078af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd390700000500000000f18c30907d7bee45a0100000fe9de56c9d05000000c6c60bef0d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cac3f1d5af65727546e7c955ccefa1f6ab689ffffff7f63ede202fa4e0a2127b8b83c71a51445dc8dfd13ff15f852a39e5b2ab7bcb8f512036a5ba6d04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916fcecc8158f0200000000c8fb735fd552bdc268694aeb0743e326c819b6cf5c8ac86f8a297dff0445a13d0045fb3cda30a673a6037ed8c85f21ec2c081bdce431e56723888fb126a19bc1172b84b3ebe174aba210d739a018f9bbec63222d20cecac4d03723f1c921b5bbf7949632cacfdd32b3a6aa57f1ad2e99e0e67a993716dbf580469f0f53acbb400001e3738270b315d362ed834f2af97787f696649a462e7e090000000000000045eac1f2014f720e83b7838e3eede14308d582685e1becd6f35154bcb4000000000000000000000000000000bc3af2b170ad3e2b26539cebca8f4ddc211bc3ccf0bd9d42ca019dd5d022cf74686e9fbe2562979eaed840a7afaab43176e65ec1118d46d1e827f3472f4445d353887a5ad103649afa1769080584f800031e03a651bb04000000ab04871bc47287cd31cc43ea0ffb567b4040c1458d0320ce7d0000413a0000000000000000005f37983f84e98a523d80bd56a57fa82b82f639601ae899a559944cb9a62a29ab028acfc1cb26a0f6a5480a55d624a0c544ba0dc828c22fe30000aa391598000000437d57fcf8295f63a70837f5cd4e5e77964522dc7ca3aa3476b7f2d851d27fd4de6eabb43e0799dc8d9fb7dc6c523ffbd74a6a40e4acb1ac872ade9d1f2ab779b8dbe843aeeda0426c767c00327b8c95b2bb6ddb55117669d9598c0f3598073f3a921c76beceff7e4fbf909a2cabf5b8ea5011db9020823b83abe54346c7af0a99fa077ffe7000feb9e44023a1749eb1d0d572b77d6e0d0fcd74031c8ef2629f5ecff4626746d6abe98a255e92c3c4f79bfcd0d91741380000cfeb73dec68ed56b5d3dfdf0cb8b71ad79000000000000000000000000000000dd434a25e95d0ec29d3adaccf89d0888031ecdfdb4dfbe444673be099ece7e4009c76c7108ef0a7e59fd6d906fbc3c9b412e0478cfee4485f423c63f49db43833c92eeeb647cebd4d7a93a17bcbb6bae5ff876375d4fe39cc2d292691672cc18ca372104ceb83a35ecedd97fc191d8f64d2b1d60c6d12911aada66c26aa4802c3514c3d92ec905000000b13f4a2575fbe943a6c40000000000000000000000000000028026b80c3899543223a6079ee96198b9a326db3be3a48af415ca28ca68c502550044ed8e29af8d763ef9b1f31befcad2ce5394601c7cdc233bff7f0000000000009fb3ad650f77e339768924dfdbeead13b88371154d743544a6091ec93e0d3fd5b4dc42911c1ba322fd4d6fbf19e617d51f964727bfd5cc5ba15370f6e1141d2271eded0b15e4316a1e4623272beb249a0928c417720be14c898f397411c88a7bcf3df46ab3efe7cd5e160c2afd3cc945f75011a102d952c7ad17a58d9be691c334ea35bae71e76e160cc2260bd028162917807ce89e11b5f261052ee0dde18efa1d802af2b7bcf6f8af41933cea0d0343261bccf64ca1c81045153eafbefdb91fbdff9ee3307d4a1837963b2dc2a3698d90e7915b098f19392e792adaea86052f4e948184001b6494e906925a092483adc7e9c8f7a29d226763c100aecae7f00619c36bceb9fb6dd7e55487d8485e498fdfc377fd3d266d21d46ab2f6b2ce22cd0aebba9b0ffbfe8ec3143c3734967c90b16ebbeeae1ce2baaae05aed6bf0f40c8a323f9235dc99698bd0b800067a901a79daada03cc77e74feb98b1586946b452764ff917a8ecc10e529c5bea49cad70e22df522c2803b6ef65df70223c6e22c3433e322d8dbd6e9b040065a9d6b3d5ae276cffe935d559bea88e1aa36b4e6c19e78457904297e77370e013b705a96548d47c609a93c45f4d1382b39c05dcc07d5b49ad75ddb3ce5b5b9416e03995da04647aa5e6fc1a6f5d663380967ccef9de49a90ced031335e3219ebd9d06c257a50497ec523f5ff7361261ccfe239d603364a42e2e81fc068fcbb9792b673827fe7018a988fbce55bb74cdb327ced4b77b8743fb3cb72cc280b9f62e4f92f46a19600b802cba88b7d0a938d9e0e6cfe5d66b874c9a0c6c04b96360d6f499d004179e5b6025c0e1050faec7ecd9de190a975db2f8c06a551236278c4766d7e22e3b85168c9851de6266c791252f919b4f8b257b5a786734e5142e4666c67aef5b7b2f88c6640995434aa8636993089c73f196c54ae829ad4307132655b075ae534fa7f1ea9a17e62357b0bd2bd1d62d34bfc1364640250136729ba4f763ff25c33e8acc806611792add8254e705fefd2a44d5b15e3b36f6b75c97c9c04c511d8cf9e24c61c8284a913a381cb1a5628878040000000000000017b68afd95d4abf7920de9ebe1c89661f4adc3d83d72b1b778e30c2bf2efbbcd054cf51f4205ebf9a98a0d9f18135cb1d8d567c3436fa697b72c3b0200000000000079c0b3339debc78352b2e65299223d7ef2bd540e78167b3ac92a4c4f826f6d0e5c4ebf4f7a70c03e2f5ddbebf168586360c3663531eb5995d228f011a10ffc8b17d716b0c528dab6d0c4fe2ee402348104bc5d4012babedee898c6d3e1017be2e9bc759d3ab4d615f5000000000000000000000000000000000000000000007fff0000000000e693e314adf7dc9f517d04f1e6ca367d30d31d3647c6059db6e1e9529eb1623ef99e2d9ac2ab4872f8e784b07a31110bef6d000000a6f9e89e6d50ee06ce716f94da60f1f22d9669560d296287c13c92070000ee7553eb2df17839542fa88d09f000e88a90cf4406b9000000000000000000000000f441d6a6f516c235c6f5863e7f454ee0e16b9aa2593eb31fa3836703e7765aaeb77a8770e518efaa6d3dd85e03b3b133eb749057cea9af75a0e6f633532f2891b8e263cb6eecea691842827bc7c8c0130187081c8d320642389f5f0c42dba0ff68e84d7b130906f17f6aa075a257310f2d92cb1d1e16468949f5675262ee318e735930b01d8f586e34537bcff7d6196f494cdcf3a712078d745db0f5687a78ee6d000b3d171a0f08299b52d207f32e9da311ca090000003a42732808515eec574f892622c5be497fc3d9ca122d7c18b9e54637812c8debc61f0e42d838e44a819b74bce1a56108bb0fde97a02475920532309c55b2c9ae9f281391ec5cc72a5e94cca1cbf1ff01000000000000bdb537a0c52bd45a9f966c25616cec30c3ea3246cb8e6aac7cf273638e6656a3e4ccadc348f0172028c99cc5f6d5c6d09ed65aa54549e73c28b7c8ad06ad3c5e3c27eec0eff1a6c84f1189919eefcee807fc081e004ffb7d3104af00ac92f1080211c4bee74381a0e31021918f27863fdbafb50f70857d52a1f7df51935a80b1980a4778d35f183ea517f55a98095305701ab3f3ae43f06e91bc7d85e3800b46926944fba9805a985e63e53a62232fcd3f01dbe1728f300e247a7ebe344f9749818ff3961b2a42664ccd680a90bbb6ab400e286acc8f9febef64594777f848ed1cf980a3da2f0f7745760a05887d0c28060d613dd6539d392fc21fee0b5131609664b821d7a994e6c5965a4fa1ec1790c54e54586907dcc5e8bac16e79da9c2444420900000000000000f888a94365b99b72796fca1b922fc9aefaf1546c17cbb1d2d2fd12cb1a49cad501a3ca218c595b667b634606c57987ebfb0783a4948e4561d5cda158fe74453ff4a837beeedba483842c57d6005b544b4f80003386edfd3d4a88a667bd41eefe0d808abed08a29e6bc370a80cc0366fb4080bfbaaa946fd47ab662c794846e403950bbc3a48bb276cbb08a8eab145c06221ef16a238e3d50ad18aea9a2cec97d3c2d0569caabe2bffe02506bc9cb7294c5d020536dd5e7a6351642112df3b55d0215aaec7e45598995e79699e47567e353e68b03f82be860b188554b734e1192f9c1a867b815ef52cdc3307c0cc9be05a40fde69c350e59f11f1d26a4d04d8c8b2c4a4d23ec931d14bc7807db773a614b670acf46f83f7c65a0f8d43c5f64705f0d27c46d4b686e867e9b0be76a7978a8f962bb5a070df97f2bf7612115cfe5ebdc7ad0bc5a5f3ace25347d0e5c347279d55aa67a967380000000000000000000000000000000000000000000000ed0942d980c754c6c69ef65c375ad018824f78b260d5f51bc3feba504408a8c8141d84f3f417603b5081680f346ff0ffbe4ae19e936511966965ce268b6345a0001c0f26a32e0a999fc869292e939dcf89b9bfd794f9c12d41959a00688cca43015a9eec58f647796adea520cd2abeb0b55c22949d10e5a05fee4543fdc1e02554a55b5fef2427a6e5708edc38fac53c2f961945a3f83cdf01979939b49bc6b1aef8c733401bbe473de8d64efbe0d123739f387d1c0d9e74f2175c174ada1678c7db79492e8dd0f34e2ccf419cf7f14ffa408b50a52685b36aed14aa22ad928191d5a2697646edc52a1c0c5d720ae690add2b34aed161f51cc1cb424f76098e1e1921e5a405f9d298a8461f2da30e47b7c6ed7c95c84c745f58723e4cddffae3b53b5b947f9435e589f9ae55b30ecd3827b2de5df31976870823da8058c2538c04e397f3d0ef90c11c74da984fa558697ecb57224ce8fa6f79aadbd7dbf3678e74d790bc2ee72769a3ada1dd504f8e4133ce1effd446bc9a2f139e65cc4bd83912af3122352506c7c2191b3705116b2f4fc20d4e93882bdd6ccea97f3a08d3565b0000000000000000000000000000d35fb97c2d7a9374294dcec3da3df9a13c4fc63b00426682534d894caee0b963a3"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) 803.429129ms ago: executing program 3 (id=6823): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x78bd28, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000600}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000440)=0x14) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r7, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000d80)=@ipv4_newaddr={0x28, 0x14, 0x509, 0x0, 0x0, {0x2, 0x1, 0x0, 0xfe, r8}, [@IFA_ADDRESS={0x8, 0x1, @multicast2}, @IFA_LOCAL={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x41}}]}, 0x28}}, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000480)=0x0, &(0x7f0000000b00)=0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000001c40)={'syztnl2\x00', &(0x7f0000001bc0)={'ip6gre0\x00', 0x0, 0x4, 0x8, 0x6, 0x7, 0x2, @local, @local, 0x8000, 0x700, 0x5, 0x8}}) sendmsg$ETHTOOL_MSG_DEBUG_GET(r5, &(0x7f0000001dc0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000001d80)={&(0x7f0000001c80)={0xf8, r1, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nicvf0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xf8}, 0x1, 0x0, 0x0, 0x4000885}, 0x20000011) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002000)=ANY=[@ANYBLOB="80000000", @ANYRESHEX=0x0, @ANYBLOB="050000000000000000000200000008000300", @ANYRESOCT=r2, @ANYBLOB="2d000e0080000000ffffffffffff08021100000008021100000000000000000000000000640000002503000000000000080026006c09", @ANYRESDEC=r0, @ANYRES64=r3], 0x80}}, 0x0) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r0, &(0x7f0000001e80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001e40)={&(0x7f0000001e00)={0x1c, r4, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @void}}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000040}, 0x40) sendmsg$NL80211_CMD_JOIN_MESH(r13, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000000780)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000580)={0x124, r4, 0x200, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x3429, 0x1a}}}}, [@NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x738}, @NL80211_ATTR_STA_VLAN={0x8, 0x14, r14}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x3}, @NL80211_ATTR_STA_FLAGS={0x24, 0x11, 0x0, 0x1, [@NL80211_STA_FLAG_ASSOCIATED={0x4}, @NL80211_STA_FLAG_WME={0x50}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_WME={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_AUTHORIZED={0x4}, @NL80211_STA_FLAG_TDLS_PEER={0x4}, @NL80211_STA_FLAG_SHORT_PREAMBLE]}, @NL80211_ATTR_STA_EXT_CAPABILITY={0xc0, 0xac, "e2853650001c5ca7e8d40e2abf0cde2d92477e7da1952f346635ec07b4b249834c62372f9ef1528a88c1f0635e0d0e11dbbf10337a117049bc528f6882f6437f8bacfb3729d26aa730dc034c7becc45c0478206563d85a134e4725e68159b7bbec4b6450abdba6f0bbe26a2852be9499a3661ccaf139df07a0d9efdd5076a7bcd2e4d2a447c6c56b586b0a217917bff8d58c1631f19db1d00c7c04a166ccb63e0d2779185084dff6a9089c29a7c30e9e88eb64fb60b1d20be137cfaa"}]}, 0x124}, 0x1, 0x0, 0x0, 0x804}, 0x4c010) 725.587782ms ago: executing program 0 (id=6824): sendmsg$netlink(0xffffffffffffffff, 0x0, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000080)={0x4, [0x0, 0x0, 0x0, 0x0]}) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000140)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[], 0x48}}, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000380)={0x1d, r5, 0x1, {0x0, 0x0, 0x1}, 0xfd}, 0x18) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000100)={'vxcan0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x44060}, 0x98) 724.641789ms ago: executing program 4 (id=6825): r0 = socket(0x10, 0x80002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, 0x0, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140011"], 0x48}}, 0x0) 688.746038ms ago: executing program 2 (id=6826): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x4b0, 0x370, 0x0, 0xffffffff, 0x370, 0x228, 0x440, 0x440, 0xffffffff, 0x440, 0x440, 0x5, 0x0, {[{{@ip={@rand_addr=0x64010104, @local, 0xff0000ff, 0xffffff00, 'veth1_to_bridge\x00', 'wg1\x00', {}, {0xff}, 0x16}, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'fsm\x00', "4801d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0xffffffff, 0x0, 0xff000000], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000, 0xffffffff], @ipv6=@local, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0x0, 0xff], 0x7, 0x1, 0x5c, 0x4e1c, 0x4e22, 0x4e24, 0x4e24, 0x814, 0x20c0}, 0x0, 0x2}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0xae, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xfffc, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x100}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'virt_wifi0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x0, 0x4}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @rand_addr=0x64010101, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @dev={0xac, 0x14, 0x14, 0x29}, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x510) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="7c0300004100010029bd700004000000030000000400478064030180600310805c0308"], 0x37c}, 0x1, 0x0, 0x20, 0x400c801}, 0x4008094) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x83, 0x0, &(0x7f0000000240)) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, 0x0, &(0x7f00000005c0)) 659.203727ms ago: executing program 4 (id=6827): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100050005000700000000000800090000003f0014002000ff250100100000000000e1ffe000000108000a0000000000060002"], 0x5c}, 0x1, 0x6c}, 0x0) 602.08769ms ago: executing program 1 (id=6828): r0 = socket$pptp(0x18, 0x1, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000002c0), 0xffffffffffffffff) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) recvmmsg(r3, &(0x7f0000005180), 0x400000000000166, 0x1a000, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff0000400001000000050007000000000008000900000000101400200000000000000000defffffeff0000000008000a000000000014001f0000000000000000000000000000000000060002000000000006001b004e20000005002100"], 0x6c}, 0x1, 0x620b}, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x6, 0x13, r0, 0x2f7e0000) 533.166077ms ago: executing program 2 (id=6829): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f5f626174616476001400350001657468315f6d6163767461700000001400350067726530000000000000000000000000140035006261746164765f736c6176655f31000008000f"], 0xe8}}, 0x0) close(r0) 532.569188ms ago: executing program 3 (id=6830): r0 = socket(0x2, 0x80805, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_DEFER_SETUP(r1, 0x112, 0x10, &(0x7f0000000040), 0x4) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) r3 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r3, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f070000000000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) (async) r5 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000000200)={r4, @in6={{0xa, 0x4e23, 0xef24, @local, 0xfffffbff}}, 0x1ff, 0x201}, &(0x7f0000000400)=0x90) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e23, 0x5, @remote, 0x1}}, 0x7, 0xfffa}, 0x90) 443.711363ms ago: executing program 4 (id=6831): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x14, 0x52, 0x1, 0x0, 0xefffffff, {0x1c}}, 0x14}}, 0x0) 201.929721ms ago: executing program 4 (id=6832): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r1, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e67}, {&(0x7f00000000c0)=""/250, 0x4}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=ANY=[@ANYBLOB="18000000", @ANYRES16=r0, @ANYBLOB="a787000000ff000000000b00000404000180"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r3, 0x1}, 0x14}}, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000000)={0x2, 0x0, 0x2, 0x724, 0x0}, &(0x7f00000001c0)=0x10) shutdown(r1, 0x1) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f00000002c0)={'team0\x00', {0x2, 0x4e22, @rand_addr=0x64010102}}) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000001680)={r4, 0x7, 0x1000, "9a0de4e7d5401d3dbda0fa25ee8f0b844d2d16872c74da1e48396d612c2f42809b53429c3c83a84edd9e2697422eb06d9b90374b493c0b41b43442a81c7a2a26b66f025e4b27b890cf882553faad4306224d15a6a0b76024a51183735f73e1a924a7616aa61c0de525cb8891191d72b982d4e8b30f914927b7d3720711211932cc8ac1255bdf1daf141dd17c8a91d613f5f1f4b7c2d0c8927a763770b857be21748d527f9f083051bfc8d7e4b22f31476a19f2199c0ccae5f03049af8e2196175df7d284c2e67b5b51b745b34a1d23a6c86d4e91c10c90c6ce5073f48d755f53e3451dec5ef891c33aeff714cf4c9d0c9e08ddd3bd7d085ea521506a8733677eeadb61ca9598db6e318bb33225789e3e57411219cc9912838a9ccd4cd0014f14f104ac533635613ff766e6cfb7a52377b28fcbc8fe201179487a8ddb5000e659baa2da66fc855a3682633866bc16c8b438b7a78fbbce7759b4701f062ee2aa260f4d48b55b97f7e435d896b7d4ca5b7ccc4e937d00ee16509080a60c06878f992883c70b7b48313c506be6c5f5f8a37634eb2c5f13a889c2346acc10062e6f1b892383cc8078344c081f06f863542203260364f254f92930bf850a3cb6b832fb06f34f28e2cfa673252a2fe7b48b4fb5e3fe0f44aae5c09ccfd9ec2f892b569a2f13ee2571694a76b942cc1940f6d45e919ff2b953779c4fd4577668d71776c558eafa111af3d320274a7aef797eebcbd4aa11c74a0000d55b3ea3f31a892f54938d3c16dc3ca2609c929ce5424441bb7d3fd5c5bd25db375dc2f1a80fd292b1bfd3f8bc24f272e0937fc798ca8302448ac96ec42814dd70862228f14e5bcc63c21d9e7ccfd80c34f9ae960e963966f85426d5742a36b5401ea33ac3e7164af7cf0febcf00a83df4eeb618e83ab6f52b2a60cf11478689e57092140340201f5ae5374a7887cb39594b5abdc6be493492689fca2383e09cd95d8c93666b45fe47ab876e0b0e62df4ffb481723592971b4d0eea65eba2cf65e4698324108cdbd1c40a4236b24c895d4baa05576c05f3e4b8b24cbb1f53afcc5edf1b28570ff1749ebe31e92c183c85b18ab3b2897095fe1df4a03961de5d9c45171f90911109648c3a62fd3aec55b518da1f2ed103e30f8c1e21efe236c0271b10f872a5ba29724019a2c34be4ee8152655d6c1f4acdf30b99ca7b63a2c511702e4ea4fcc3201ec20eb94045d03820ffb3a544e6aed9924a5d5366b16e25b96d0c7fb670fe54e58fd00790caa8b75aca60472f1690a8dfd879ad8eaf01122856e7c9169e92110afcd05c6cb97a2bd0c48a9f8d11908d557118cc60547fe25edca6a61eba8697044e0b15525ba7bc5d2b1f4446730c7c1ca963f046efa25b26fcfa2541dabe9c39a3897fa21a7eb6846ca2d5e2839ac43f2076c033613ae8bc93e86b15ca4307bc86f0ef04b29298705e4f3e916da92033d4d50d6728cebb488e123e8f2e1ca0465d42e73e666c458feee8058ad9560c57947d3ebdab86e612a2b79d17c1967d8600bb00790676de3bcb37d29c720300028c3f3547fab5b9ebc6d9cbdaed96b72371ab4aec1aa0e4d79617dd363cdb7fed69731b3de045dd8de4e9e2d6ed89a412db2e1eb13a7b942f7296dad3eab50a1cc97d2c6363185c2d36f98ac81c3fbbc4dd08057fcdd62f2b60536155ceceb659a793cc9eee07412432e709a472ce66c9874b00996dd53331f9c6178f8250f62c46ab6257f5c6fbbe376ecb72b7d7bbf91da820f0516381aa026e88b8ed4a015edfa07a842a830d1d8d8de319e485807292952e48b024d07d624fc4c70a6d9c3e4673931742bc603e4927859545bd8d9aec5bb5ce5d56b3ab0d0f947411c537fd5537b8d2d125c229f9721c2617b527c061e6b3e0fa34d431ccb81ef92dc57b36384d661fdcb6432d0ad650399c73879ec0ce286150374b7b667a8c555b8384c51821e4bcba683d29eea5b86e4736400c17dc60461a460af667f408c3eac0992030fd0df0e80aa2af307b09709e04275a266c30684851a9be9284559a12ea22c75e9773692282e7af59af085e18fedd886850d4027f262830d7d83bf0534c60b116dab1b207839ea04e798c888dd74685fc4e4c2cf0bd11c62e8e8dd20350b78462cb26cff1739be891db85174b0e44fe2f3c1d340e4653d1981d1b04ba71eb018b6f0572b89283ad24186e8f5d9161ea395bc5feceff199b5d9d6e08a1c1ca370eec929560b87db0a522517f22bdfedb76c4e9c34197aa3ecccf549fb0ebf45847222a252bd2e1781a27ddd94c25720237174228b27526917c4967bdd2bca75c73de3541201b8fc98da509ba61fbc9d2180f604b190ff82c11f43091b4539de479468a1bdcf068bdbdf50bda6a585699eb31761477b6366de713078b739e16a3896bb43b2df24d70886e6f4330ca0da462a9739e0a175a7dc726d5353998dc36fb738eb4584cb40d1acabf2979f76f3bdf258bfc3d9bb31137295d673d87f40ff328a1bf355cea48bfb946aa11cf15849c683ae49620aefc4bf32143d60167ec81fbdb0b3b4f6a96b8a1c18dd3213b625c9bf86357fbd47d734ba7e0e053cda8959bb3cbc5cabd50fa191015e05dbad7ef2fdce408f252801f2deb4eb9240cde8bf15904565ea537bcbfd93925415e86fd657ada49fc5053c7eefed836e853b875da3e94d512a37fb901debd6b605783a8299c82a7d3b68cd922191b7f99f92f19c0e23170eb29e19e2e1a5846ec23ffcb2d377440b1222565ccfe299fd59e8ed7515142cabae33134374ca3fefb3ce771a1cd0472696db3eb14b3bac6b59f25c657663e06474149237f952c7b7994e4036bc9990a53431c01239e99fa03179038ed2663f6d03ae39c4099eb7b64e22a7c3380fa00ef1b7cdd155359843486742c0fc16d778dcff8ab44514a32b389c04d660e4a216380427ee4a214ca33d2423d0e5dfff6e69c22e6ffd425c826d9b9f6d1b8b478d780dbdf77eb237697e21d9305efde5794daf45b9445264cfe223c0aa925674aba204d54c7b493bb0042e9e5f2e8337ccda9846c266e4c79a8c29d144bc90d83feadf10d270a807f35a756704abf0d4b15946bbf2a913bd97e756ff3f39423d91b19f6a0e2cdcb343b447b21e542535722294c4d43a63a5f01e7c5a6297a03c7f15c5f7aabf51f60a657a0b5a6f2fd200232fb58e4df25b69087a73526a28f3dfe63533d54015970195e0e3a9d87a6996310f1011d0df8f2409cf2d1aef19e2a2d3e11f6a3dc1d8982187b86207eaeec5e5f93db3c58842391e8f92dafaddb74d1fb872f70798ad31eea8543cc2a6696d570ab1d2e1e1c0c297fb177b90a8b9baa07c34c445711bdbc36dcd2a880fe016320308516220ce29c2c7e85ddfa85ff069116e78ce82b27a4eab437e5b460a6b540e8ff165587b4e6629f75ee66302f414b1cc004074ea037416838c8178ec8314f981a1d3ceaee3a1d86764d3ec7ffada5a3999a694a5fe65d01615cf7ea827e42d6b68a2be31c92b231e0acbf9c5fa775e12b4c1bed22b2ca6d9fd4be5f266b6115515959608fb82a0fca42399ad0e68f0c1d62004ecfafbfa1681768136a67d0018147bc48459419292b6201c857bb8876bdff369dde80cf744422f1cc590d6e72594347db18b6698a2d5334f1085a024ab89ef72f39b2c7bf4083edb422b61b1f06b4acf5046802fdf10d6524c9d9e171deabc8082f23c9b89e9e2cf16bc68d9413e62fc2769fd6a300639291ed2ce00d55d87fb6317910588e573b6203ceff3c5b38c72adeb165281a362fe5c436f7cfdd912b2fcb8738afadc3ee5d16cb74321c9439cf7579f14839f17c9066591d1f100540a382c057b08c662b966cca920147dec0b648821257ba86b44294a2bb97ae6b1de6e35f7ca834c8d02c69f93be20799988585f54fdeb968e2324dc46c7e3c6bd9d8a6271e9a5a895f74b065423e36aeade9cd351fa3950c4b313e846e80e45f12e0838a0f4b0e7dc568ea7107d5ca643995afb656659dbe36b9bda56cd91e5e62a87170671f21104054f33b456b3f87b4adbfc159fcd5e3131ba296195873081e1d1e62663d8b78b40e87dadaf28edca4ca48bc16ab57903c472ea9e88437e003b9548f0b6cd38f027ee03cc0bb49ae6c93582a623df82c32b043ff562ebcd4c3aa39c936b8f4349cb6bb44e204edebad37593b48a058a85f79f72e8ec07673a5e77bac46c3e0baef8df39689a2353202234fbf4edd9e76ec2a9cfde1898e2ff9f85b23365a4d6ef76af7e58baabdf3f2d2dd55fef2969af90f7da515fbe61ed838ccd75d7896c0f7aa738d6c869b7946c812b3bd94e789515f225608ebd89ff90dc01a4670f09ce6cdbf715b151b10322f7345cbefe7ce0a251060622311d6415c486a23e64a4c1d5d252ecace3277bee260ab7031615abb113b824762dd4fd6745d7f62c2144df67d838297aa902f5053b1378b91af9d310bba105198f1c56a835b18306ade596c85548d1c41c78fbb1c6fce0928b008801ad8f277795a30cd96461fd9a2c1d5e055666f1e6cd359d9c8023cb737b659695690acb6b0b0b5e3cc5b12f3e74e85a9bb4084b2a2b6a6462c87524f5727735cccaad393df8aa4f8439c5007cd24d9e8efe98c3a3cc2554ad8a9c04b50806d44cb91ffa5594be923ce6a05f5acb684f81fcaf1e722901fde4da2be1f876a13516df380ac8c8bdc2cd9886a7439fb031fbe19c45740ba9956318fe271f107b4df8b607b19098038f7258effedf0b8c7ea741e4c4279ccaa6bc7419848dd5f2c8e5b21919d072a1c5065198f45cacac0df7b768dc07e117b29a3b96d1307ce5f8f2501e2138bf9b31fd3edb0729a1f64f62b8cc1e61bfd2b5b1a39a17dce2905131a3ac1663a903a383c8cd6ed3a49006d83562e6da7011ede8d67a01caf95d4f182eb8fb79164f166e82a787a42a07a57e1216baf458d65802c8871be4b877adcc8553918fa92ba5f9aab92bf12e639f24d096b9edd8de738406dfe8e0ff9578a2cef4fbae71185ff8491e0793f952d24000074049344e9107d09a2b65e45160eff3e59b25da6460759e9e971f042599154f48d32e1ce8e0f6c88d74802b0e72dbcbc0b4de570b481a154b63cbf6fff1fd760fc25d70d730bd47b8de2848ba1d7681934483888a4d328aeaf10ef9e46d701e89e18287070d46328c7242d541c1ff1d18f69991e1a78f9be0fde1394b51d4ea65cf72e9c3be29319a9a06a58298a169beef507e23e87a3845d97c81a36623838f58f98b25f1ca8d80d185e850411a9159d913af6e7933bfcca7220fd9c527515732a57b0c545181fa61a19dfe17611f182f4911af7e8db44b8dc9ca4e4002155718ae07a4dc6cf68b4cb7f2b6654cb3f70d4e91e5b8d8e5037a15fe5d9bcf09c0dac8e30eb4e01c159183f98fe83c4bcc734c55928b57b9ffd9a04e3fec15f73f10c6903ec629ebc3930a9739f263c28986cbd86b6c19bbc90947cdca9d71748f638103acb9d3b71a006cd2ca4cab1c7165561b0214165da712aa90973c1a25a0066d85866e285d6be268af2ffa4ca92951a94049d4a6cdd9d012f3073da39c628d02432644bf8ec2000d5c874308db9cf66776793517183079a5922429da852ee68b1a25e05d93bcd3ae6f4a88183c9d5fca9b512c436281dd7d31f648f9836d61ba2a6108b4c990fc230808cc1545738ff240ad09922d89240298ed60cf2d3e79ef1cc6602227cb2870591b7fe3ae2cbac2b1aa28a539645ef147f98f9aaf99d27e5f7fcd8e52e7cd7473"}, 0x1008) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000000c0)) 201.483475ms ago: executing program 3 (id=6833): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000001800)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[], 0x12f4}, 0x1, 0x0, 0x0, 0x4044010}, 0x0) recvmsg$unix(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000240)=""/54, 0x36}], 0x1}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa080045000028"], 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x4361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r6 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r6, &(0x7f0000000240)="800000800000210ee7decd7a000340008100", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 200.328946ms ago: executing program 1 (id=6834): socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x80002, 0x0) (async) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0900000081000000030000000500000016010000", @ANYRES32, @ANYBLOB="ffffffff"], 0x48) (async) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r5, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, 0x80ad}, 0x1c) (async) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) (async) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x33, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x1}]}, 0x10) (async) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x4e20, 0x4000b, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x12}}, 0x80ad}, 0x1c) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd7000fedbf12511000000060028000300000008000300", @ANYRES32=r4, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x2000c810}, 0x80) pipe(0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @link_local}, 0x14) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r8 = socket$kcm(0x11, 0x200000000000003, 0x300) (async) r9 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x30, 0x1411, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x13}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000800) setsockopt$sock_attach_bpf(r8, 0x107, 0xf, &(0x7f00000003c0), 0x4) (async) recvmsg$kcm(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0), 0x60}, 0x0) (async) sendto$inet6(r0, &(0x7f0000000280)="02043c00ec074802010e0200c52cf7c20675e005b02f0800eb2b2ff0dac8897c6b112002faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r10, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x44, 0x0, 0x8, 0x401, 0x0, 0x0, {0x3, 0x0, 0x6}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8884}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_GRE_REPLIED={0x8, 0x2, 0x1, 0x0, 0x800}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x2f}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x40000) 186.03637ms ago: executing program 2 (id=6835): ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, &(0x7f0000000040)={0x3, 0x80000001, 0x4, 0x7fffffff, 0x7a99, 0x5}) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_int(r0, 0x0, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r2, 0x29, 0xc8, 0x0, 0xc000000) setsockopt$MRT6_ADD_MFC_PROXY(r2, 0x29, 0xd2, &(0x7f0000000300)={{0xa, 0x0, 0x4000000, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0xffffffffffffffff, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x5c) 93.459403ms ago: executing program 0 (id=6836): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x5800, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}]}}]}, 0x8c}}, 0x0) 58.470987ms ago: executing program 2 (id=6837): socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x400000000000004) socket$xdp(0x2c, 0x3, 0x0) socket$tipc(0x1e, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000300000000000000c29c18120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{r1}, &(0x7f0000000280), &(0x7f0000000500)=r3}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xe, 0x0, &(0x7f0000000000)="43227504001100b32415f73227b2", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x50) syz_extract_tcp_res$synack(0x0, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000001100010000ff0f000000000007000000", @ANYRES32=r8, @ANYBLOB="80010000091004000c001a800800058004000480"], 0x2c}}, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b980), r0) sendmsg$NL80211_CMD_SET_COALESCE(r10, &(0x7f000000ba40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f000000ba00)={&(0x7f000000b9c0)={0x28, r11, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8, 0x24}}}}, [@NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0xc000}, 0x4004) ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000080)={{0x2, 0x4e20, @rand_addr=0x64010102}, {0x0, @random="fa486edc6f6a"}, 0x0, {0x2, 0x4e20, @remote}, 'xfrm0\x00'}) ioctl$BTRFS_IOC_SPACE_INFO(r6, 0xc0109414, &(0x7f00000001c0)={0x7a6, 0x800, ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) r12 = socket$netlink(0x10, 0x3, 0x14) getsockopt$IP_VS_SO_GET_DESTS(r12, 0x0, 0x484, &(0x7f0000000040)=""/31, &(0x7f0000000100)=0x1f) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 0s ago: executing program 0 (id=6838): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000700), r0) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000a40)=""/137, 0x89}, {&(0x7f0000000940)=""/207, 0xcf}, {&(0x7f00000004c0)=""/155, 0x9b}, {&(0x7f0000000840)=""/206, 0xce}, {&(0x7f0000000bc0)=""/4036, 0xfc4}, {&(0x7f0000000180)=""/111, 0x6f}, {&(0x7f0000000340)=""/147, 0x93}], 0x7, 0x0, 0xffa1}, 0x401}], 0x1, 0x40000180, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180"], 0x18}}, 0x0) kernel console output (not intermixed with test programs): 1442][T23757] syzkaller1: group set to 0 [ 674.480950][T23758] xt_TCPMSS: Only works on TCP SYN packets [ 674.570016][T23767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5505'. [ 675.433868][T23802] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5517'. [ 675.471844][T23804] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5518'. [ 675.722059][T23817] bond0: entered promiscuous mode [ 675.734659][T23817] bond_slave_0: entered promiscuous mode [ 675.753275][T23817] bond_slave_1: entered promiscuous mode [ 675.773378][T23817] bond0: left promiscuous mode [ 675.778839][T23817] bond_slave_0: left promiscuous mode [ 675.789449][T23817] bond_slave_1: left promiscuous mode [ 676.230870][T23838] netlink: 'syz.4.5528': attribute type 11 has an invalid length. [ 676.491504][T23850] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5533'. [ 676.611884][T23859] FAULT_INJECTION: forcing a failure. [ 676.611884][T23859] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 676.665577][T23859] CPU: 0 UID: 0 PID: 23859 Comm: syz.2.5536 Not tainted syzkaller #0 PREEMPT(full) [ 676.665606][T23859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 676.665619][T23859] Call Trace: [ 676.665627][T23859] [ 676.665637][T23859] dump_stack_lvl+0xe8/0x150 [ 676.665672][T23859] should_fail_ex+0x40c/0x560 [ 676.665704][T23859] _copy_to_user+0x31/0xb0 [ 676.665729][T23859] simple_read_from_buffer+0xe1/0x170 [ 676.665756][T23859] proc_fail_nth_read+0x1bb/0x230 [ 676.665780][T23859] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 676.665805][T23859] ? rw_verify_area+0x24a/0x4c0 [ 676.665830][T23859] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 676.665850][T23859] vfs_read+0x213/0xa80 [ 676.665879][T23859] ? __pfx___mutex_lock+0x10/0x10 [ 676.665900][T23859] ? __pfx_vfs_read+0x10/0x10 [ 676.665923][T23859] ? __fget_files+0x2a/0x420 [ 676.665947][T23859] ? __fget_files+0x3a2/0x420 [ 676.665965][T23859] ? __fget_files+0x2a/0x420 [ 676.665992][T23859] ksys_read+0x150/0x270 [ 676.666017][T23859] ? __pfx_ksys_read+0x10/0x10 [ 676.666048][T23859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.666070][T23859] do_syscall_64+0x174/0x580 [ 676.666088][T23859] ? trace_irq_disable+0x3b/0x140 [ 676.666109][T23859] ? clear_bhb_loop+0x40/0x90 [ 676.666134][T23859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 676.666152][T23859] RIP: 0033:0x7f120ff5e68e [ 676.666171][T23859] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 676.666186][T23859] RSP: 002b:00007f1210ec6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 676.666207][T23859] RAX: ffffffffffffffda RBX: 00007f1210ec76c0 RCX: 00007f120ff5e68e [ 676.666220][T23859] RDX: 000000000000000f RSI: 00007f1210ec70a0 RDI: 0000000000000004 [ 676.666231][T23859] RBP: 00007f1210ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 676.666243][T23859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 676.666254][T23859] R13: 00007f1210226038 R14: 00007f1210225fa0 R15: 00007ffdd3fec688 [ 676.666290][T23859] [ 677.041484][T23861] netlink: 'syz.1.5539': attribute type 9 has an invalid length. [ 677.077389][T23871] workqueue: name exceeds WQ_NAME_LEN. Truncating to: 1Y#­¦ūĖŒ [ 677.077389][T23871] d]WŹ”+NC”m­÷Y<ƒ­9Åź [ 677.297655][T23881] net_ratelimit: 21 callbacks suppressed [ 677.297691][T23881] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 677.373725][T23886] sock: sock_timestamping_bind_phc: sock not bind to device [ 677.396786][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 677.541879][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 677.686749][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 677.817737][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 677.841407][T23914] netlink: 'syz.3.5553': attribute type 11 has an invalid length. [ 678.109266][T23926] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 678.188085][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 678.202941][T23932] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 678.305365][T23938] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5561'. [ 678.317222][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 678.447700][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 678.711273][T23971] netlink: 'syz.3.5570': attribute type 3 has an invalid length. [ 678.832736][T23970] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5569'. [ 679.550245][T24015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5582'. [ 679.592366][T24020] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5580'. [ 679.628372][T24020] netlink: 'syz.4.5580': attribute type 1 has an invalid length. [ 679.665382][T24020] netlink: 224 bytes leftover after parsing attributes in process `syz.4.5580'. [ 679.718671][T24020] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5580'. [ 679.958133][T24036] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 680.395673][T24058] netlink: 'syz.4.5596': attribute type 11 has an invalid length. [ 681.227398][T24107] netlink: 'syz.4.5608': attribute type 11 has an invalid length. [ 681.243564][T24108] netlink: 'syz.3.5607': attribute type 12 has an invalid length. [ 681.413342][T24115] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5610'. [ 681.961715][T24150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5617'. [ 682.512733][T24117] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 682.547508][T24117] veth3: left allmulticast mode [ 682.561356][T24117] gretap2: left promiscuous mode [ 682.567082][T24117] gretap2: left allmulticast mode [ 682.612256][T24117] bond4: left promiscuous mode [ 682.625155][T24117] macvtap1: left allmulticast mode [ 682.637019][T24117] macvtap2: left allmulticast mode [ 682.644520][T24117] bond5: left promiscuous mode [ 682.654060][T24117] macvtap3: left allmulticast mode [ 682.660024][T24117] macvtap4: left allmulticast mode [ 682.666314][T24117] bond6: left promiscuous mode [ 682.677268][T24117] macvtap5: left allmulticast mode [ 682.687417][T24117] macvtap6: left allmulticast mode [ 682.693181][T24117] bridge0: left allmulticast mode [ 682.700742][T24117] bond7: left promiscuous mode [ 682.707628][T24117] macvtap7: left allmulticast mode [ 682.713222][T24117] macvtap8: left allmulticast mode [ 682.719990][T24117] bond9: left promiscuous mode [ 682.727366][T24117] macvtap9: left allmulticast mode [ 682.736993][T24117] macvtap10: left allmulticast mode [ 682.746032][T24117] ip6tnl2: left allmulticast mode [ 682.906978][T24117] veth7: left allmulticast mode [ 682.932237][T24117] bridge5: left promiscuous mode [ 682.937285][T24117] bridge5: left allmulticast mode [ 682.986687][T15940] lo speed is unknown, defaulting to 1000 [ 682.995740][T15940] syś2: Port: 1 Link DOWN [ 683.039465][T17868] net_ratelimit: 24 callbacks suppressed [ 683.039492][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 683.267383][T24182] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5621'. [ 683.311898][T24182] netlink: 'syz.1.5621': attribute type 11 has an invalid length. [ 683.420951][ T14] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.430063][ T14] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.439923][ T14] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.448979][ T14] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.464196][ T14] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.473346][ T14] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.485849][ T14] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 683.502137][ T14] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.558829][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 683.687103][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 683.771208][T24203] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5626'. [ 683.791961][T24205] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5628'. [ 683.818371][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 683.927592][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.047898][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.114747][T24222] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5631'. [ 684.166916][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.276645][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.389065][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.404168][T24236] netlink: 'syz.3.5635': attribute type 11 has an invalid length. [ 684.588085][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 684.596334][T24247] FAULT_INJECTION: forcing a failure. [ 684.596334][T24247] name failslab, interval 1, probability 0, space 0, times 0 [ 684.619222][T24249] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5641'. [ 684.653951][T24247] CPU: 0 UID: 0 PID: 24247 Comm: syz.3.5640 Not tainted syzkaller #0 PREEMPT(full) [ 684.653980][T24247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 684.653993][T24247] Call Trace: [ 684.654002][T24247] [ 684.654011][T24247] dump_stack_lvl+0xe8/0x150 [ 684.654043][T24247] should_fail_ex+0x40c/0x560 [ 684.654076][T24247] should_failslab+0xa8/0x100 [ 684.654100][T24247] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 684.654128][T24247] ? local_lock_release+0x9c/0x160 [ 684.654158][T24247] ? __alloc_skb+0x1d7/0x7a0 [ 684.654174][T24247] ? __alloc_skb+0x1d7/0x7a0 [ 684.654197][T24247] __alloc_skb+0x1d7/0x7a0 [ 684.654219][T24247] netlink_sendmsg+0x5d4/0xb40 [ 684.654251][T24247] ? __pfx_netlink_sendmsg+0x10/0x10 [ 684.654278][T24247] ? aa_sock_msg_perm+0xf1/0x1b0 [ 684.654307][T24247] ? __pfx_netlink_sendmsg+0x10/0x10 [ 684.654327][T24247] sock_sendmsg_nosec+0x13a/0x180 [ 684.654356][T24247] ____sys_sendmsg+0x54e/0x850 [ 684.654381][T24247] ? __pfx_____sys_sendmsg+0x10/0x10 [ 684.654417][T24247] ? import_iovec+0x73/0xa0 [ 684.654440][T24247] ___sys_sendmsg+0x2a5/0x360 [ 684.654460][T24247] ? __lock_acquire+0x683/0x2cf0 [ 684.654484][T24247] ? __pfx____sys_sendmsg+0x10/0x10 [ 684.654538][T24247] ? __fget_files+0x2a/0x420 [ 684.654557][T24247] ? __fget_files+0x3a2/0x420 [ 684.654586][T24247] __x64_sys_sendmsg+0x1b1/0x290 [ 684.654616][T24247] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 684.654655][T24247] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.654676][T24247] do_syscall_64+0x174/0x580 [ 684.654696][T24247] ? trace_irq_disable+0x3b/0x140 [ 684.654715][T24247] ? clear_bhb_loop+0x40/0x90 [ 684.654740][T24247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 684.654760][T24247] RIP: 0033:0x7fcc20d9de59 [ 684.654778][T24247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 684.654795][T24247] RSP: 002b:00007fcc21d0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 684.654817][T24247] RAX: ffffffffffffffda RBX: 00007fcc21025fa0 RCX: 00007fcc20d9de59 [ 684.654831][T24247] RDX: 0000000000000004 RSI: 00002000000001c0 RDI: 0000000000000004 [ 684.654844][T24247] RBP: 00007fcc21d0b090 R08: 0000000000000000 R09: 0000000000000000 [ 684.654857][T24247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 684.654868][T24247] R13: 00007fcc21026038 R14: 00007fcc21025fa0 R15: 00007ffffedcff78 [ 684.654898][T24247] [ 685.040903][T24268] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5642'. [ 685.253880][T24278] netlink: 'syz.2.5650': attribute type 11 has an invalid length. [ 685.281963][T24271] netlink: 56 bytes leftover after parsing attributes in process `syz.1.5646'. [ 685.315220][T24271] tipc: Enabling of bearer rejected, failed to enable media [ 685.356719][T24280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 685.378317][T24283] netlink: 'syz.4.5651': attribute type 1 has an invalid length. [ 685.419293][T24283] netlink: 'syz.4.5651': attribute type 2 has an invalid length. [ 685.513356][T24295] FAULT_INJECTION: forcing a failure. [ 685.513356][T24295] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 685.532529][T24295] CPU: 0 UID: 0 PID: 24295 Comm: syz.2.5654 Not tainted syzkaller #0 PREEMPT(full) [ 685.532556][T24295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 685.532567][T24295] Call Trace: [ 685.532575][T24295] [ 685.532584][T24295] dump_stack_lvl+0xe8/0x150 [ 685.532613][T24295] should_fail_ex+0x40c/0x560 [ 685.532646][T24295] _copy_from_iter+0x1d3/0x1660 [ 685.532672][T24295] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 685.532700][T24295] ? rcu_is_watching+0x15/0xb0 [ 685.532723][T24295] ? trace_kmem_cache_alloc+0x29/0xe0 [ 685.532751][T24295] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 685.532778][T24295] ? __pfx__copy_from_iter+0x10/0x10 [ 685.532805][T24295] ? __alloc_skb+0x276/0x7a0 [ 685.532823][T24295] ? __alloc_skb+0x276/0x7a0 [ 685.532846][T24295] ? netlink_sendmsg+0x650/0xb40 [ 685.532867][T24295] ? skb_put+0x112/0x210 [ 685.532887][T24295] netlink_sendmsg+0x6c0/0xb40 [ 685.532919][T24295] ? __pfx_netlink_sendmsg+0x10/0x10 [ 685.532945][T24295] ? aa_sock_msg_perm+0xf1/0x1b0 [ 685.532971][T24295] ? __pfx_netlink_sendmsg+0x10/0x10 [ 685.532991][T24295] sock_sendmsg_nosec+0x13a/0x180 [ 685.533017][T24295] ____sys_sendmsg+0x54e/0x850 [ 685.533042][T24295] ? __pfx_____sys_sendmsg+0x10/0x10 [ 685.533070][T24295] ? import_iovec+0x73/0xa0 [ 685.533094][T24295] ___sys_sendmsg+0x2a5/0x360 [ 685.533114][T24295] ? __lock_acquire+0x683/0x2cf0 [ 685.533139][T24295] ? __pfx____sys_sendmsg+0x10/0x10 [ 685.533195][T24295] ? __fget_files+0x2a/0x420 [ 685.533213][T24295] ? __fget_files+0x3a2/0x420 [ 685.533242][T24295] __x64_sys_sendmsg+0x1b1/0x290 [ 685.533266][T24295] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 685.533304][T24295] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.533325][T24295] do_syscall_64+0x174/0x580 [ 685.533343][T24295] ? trace_irq_disable+0x3b/0x140 [ 685.533362][T24295] ? clear_bhb_loop+0x40/0x90 [ 685.533386][T24295] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 685.533405][T24295] RIP: 0033:0x7f120ff9de59 [ 685.533423][T24295] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 685.533440][T24295] RSP: 002b:00007f1210ec7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 685.533461][T24295] RAX: ffffffffffffffda RBX: 00007f1210225fa0 RCX: 00007f120ff9de59 [ 685.533483][T24295] RDX: 0000000000000004 RSI: 00002000000001c0 RDI: 0000000000000004 [ 685.533496][T24295] RBP: 00007f1210ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 685.533508][T24295] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 685.533520][T24295] R13: 00007f1210226038 R14: 00007f1210225fa0 R15: 00007ffdd3fec688 [ 685.533552][T24295] [ 685.824816][T24300] veth1_to_bond: entered allmulticast mode [ 685.852557][T24300] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5657'. [ 685.885728][T24300] veth1_to_bond (unregistering): left allmulticast mode [ 685.948418][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.967218][T24307] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 686.319097][T24335] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5667'. [ 686.438799][T24340] bond0: entered promiscuous mode [ 686.447540][T24340] bond_slave_0: entered promiscuous mode [ 686.465252][T24340] bond_slave_1: entered promiscuous mode [ 686.491415][T24340] bond0: left promiscuous mode [ 686.499215][T24340] bond_slave_0: left promiscuous mode [ 686.504874][T24340] bond_slave_1: left promiscuous mode [ 686.608614][T24357] netlink: 'syz.3.5676': attribute type 1 has an invalid length. [ 686.622455][T24359] netdevsim netdevsim3: Direct firmware load for  failed with error -2 [ 686.631457][T24359] netdevsim netdevsim3: Falling back to sysfs fallback for:  [ 686.666633][T24357] 8021q: adding VLAN 0 to HW filter on device bond15 [ 686.739624][T24364] virt_wifi0 speed is unknown, defaulting to 1000 [ 686.748630][T24364] lo speed is unknown, defaulting to 1000 [ 687.109830][T24382] netlink: 'syz.4.5683': attribute type 1 has an invalid length. [ 687.493170][T24391] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5686'. [ 687.523718][T24393] netlink: 'syz.4.5689': attribute type 1 has an invalid length. [ 687.613126][T24396] netlink: 'syz.0.5688': attribute type 1 has an invalid length. [ 687.697692][T24396] 8021q: adding VLAN 0 to HW filter on device bond10 [ 687.721555][T24403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5691'. [ 687.846741][T24396] bond2: (slave veth0_to_bond): Releasing active interface [ 687.936258][T24396] bond10: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 688.115888][T24413] macvlan4: entered promiscuous mode [ 688.121246][T24413] macvlan4: entered allmulticast mode [ 688.136301][T24413] bond10: entered promiscuous mode [ 688.141612][T24413] veth0_to_bond: entered promiscuous mode [ 688.148627][T24413] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 688.166948][T24413] bond10: left promiscuous mode [ 688.178970][T24413] veth0_to_bond: left promiscuous mode [ 688.274188][T24431] vlan1: entered promiscuous mode [ 688.279820][T24431] hsr0: entered promiscuous mode [ 688.285339][T24431] vlan1: entered allmulticast mode [ 688.293646][T24431] hsr0: entered allmulticast mode [ 688.315896][T24431] hsr_slave_0: entered allmulticast mode [ 688.323512][T24431] hsr_slave_1: entered allmulticast mode [ 688.364111][ T6721] net_ratelimit: 14 callbacks suppressed [ 688.364137][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 688.503733][T24430] syzkaller0: entered promiscuous mode [ 688.509586][T24430] syzkaller0: entered allmulticast mode [ 688.541827][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 688.658608][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 688.767036][T24445] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 688.786615][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 688.851508][T24455] __nla_validate_parse: 1 callbacks suppressed [ 688.851529][T24455] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5710'. [ 689.169998][T24459] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5711'. [ 692.176033][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 692.308014][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 692.362940][T24500] netlink: 'syz.0.5724': attribute type 61 has an invalid length. [ 692.364888][T24497] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5722'. [ 692.426680][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 692.478791][T24506] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5727'. [ 692.502867][T24506] erspan0: left promiscuous mode [ 692.529393][T24506] 8021q: adding VLAN 0 to HW filter on device team0 [ 692.617824][T24506] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 692.631357][T24506] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 692.644169][T24506] veth1_vlan: left promiscuous mode [ 692.651156][T24506] veth0_vlan: left promiscuous mode [ 692.657561][T24506] veth0_vlan: entered promiscuous mode [ 692.664677][T24506] veth1_vlan: entered promiscuous mode [ 692.676329][T24506] veth0_macvtap: left promiscuous mode [ 692.685176][T24506] veth0_macvtap: entered promiscuous mode [ 692.698795][T24506] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 692.707501][T24506] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 692.715780][T24506] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 692.742451][T24506] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 692.750644][T24506] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 692.769437][T24520] xt_hashlimit: size too large, truncated to 1048576 [ 692.771664][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 692.783725][T15940] lo speed is unknown, defaulting to 1000 [ 692.792886][T15940] syś2: Port: 1 Link ACTIVE [ 692.823523][T24498] bond15: (slave erspan0): Device is not bonding slave [ 692.830646][T24498] bond15: option active_slave: invalid value (erspan0) [ 692.844630][T24498] bond15 (unregistering): Released all slaves [ 692.870044][T24523] netlink: 'syz.3.5726': attribute type 49 has an invalid length. [ 692.941189][T24525] netlink: 192 bytes leftover after parsing attributes in process `syz.0.5730'. [ 692.972467][ T133] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 692.977825][T24525] netlink: 'syz.0.5730': attribute type 11 has an invalid length. [ 692.981306][ T133] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.046403][ T133] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.075976][T17868] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.166395][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 693.385456][T24546] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5735'. [ 693.451181][T24546] gtp1: entered promiscuous mode [ 693.491017][T24546] gtp1: entered allmulticast mode [ 693.536712][ T133] net_ratelimit: 1 callbacks suppressed [ 693.536733][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 693.641145][T24556] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5737'. [ 693.657283][T17961] block nbd3: Receive control failed (result -32) [ 693.683142][T24559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5738'. [ 693.833267][T24565] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5740'. [ 693.912857][T24544] syzkaller0: entered promiscuous mode [ 693.930660][T24544] syzkaller0: entered allmulticast mode [ 693.978430][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 694.002057][T24569] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 694.038921][T24571] netlink: 'syz.2.5743': attribute type 64 has an invalid length. [ 694.070660][T24571] netlink: 5 bytes leftover after parsing attributes in process `syz.2.5743'. [ 694.083827][T24573] syzkaller0: entered promiscuous mode [ 694.090868][T24573] syzkaller0: entered allmulticast mode [ 694.201969][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 694.329793][T24584] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5749'. [ 694.365722][T24587] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5750'. [ 697.237321][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 697.493896][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 697.650788][T24629] netlink: 288 bytes leftover after parsing attributes in process `syz.3.5764'. [ 697.680902][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 697.702147][T24632] netlink: 9 bytes leftover after parsing attributes in process `syz.2.5763'. [ 697.750365][T24632] 0·: renamed from hsr0 [ 697.786915][T24632] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 697.828782][T24632] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 697.839841][T24632] 0·: entered allmulticast mode [ 697.844793][T24632] hsr_slave_0: entered allmulticast mode [ 697.850519][T24632] hsr_slave_1: entered allmulticast mode [ 697.857589][T24632] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 698.011390][T24652] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5770'. [ 698.012065][T24647] syzkaller0: entered promiscuous mode [ 698.026111][T24647] syzkaller0: entered allmulticast mode [ 698.059561][T24652] netlink: 'syz.0.5770': attribute type 49 has an invalid length. [ 698.070064][T24652] netlink: 'syz.0.5770': attribute type 39 has an invalid length. [ 698.084043][T24652] hsr_slave_0: left promiscuous mode [ 698.091074][T24652] hsr_slave_1: left promiscuous mode [ 698.206877][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 698.320842][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 698.556702][ T14] net_ratelimit: 1 callbacks suppressed [ 698.556722][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 698.671871][T24675] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5780'. [ 702.419730][T24684] bond0: (slave wireguard0): refused to change device type [ 702.468663][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 702.498004][T24689] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5784'. [ 702.577384][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 702.807004][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 702.926698][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 703.046893][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 703.076109][T24724] FAULT_INJECTION: forcing a failure. [ 703.076109][T24724] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 703.089203][T24724] CPU: 1 UID: 0 PID: 24724 Comm: syz.3.5797 Not tainted syzkaller #0 PREEMPT(full) [ 703.089231][T24724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 703.089242][T24724] Call Trace: [ 703.089250][T24724] [ 703.089257][T24724] dump_stack_lvl+0xe8/0x150 [ 703.089287][T24724] should_fail_ex+0x40c/0x560 [ 703.089316][T24724] _copy_from_user+0x2d/0xb0 [ 703.089335][T24724] __sys_bpf+0x2e7/0xd90 [ 703.089361][T24724] ? __pfx___sys_bpf+0x10/0x10 [ 703.089385][T24724] ? __fget_files+0x2a/0x420 [ 703.089416][T24724] ? ksys_write+0x242/0x270 [ 703.089437][T24724] ? __pfx_ksys_write+0x10/0x10 [ 703.089458][T24724] __x64_sys_bpf+0xba/0xd0 [ 703.089494][T24724] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.089512][T24724] do_syscall_64+0x174/0x580 [ 703.089531][T24724] ? trace_irq_disable+0x3b/0x140 [ 703.089546][T24724] ? clear_bhb_loop+0x40/0x90 [ 703.089565][T24724] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.089580][T24724] RIP: 0033:0x7fcc20d9de59 [ 703.089597][T24724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 703.089612][T24724] RSP: 002b:00007fcc21d0b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 703.089631][T24724] RAX: ffffffffffffffda RBX: 00007fcc21025fa0 RCX: 00007fcc20d9de59 [ 703.089643][T24724] RDX: 0000000000000090 RSI: 00002000000004c0 RDI: 0000000000000005 [ 703.089654][T24724] RBP: 00007fcc21d0b090 R08: 0000000000000000 R09: 0000000000000000 [ 703.089664][T24724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 703.089675][T24724] R13: 00007fcc21026038 R14: 00007fcc21025fa0 R15: 00007ffffedcff78 [ 703.089702][T24724] [ 703.095668][T24725] netlink: 260 bytes leftover after parsing attributes in process `syz.0.5796'. [ 703.156747][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 703.415789][T24729] syzkaller0: entered promiscuous mode [ 703.421330][T24729] syzkaller0: entered allmulticast mode [ 703.460749][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 703.549358][T24745] openvswitch: netlink: Message has 12 unknown bytes. [ 703.556308][T24745] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 703.614745][T24751] block nbd4: not configured, cannot reconfigure [ 703.626723][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 703.746675][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 704.237802][T24786] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 707.576798][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 707.696354][T24802] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 707.706335][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 707.793707][T24811] FAULT_INJECTION: forcing a failure. [ 707.793707][T24811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 707.816629][T24811] CPU: 0 UID: 0 PID: 24811 Comm: syz.4.5822 Not tainted syzkaller #0 PREEMPT(full) [ 707.816657][T24811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 707.816668][T24811] Call Trace: [ 707.816677][T24811] [ 707.816686][T24811] dump_stack_lvl+0xe8/0x150 [ 707.816718][T24811] should_fail_ex+0x40c/0x560 [ 707.816751][T24811] _copy_to_user+0x31/0xb0 [ 707.816775][T24811] simple_read_from_buffer+0xe1/0x170 [ 707.816799][T24811] proc_fail_nth_read+0x1bb/0x230 [ 707.816824][T24811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 707.816848][T24811] ? rw_verify_area+0x24a/0x4c0 [ 707.816874][T24811] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 707.816893][T24811] vfs_read+0x213/0xa80 [ 707.816920][T24811] ? __pfx___mutex_lock+0x10/0x10 [ 707.816947][T24811] ? __pfx_vfs_read+0x10/0x10 [ 707.816972][T24811] ? __fget_files+0x2a/0x420 [ 707.816996][T24811] ? __fget_files+0x3a2/0x420 [ 707.817013][T24811] ? __fget_files+0x2a/0x420 [ 707.817039][T24811] ksys_read+0x150/0x270 [ 707.817065][T24811] ? __pfx_ksys_read+0x10/0x10 [ 707.817095][T24811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.817118][T24811] do_syscall_64+0x174/0x580 [ 707.817136][T24811] ? trace_irq_disable+0x3b/0x140 [ 707.817156][T24811] ? clear_bhb_loop+0x40/0x90 [ 707.817182][T24811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.817202][T24811] RIP: 0033:0x7f8d2535e68e [ 707.817220][T24811] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 707.817238][T24811] RSP: 002b:00007f8d26351fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 707.817259][T24811] RAX: ffffffffffffffda RBX: 00007f8d263526c0 RCX: 00007f8d2535e68e [ 707.817273][T24811] RDX: 000000000000000f RSI: 00007f8d263520a0 RDI: 0000000000000004 [ 707.817285][T24811] RBP: 00007f8d26352090 R08: 0000000000000000 R09: 0000000000000000 [ 707.817298][T24811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 707.817310][T24811] R13: 00007f8d25626038 R14: 00007f8d25625fa0 R15: 00007ffc8800a018 [ 707.817385][T24811] [ 708.043011][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 708.201417][T24821] tipc: Enabled bearer , priority 0 [ 708.209502][T24821] syzkaller0: entered promiscuous mode [ 708.215012][T24821] syzkaller0: entered allmulticast mode [ 708.224670][T24821] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 708.287607][T24821] tipc: Resetting bearer [ 708.305680][T24820] tipc: Resetting bearer [ 708.340538][T24820] tipc: Disabling bearer [ 708.353575][T24826] FAULT_INJECTION: forcing a failure. [ 708.353575][T24826] name failslab, interval 1, probability 0, space 0, times 0 [ 708.366807][T24826] CPU: 1 UID: 0 PID: 24826 Comm: syz.4.5825 Not tainted syzkaller #0 PREEMPT(full) [ 708.366834][T24826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 708.366845][T24826] Call Trace: [ 708.366854][T24826] [ 708.366863][T24826] dump_stack_lvl+0xe8/0x150 [ 708.366892][T24826] should_fail_ex+0x40c/0x560 [ 708.366921][T24826] should_failslab+0xa8/0x100 [ 708.366950][T24826] __kmalloc_noprof+0xfe/0x720 [ 708.366975][T24826] ? rcu_is_watching+0x15/0xb0 [ 708.366998][T24826] ? tomoyo_realpath_from_path+0xef/0x640 [ 708.367149][T24826] ? tomoyo_realpath_from_path+0xef/0x640 [ 708.367176][T24826] tomoyo_realpath_from_path+0xef/0x640 [ 708.367186][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 708.367208][T24826] ? tomoyo_path_number_perm+0x219/0x5f0 [ 708.367228][T24826] tomoyo_path_number_perm+0x246/0x5f0 [ 708.367247][T24826] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 708.367267][T24826] ? __lock_acquire+0x683/0x2cf0 [ 708.367303][T24826] ? hook_file_ioctl+0x1f0/0x5f0 [ 708.367345][T24826] ? __fget_files+0x2a/0x420 [ 708.367366][T24826] ? __fget_files+0x2a/0x420 [ 708.367383][T24826] ? __fget_files+0x3a2/0x420 [ 708.367400][T24826] ? __fget_files+0x2a/0x420 [ 708.367423][T24826] security_file_ioctl+0xc3/0x2a0 [ 708.367445][T24826] __se_sys_ioctl+0x47/0x170 [ 708.367469][T24826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.367491][T24826] do_syscall_64+0x174/0x580 [ 708.367510][T24826] ? trace_irq_disable+0x3b/0x140 [ 708.367529][T24826] ? clear_bhb_loop+0x40/0x90 [ 708.367553][T24826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 708.367572][T24826] RIP: 0033:0x7f8d2539de59 [ 708.367605][T24826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 708.367621][T24826] RSP: 002b:00007f8d26331028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 708.367642][T24826] RAX: ffffffffffffffda RBX: 00007f8d25626090 RCX: 00007f8d2539de59 [ 708.367658][T24826] RDX: 0000200000002280 RSI: 0000000000008914 RDI: 0000000000000004 [ 708.367670][T24826] RBP: 00007f8d26331090 R08: 0000000000000000 R09: 0000000000000000 [ 708.367690][T24826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 708.367702][T24826] R13: 00007f8d25626128 R14: 00007f8d25626090 R15: 00007ffc8800a018 [ 708.367762][T24826] [ 708.367992][T24826] ERROR: Out of memory at tomoyo_realpath_from_path. [ 708.383851][T24828] netlink: 'syz.1.5828': attribute type 1 has an invalid length. [ 708.387427][T24826] syzkaller0: entered promiscuous mode [ 708.649547][T24826] syzkaller0: entered allmulticast mode [ 708.670698][T24832] syzkaller0: entered promiscuous mode [ 708.688812][T24832] syzkaller0: entered allmulticast mode [ 708.716137][ T133] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 708.735340][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 708.744711][ T133] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 708.761226][T24836] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 708.856673][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 708.874320][T24843] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5831'. [ 708.895933][T24840] netlink: zone id is out of range [ 708.901556][T24840] netlink: zone id is out of range [ 708.907169][T24840] netlink: zone id is out of range [ 708.912485][T24840] netlink: zone id is out of range [ 708.917920][T24840] netlink: zone id is out of range [ 708.923107][T24840] netlink: zone id is out of range [ 708.929480][T24840] netlink: zone id is out of range [ 708.934891][T24840] netlink: zone id is out of range [ 708.973627][T24845] netlink: 'syz.1.5832': attribute type 3 has an invalid length. [ 708.982306][T24845] netlink: 'syz.1.5832': attribute type 1 has an invalid length. [ 709.003716][T24845] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5832'. [ 709.498626][T24876] ’’’’’’: renamed from vlan1 (while UP) [ 709.548497][T24882] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5841'. [ 709.801266][T24897] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5851'. [ 709.862646][T24895] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5848'. [ 710.699565][T24922] xt_hashlimit: size too large, truncated to 1048576 [ 710.800328][T24927] netlink: 'syz.2.5860': attribute type 25 has an invalid length. [ 710.983537][T24938] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5865'. [ 711.474758][T24956] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 711.485343][T24957] FAULT_INJECTION: forcing a failure. [ 711.485343][T24957] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 711.504871][T24956] syzkaller1: Linktype set failed because interface is up [ 711.516172][T24957] CPU: 1 UID: 0 PID: 24957 Comm: syz.1.5871 Not tainted syzkaller #0 PREEMPT(full) [ 711.516207][T24957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 711.516219][T24957] Call Trace: [ 711.516228][T24957] [ 711.516237][T24957] dump_stack_lvl+0xe8/0x150 [ 711.516271][T24957] should_fail_ex+0x40c/0x560 [ 711.516304][T24957] _copy_from_user+0x2d/0xb0 [ 711.516328][T24957] ___sys_sendmsg+0x1c6/0x360 [ 711.516354][T24957] ? __lock_acquire+0x683/0x2cf0 [ 711.516380][T24957] ? __pfx____sys_sendmsg+0x10/0x10 [ 711.516436][T24957] ? __fget_files+0x2a/0x420 [ 711.516454][T24957] ? __fget_files+0x3a2/0x420 [ 711.516478][T24957] __x64_sys_sendmsg+0x1b1/0x290 [ 711.516499][T24957] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 711.516533][T24957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.516553][T24957] do_syscall_64+0x174/0x580 [ 711.516573][T24957] ? clear_bhb_loop+0x40/0x90 [ 711.516597][T24957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.516614][T24957] RIP: 0033:0x7fb9d6d9de59 [ 711.516633][T24957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 711.516651][T24957] RSP: 002b:00007fb9d7ba6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 711.516673][T24957] RAX: ffffffffffffffda RBX: 00007fb9d7025fa0 RCX: 00007fb9d6d9de59 [ 711.516687][T24957] RDX: 0000000000040090 RSI: 0000200000000540 RDI: 000000000000001a [ 711.516699][T24957] RBP: 00007fb9d7ba6090 R08: 0000000000000000 R09: 0000000000000000 [ 711.516711][T24957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 711.516723][T24957] R13: 00007fb9d7026038 R14: 00007fb9d7025fa0 R15: 00007ffe0db714f8 [ 711.516759][T24957] [ 711.702888][T24956] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 711.761699][T24962] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5875'. [ 711.778748][T24962] macsec2: entered promiscuous mode [ 711.784033][T24962] bridge0: entered promiscuous mode [ 711.789534][T24962] macsec2: entered allmulticast mode [ 711.794854][T24962] bridge0: entered allmulticast mode [ 711.818371][T24962] bridge0: port 3(macsec2) entered blocking state [ 711.825403][T24962] bridge0: port 3(macsec2) entered disabled state [ 711.846718][T24962] bridge0: left allmulticast mode [ 711.858635][T24156] bridge0: left promiscuous mode [ 712.006990][T24972] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5880'. [ 712.322032][T24979] netlink: 18 bytes leftover after parsing attributes in process `syz.0.5882'. [ 712.453453][T24979] 8021q: adding VLAN 0 to HW filter on device bond11 [ 712.467180][T24979] bond0: (slave bond11): Enslaving as an active interface with a down link [ 712.582813][T24998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5889'. [ 712.604563][T24995] syzkaller0: entered promiscuous mode [ 712.616692][T24995] syzkaller0: entered allmulticast mode [ 712.931116][T25010] netlink: 'syz.2.5896': attribute type 12 has an invalid length. [ 713.002021][T25011] syzkaller0: entered promiscuous mode [ 713.012482][T25011] syzkaller0: entered allmulticast mode [ 716.172988][ T5785] net_ratelimit: 57 callbacks suppressed [ 716.173068][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 716.302583][T25048] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5904'. [ 716.330740][T25049] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5903'. [ 716.330740][T25046] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5903'. [ 716.430244][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 716.495417][T25053] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5906'. [ 716.625154][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 716.746802][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 716.801691][T25076] openvswitch: netlink: Message has 12 unknown bytes. [ 716.808582][T25076] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 716.873154][T25078] virt_wifi0 speed is unknown, defaulting to 1000 [ 716.876655][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 716.908514][T25078] lo speed is unknown, defaulting to 1000 [ 716.995716][T25087] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5920'. [ 716.996618][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 717.178299][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 717.306646][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 717.683559][T25122] netlink: 'syz.3.5929': attribute type 4 has an invalid length. [ 717.831835][T25127] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5930'. [ 717.951837][T25134] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5928'. [ 717.977745][T25133] netlink: 196 bytes leftover after parsing attributes in process `syz.0.5930'. [ 717.987438][T25133] netlink: 196 bytes leftover after parsing attributes in process `syz.0.5930'. [ 717.998549][T25133] netlink: 19 bytes leftover after parsing attributes in process `syz.0.5930'. [ 718.194942][T25149] bond0: entered promiscuous mode [ 718.200029][T25149] bond_slave_0: entered promiscuous mode [ 718.205908][T25149] bond_slave_1: entered promiscuous mode [ 718.217676][T25149] bond0: left promiscuous mode [ 718.222616][T25149] bond_slave_0: left promiscuous mode [ 718.246056][T25149] bond_slave_1: left promiscuous mode [ 718.371290][T25156] xt_HMARK: proto mask must be zero with L3 mode [ 719.790355][T25209] sctp: [Deprecated]: syz.1.5958 (pid 25209) Use of struct sctp_assoc_value in delayed_ack socket option. [ 719.790355][T25209] Use struct sctp_sack_info instead [ 720.281802][T25215] geneve0: left promiscuous mode [ 720.521657][ T14] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.546978][ T14] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 720.577386][ T14] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.634434][ T14] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 720.662100][ T14] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.680351][T25238] FAULT_INJECTION: forcing a failure. [ 720.680351][T25238] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 720.702841][ T14] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 720.712836][T25238] CPU: 0 UID: 0 PID: 25238 Comm: syz.0.5965 Not tainted syzkaller #0 PREEMPT(full) [ 720.712862][T25238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 720.712875][T25238] Call Trace: [ 720.712883][T25238] [ 720.712892][T25238] dump_stack_lvl+0xe8/0x150 [ 720.712925][T25238] should_fail_ex+0x40c/0x560 [ 720.712959][T25238] _copy_from_user+0x2d/0xb0 [ 720.712983][T25238] ___sys_sendmsg+0x1c6/0x360 [ 720.713007][T25238] ? __lock_acquire+0x683/0x2cf0 [ 720.713033][T25238] ? __pfx____sys_sendmsg+0x10/0x10 [ 720.713088][T25238] ? __fget_files+0x2a/0x420 [ 720.713107][T25238] ? __fget_files+0x3a2/0x420 [ 720.713136][T25238] __x64_sys_sendmsg+0x1b1/0x290 [ 720.713160][T25238] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 720.713200][T25238] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.713222][T25238] do_syscall_64+0x174/0x580 [ 720.713252][T25238] ? trace_irq_disable+0x3b/0x140 [ 720.713271][T25238] ? clear_bhb_loop+0x40/0x90 [ 720.713295][T25238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 720.713315][T25238] RIP: 0033:0x7f00f3f9de59 [ 720.713333][T25238] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 720.713351][T25238] RSP: 002b:00007f00f4f08028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 720.713372][T25238] RAX: ffffffffffffffda RBX: 00007f00f4225fa0 RCX: 00007f00f3f9de59 [ 720.713386][T25238] RDX: 0000000000040084 RSI: 0000200000000200 RDI: 0000000000000003 [ 720.713399][T25238] RBP: 00007f00f4f08090 R08: 0000000000000000 R09: 0000000000000000 [ 720.713411][T25238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 720.713422][T25238] R13: 00007f00f4226038 R14: 00007f00f4225fa0 R15: 00007fff5f03ec88 [ 720.713453][T25238] [ 720.713925][ T14] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 720.913257][T25240] netlink: 'syz.4.5964': attribute type 1 has an invalid length. [ 720.937029][ T14] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 721.151578][ T6721] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 721.159762][ T6721] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 721.297940][T25265] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 722.500729][ T57] net_ratelimit: 15 callbacks suppressed [ 722.500756][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 722.636869][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 722.846760][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 722.979600][T25286] syzkaller0: entered promiscuous mode [ 722.985302][T25286] syzkaller0: entered allmulticast mode [ 723.521822][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 723.634963][T25306] __nla_validate_parse: 10 callbacks suppressed [ 723.634985][T25306] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5988'. [ 723.698502][T25306] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5988'. [ 723.711061][T25306] nbd: must specify at least one socket [ 723.726634][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 723.736319][T25308] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20002 [ 723.808281][T25306] xt_TCPMSS: Only works on TCP SYN packets [ 723.856663][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 723.929660][T25321] FAULT_INJECTION: forcing a failure. [ 723.929660][T25321] name failslab, interval 1, probability 0, space 0, times 0 [ 723.952360][T25321] CPU: 1 UID: 0 PID: 25321 Comm: syz.2.5993 Not tainted syzkaller #0 PREEMPT(full) [ 723.952386][T25321] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 723.952397][T25321] Call Trace: [ 723.952404][T25321] [ 723.952413][T25321] dump_stack_lvl+0xe8/0x150 [ 723.952441][T25321] should_fail_ex+0x40c/0x560 [ 723.952472][T25321] should_failslab+0xa8/0x100 [ 723.952494][T25321] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 723.952521][T25321] ? local_lock_release+0x9c/0x160 [ 723.952552][T25321] ? __alloc_skb+0x1d7/0x7a0 [ 723.952567][T25321] ? __alloc_skb+0x1d7/0x7a0 [ 723.952590][T25321] __alloc_skb+0x1d7/0x7a0 [ 723.952611][T25321] netlink_ack+0x136/0xb30 [ 723.952647][T25321] netlink_rcv_skb+0x2a4/0x4a0 [ 723.952669][T25321] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 723.952691][T25321] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 723.952723][T25321] ? bpf_lsm_capable+0x9/0x20 [ 723.952743][T25321] ? security_capable+0x7e/0x2c0 [ 723.952773][T25321] nfnetlink_rcv+0x2b9/0x28c0 [ 723.952792][T25321] ? kernel_text_address+0xa5/0xe0 [ 723.952817][T25321] ? __kernel_text_address+0xd/0x30 [ 723.952838][T25321] ? unwind_get_return_address+0x4d/0x90 [ 723.952864][T25321] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 723.952894][T25321] ? arch_stack_walk+0xfb/0x150 [ 723.952932][T25321] ? stack_trace_save+0xa9/0x100 [ 723.952970][T25321] ? __lock_acquire+0x683/0x2cf0 [ 723.952990][T25321] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 723.953012][T25321] ? kasan_save_track+0x4f/0x80 [ 723.953029][T25321] ? kasan_save_track+0x3e/0x80 [ 723.953044][T25321] ? __kasan_slab_alloc+0x6c/0x80 [ 723.953062][T25321] ? kmem_cache_alloc_node_noprof+0x355/0x610 [ 723.953086][T25321] ? __alloc_skb+0x276/0x7a0 [ 723.953101][T25321] ? netlink_sendmsg+0x5d4/0xb40 [ 723.953120][T25321] ? sock_sendmsg_nosec+0x13a/0x180 [ 723.953142][T25321] ? ____sys_sendmsg+0x54e/0x850 [ 723.953164][T25321] ? __lock_acquire+0x683/0x2cf0 [ 723.953194][T25321] ? __netlink_lookup+0xc6/0x8b0 [ 723.953225][T25321] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.953246][T25321] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.953271][T25321] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.953290][T25321] ? netlink_deliver_tap+0x2e/0x1b0 [ 723.953314][T25321] netlink_unicast+0x7bb/0x940 [ 723.953343][T25321] netlink_sendmsg+0x813/0xb40 [ 723.953372][T25321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.953397][T25321] ? aa_sock_msg_perm+0xf1/0x1b0 [ 723.953423][T25321] ? __pfx_netlink_sendmsg+0x10/0x10 [ 723.953442][T25321] sock_sendmsg_nosec+0x13a/0x180 [ 723.953469][T25321] ____sys_sendmsg+0x54e/0x850 [ 723.953493][T25321] ? __pfx_____sys_sendmsg+0x10/0x10 [ 723.953521][T25321] ? import_iovec+0x73/0xa0 [ 723.953543][T25321] ___sys_sendmsg+0x2a5/0x360 [ 723.953563][T25321] ? __lock_acquire+0x683/0x2cf0 [ 723.953585][T25321] ? __pfx____sys_sendmsg+0x10/0x10 [ 723.953634][T25321] ? __fget_files+0x2a/0x420 [ 723.953651][T25321] ? __fget_files+0x3a2/0x420 [ 723.953676][T25321] __x64_sys_sendmsg+0x1b1/0x290 [ 723.953698][T25321] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 723.953734][T25321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.953754][T25321] do_syscall_64+0x174/0x580 [ 723.953771][T25321] ? trace_irq_disable+0x3b/0x140 [ 723.953788][T25321] ? clear_bhb_loop+0x40/0x90 [ 723.953810][T25321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 723.953830][T25321] RIP: 0033:0x7f120ff9de59 [ 723.953849][T25321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 723.953865][T25321] RSP: 002b:00007f1210ec7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 723.953886][T25321] RAX: ffffffffffffffda RBX: 00007f1210225fa0 RCX: 00007f120ff9de59 [ 723.953900][T25321] RDX: 0000000000000090 RSI: 00002000000002c0 RDI: 0000000000000003 [ 723.953913][T25321] RBP: 00007f1210ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 723.953925][T25321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 723.953945][T25321] R13: 00007f1210226038 R14: 00007f1210225fa0 R15: 00007ffdd3fec688 [ 723.953975][T25321] [ 723.986753][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 724.399686][T25337] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 724.450182][ T14] wlan0: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 724.531580][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 724.598460][T25346] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6004'. [ 724.602227][T25342] Cannot find del_set index 4 as target [ 724.652209][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 724.762360][T25357] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6008'. [ 724.854876][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 724.950716][T25369] netlink: 'syz.0.6011': attribute type 1 has an invalid length. [ 725.100262][T25381] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6017'. [ 725.139023][T25383] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6018'. [ 725.351117][T25390] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6019'. [ 725.389064][T25390] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6019'. [ 725.432767][T17868] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.446267][T17868] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.459444][T17868] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 725.470664][T17868] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.105115][T25424] FAULT_INJECTION: forcing a failure. [ 726.105115][T25424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 726.119767][T25424] CPU: 0 UID: 0 PID: 25424 Comm: syz.1.6030 Not tainted syzkaller #0 PREEMPT(full) [ 726.119795][T25424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 726.119808][T25424] Call Trace: [ 726.119816][T25424] [ 726.119824][T25424] dump_stack_lvl+0xe8/0x150 [ 726.119856][T25424] should_fail_ex+0x40c/0x560 [ 726.119887][T25424] _copy_from_user+0x2d/0xb0 [ 726.119910][T25424] ___sys_sendmsg+0x1c6/0x360 [ 726.119932][T25424] ? __lock_acquire+0x683/0x2cf0 [ 726.119958][T25424] ? __pfx____sys_sendmsg+0x10/0x10 [ 726.120012][T25424] ? __fget_files+0x2a/0x420 [ 726.120031][T25424] ? __fget_files+0x3a2/0x420 [ 726.120059][T25424] __x64_sys_sendmsg+0x1b1/0x290 [ 726.120083][T25424] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 726.120121][T25424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.120143][T25424] do_syscall_64+0x174/0x580 [ 726.120162][T25424] ? trace_irq_disable+0x3b/0x140 [ 726.120181][T25424] ? clear_bhb_loop+0x40/0x90 [ 726.120212][T25424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.120232][T25424] RIP: 0033:0x7fb9d6d9de59 [ 726.120255][T25424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 726.120273][T25424] RSP: 002b:00007fb9d7ba6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 726.120294][T25424] RAX: ffffffffffffffda RBX: 00007fb9d7025fa0 RCX: 00007fb9d6d9de59 [ 726.120309][T25424] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 726.120325][T25424] RBP: 00007fb9d7ba6090 R08: 0000000000000000 R09: 0000000000000000 [ 726.120337][T25424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.120349][T25424] R13: 00007fb9d7026038 R14: 00007fb9d7025fa0 R15: 00007ffe0db714f8 [ 726.120388][T25424] [ 726.326838][T25427] netlink: 199784 bytes leftover after parsing attributes in process `syz.2.6032'. [ 726.338216][T25427] netlink: 'syz.2.6032': attribute type 1 has an invalid length. [ 726.547305][T25438] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6036'. [ 726.800768][T25453] FAULT_INJECTION: forcing a failure. [ 726.800768][T25453] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 726.826051][T25455] netlink: 'syz.3.6042': attribute type 10 has an invalid length. [ 726.846127][T25453] CPU: 0 UID: 0 PID: 25453 Comm: syz.0.6041 Not tainted syzkaller #0 PREEMPT(full) [ 726.846159][T25453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 726.846172][T25453] Call Trace: [ 726.846182][T25453] [ 726.846193][T25453] dump_stack_lvl+0xe8/0x150 [ 726.846226][T25453] should_fail_ex+0x40c/0x560 [ 726.846261][T25453] _copy_to_user+0x31/0xb0 [ 726.846287][T25453] simple_read_from_buffer+0xe1/0x170 [ 726.846313][T25453] proc_fail_nth_read+0x1bb/0x230 [ 726.846338][T25453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.846360][T25453] ? rw_verify_area+0x24a/0x4c0 [ 726.846380][T25453] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 726.846399][T25453] vfs_read+0x213/0xa80 [ 726.846429][T25453] ? __pfx___mutex_lock+0x10/0x10 [ 726.846454][T25453] ? __pfx_vfs_read+0x10/0x10 [ 726.846479][T25453] ? __fget_files+0x2a/0x420 [ 726.846502][T25453] ? __fget_files+0x3a2/0x420 [ 726.846521][T25453] ? __fget_files+0x2a/0x420 [ 726.846548][T25453] ksys_read+0x150/0x270 [ 726.846574][T25453] ? __pfx_ksys_read+0x10/0x10 [ 726.846605][T25453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.846628][T25453] do_syscall_64+0x174/0x580 [ 726.846647][T25453] ? trace_irq_disable+0x3b/0x140 [ 726.846668][T25453] ? clear_bhb_loop+0x40/0x90 [ 726.846691][T25453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.846711][T25453] RIP: 0033:0x7f00f3f5e68e [ 726.846730][T25453] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 726.846747][T25453] RSP: 002b:00007f00f4f07fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 726.846769][T25453] RAX: ffffffffffffffda RBX: 00007f00f4f086c0 RCX: 00007f00f3f5e68e [ 726.846784][T25453] RDX: 000000000000000f RSI: 00007f00f4f080a0 RDI: 0000000000000004 [ 726.846797][T25453] RBP: 00007f00f4f08090 R08: 0000000000000000 R09: 0000000000000000 [ 726.846809][T25453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 726.846821][T25453] R13: 00007f00f4226038 R14: 00007f00f4225fa0 R15: 00007fff5f03ec88 [ 726.846855][T25453] [ 727.016617][T25455] netlink: 'syz.3.6042': attribute type 10 has an invalid length. [ 727.080840][T25460] netlink: 'syz.4.6044': attribute type 1 has an invalid length. [ 727.309942][T25460] bond9: (slave gretap3): making interface the new active one [ 727.345873][T25460] bond9: (slave gretap3): Enslaving as an active interface with an up link [ 727.448799][T25485] debugfs: '1łą^!' already exists in 'ieee80211' [ 727.558410][ T14] net_ratelimit: 15 callbacks suppressed [ 727.558432][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 727.578364][T25492] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 727.635320][T25501] openvswitch: netlink: Actions may not be safe on all matching packets [ 727.775671][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 727.802530][T25512] netlink: 'syz.2.6059': attribute type 22 has an invalid length. [ 727.812076][T25512] netlink: 'syz.2.6059': attribute type 22 has an invalid length. [ 727.836558][T25514] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 727.997809][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 728.185527][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 728.307699][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 728.570126][T25538] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.582898][T25538] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.601741][T25538] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 728.642502][T25547] netlink: 'syz.2.6073': attribute type 10 has an invalid length. [ 728.760669][T25547] netlink: 'syz.2.6073': attribute type 11 has an invalid length. [ 728.769733][T25547] netlink: 'syz.2.6073': attribute type 11 has an invalid length. [ 728.779341][T25547] __nla_validate_parse: 18 callbacks suppressed [ 728.779359][T25547] netlink: 228 bytes leftover after parsing attributes in process `syz.2.6073'. [ 728.904506][T25538] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.933931][T25538] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.956964][T25538] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 729.057244][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 729.145563][T25568] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6079'. [ 729.272813][T25571] netlink: 542 bytes leftover after parsing attributes in process `syz.4.6078'. [ 729.309154][T25538] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 729.326906][T25538] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 729.354704][T25538] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 729.402171][T25580] netlink: 'syz.4.6078': attribute type 2 has an invalid length. [ 729.433861][T25574] C: renamed from lo (while UP) [ 729.453218][T25582] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6084'. [ 729.464651][T25574] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 729.527435][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 729.623005][T25587] veth0_to_batadv: Caught tx_queue_len zero misconfig [ 730.011224][T25609] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6092'. [ 730.044270][T25611] netlink: 'syz.2.6094': attribute type 63 has an invalid length. [ 730.065805][T25538] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 730.088100][T25538] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 730.105431][T25538] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 730.123348][T25602] lo: left allmulticast mode [ 730.136824][T25602] tunl0: left allmulticast mode [ 730.141903][T25602] gre0: left allmulticast mode [ 730.146809][T25602] gretap0: left allmulticast mode [ 730.151991][T25602] erspan0: left allmulticast mode [ 730.157340][T25602] ip_vti0: left allmulticast mode [ 730.162551][T25602] ip6_vti0: left allmulticast mode [ 730.167811][T25602] sit0: left allmulticast mode [ 730.172718][T25602] ip6tnl0: left allmulticast mode [ 730.177932][T25602] ip6gre0: left allmulticast mode [ 730.214711][T25613] netlink: 'syz.2.6094': attribute type 63 has an invalid length. [ 730.233848][T25602] vlan1: left allmulticast mode [ 730.238820][T25602] hsr0: left allmulticast mode [ 730.243870][T25602] hsr_slave_0: left allmulticast mode [ 730.249297][T25602] hsr_slave_1: left allmulticast mode [ 730.448374][T25627] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6098'. [ 730.499019][T25627] macsec1: entered allmulticast mode [ 730.509376][T25627] bond0: entered allmulticast mode [ 730.521789][T25627] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 730.545064][ T14] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.553285][ T14] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 730.561560][ T14] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 730.568729][T25635] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6101'. [ 730.700614][T17868] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.708840][T17868] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20000 - 0 [ 730.717110][T17868] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 730.790022][T17868] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.834031][T17868] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20000 - 0 [ 730.864833][T17868] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 730.900714][ T57] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 730.931716][ T57] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20000 - 0 [ 730.940113][ T57] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 731.070010][T25662] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6108'. [ 731.206023][T25669] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6109'. [ 731.435273][T25688] netlink: 51 bytes leftover after parsing attributes in process `syz.1.6117'. [ 732.414092][T25745] netlink: 'syz.0.6135': attribute type 10 has an invalid length. [ 732.576731][ T57] net_ratelimit: 20 callbacks suppressed [ 732.576756][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 732.696591][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 732.846891][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 732.988090][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.117129][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.227039][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.346918][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.456647][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.567129][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.676736][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 733.941046][T25784] __nla_validate_parse: 10 callbacks suppressed [ 733.941072][T25784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6150'. [ 734.026396][T17868] tipc: Subscription rejected, illegal request [ 734.275336][T25802] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 734.300385][T25794] netlink: 'syz.2.6153': attribute type 83 has an invalid length. [ 734.319396][T25805] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 734.526797][T25820] bond0: entered promiscuous mode [ 734.531892][T25820] bond_slave_0: entered promiscuous mode [ 734.537858][T25820] bond_slave_1: entered promiscuous mode [ 734.559572][T25820] bond0: left promiscuous mode [ 734.564389][T25820] bond_slave_0: left promiscuous mode [ 734.569894][T25820] bond_slave_1: left promiscuous mode [ 734.584767][T25823] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6163'. [ 734.622003][T25825] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6164'. [ 734.635774][T25825] netlink: 'syz.3.6164': attribute type 21 has an invalid length. [ 734.788875][T25829] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6165'. [ 734.838921][T25829] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6165'. [ 734.922856][T25836] netlink: 64985 bytes leftover after parsing attributes in process `syz.4.6168'. [ 735.013448][T25842] xt_cgroup: invalid path, errno=-2 [ 735.049742][T25844] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6170'. [ 735.157956][T25846] vlan1: entered promiscuous mode [ 735.163181][T25846] hsr0: entered promiscuous mode [ 735.169388][T25846] vlan1: entered allmulticast mode [ 735.174735][T25846] hsr0: entered allmulticast mode [ 735.180168][T25846] hsr_slave_0: entered allmulticast mode [ 735.186108][T25846] hsr_slave_1: entered allmulticast mode [ 735.186867][T25847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6171'. [ 735.205346][T25847] netlink: 'syz.4.6171': attribute type 10 has an invalid length. [ 735.220442][T25847] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6171'. [ 735.222112][T25849] macsec0: entered allmulticast mode [ 735.235029][T25849] bond0: entered allmulticast mode [ 735.240585][T25849] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 735.249165][T25849] bond0: left allmulticast mode [ 735.270790][T25847] geneve5: entered promiscuous mode [ 735.276061][T25847] geneve5: entered allmulticast mode [ 735.287777][T17868] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.297239][T17868] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.316837][T17868] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.325329][T17868] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 735.384537][T25850] syzkaller0: entered promiscuous mode [ 735.396703][T25850] syzkaller0: entered allmulticast mode [ 735.485987][T25865] netlink: 'syz.2.6176': attribute type 2 has an invalid length. [ 735.492454][T25867] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-xor(2) [ 735.493755][T25865] netlink: 188 bytes leftover after parsing attributes in process `syz.2.6176'. [ 735.520516][T25867] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-xor(2) [ 735.692507][T25873] x_tables: duplicate entry at hook 1 [ 735.717354][T25873] bond0: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 735.728731][T25873] bond0: (slave ip6gre0): Error -95 calling set_mac_address [ 735.753870][T25873] 8021q: adding VLAN 0 to HW filter on device  [ 735.761321][T25873] 8021q: adding VLAN 0 to HW filter on device team0 [ 735.833383][T25873] bridge_slave_1: entered promiscuous mode [ 735.897018][T25873] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 735.925062][T25873] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 735.960884][T25873] veth1_vlan: left promiscuous mode [ 735.969239][T25873] veth0_vlan: left promiscuous mode [ 735.987052][T25873] veth0_vlan: entered promiscuous mode [ 736.012781][T25873] tipc: Resetting bearer [ 736.035455][T25873] veth1_vlan: entered promiscuous mode [ 736.062422][T25873] veth1_macvtap: left promiscuous mode [ 736.070292][T25873] veth0_macvtap: left promiscuous mode [ 736.079768][T25873] veth0_macvtap: entered promiscuous mode [ 736.087580][T25873] veth1_macvtap: entered promiscuous mode [ 736.148461][T25873] geneve0: entered promiscuous mode [ 736.187525][T25873] 8021q: adding VLAN 0 to HW filter on device bond1 [ 736.209518][T25873] 8021q: adding VLAN 0 to HW filter on device bond2 [ 736.258691][T25873] 8021q: adding VLAN 0 to HW filter on device bond3 [ 736.268751][T25873] 8021q: adding VLAN 0 to HW filter on device bond4 [ 736.278614][T25873] 8021q: adding VLAN 0 to HW filter on device bond5 [ 736.288970][T25873] 8021q: adding VLAN 0 to HW filter on device bond6 [ 736.302074][T25873] 8021q: adding VLAN 0 to HW filter on device bond7 [ 736.311216][T25873] 8021q: adding VLAN 0 to HW filter on device bond8 [ 736.323350][T25873] 8021q: adding VLAN 0 to HW filter on device bond9 [ 736.332592][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 736.338634][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 736.344511][T25873] 8021q: adding VLAN 0 to HW filter on device bond10 [ 736.456621][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 736.480892][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 736.489394][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap3 [ 736.509655][T25873] 8021q: adding VLAN 0 to HW filter on device bond0 [ 736.517587][T25873] 8021q: adding VLAN 0 to HW filter on device bond11 [ 736.525713][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap4 [ 736.534132][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap5 [ 736.542260][T25873] 8021q: adding VLAN 0 to HW filter on device bond12 [ 736.550804][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap6 [ 736.559403][T25873] 8021q: adding VLAN 0 to HW filter on device macvtap7 [ 736.566722][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 736.676688][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 736.725876][ T57] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 736.734553][ T57] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 736.746536][ T57] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 736.754271][ T57] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 736.781468][T24169] bridge6: entered promiscuous mode [ 736.806877][T24156] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 736.816160][T24156] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 737.147688][T25227] syz1: Port: 1 Link ACTIVE [ 737.249603][ T6721] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 737.258875][ T6721] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.276389][ T6721] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 737.294532][ T6721] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 737.314399][ T6721] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.334077][ T6721] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 737.352708][ T57] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 737.361902][ T57] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.371432][ T57] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 737.383827][ T57] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 737.392526][ T57] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 737.401667][ T57] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 19999 - 0 [ 737.617017][ T57] net_ratelimit: 43 callbacks suppressed [ 737.617040][ T57] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 737.653398][T25907] netlink: 'syz.4.6188': attribute type 2 has an invalid length. [ 737.769311][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 737.879450][T25917] netlink: zone id is out of range [ 737.900275][T25916] gre3: entered promiscuous mode [ 737.907181][T25917] netlink: zone id is out of range [ 737.917590][T25917] netlink: zone id is out of range [ 737.930705][T25917] netlink: zone id is out of range [ 737.945046][T25917] netlink: zone id is out of range [ 737.954640][T25917] netlink: zone id is out of range [ 737.960023][T25917] netlink: zone id is out of range [ 737.965247][T25917] netlink: zone id is out of range [ 738.774956][T25966] nbd: must specify an index to disconnect [ 738.798875][T25966] ip6t_srh: unknown srh invflags 4000 [ 739.014927][T25984] __nla_validate_parse: 8 callbacks suppressed [ 739.014950][T25984] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6215'. [ 739.136620][T25988] netlink: 14 bytes leftover after parsing attributes in process `syz.0.6216'. [ 739.247831][T25990] bond10: Unable to set down delay as MII monitoring is disabled [ 739.261065][T25990] bond10 (unregistering): Released all slaves [ 739.574215][T26010] netlink: 'syz.1.6225': attribute type 10 has an invalid length. [ 739.596272][T26010] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6225'. [ 739.606206][T26010] team0: entered allmulticast mode [ 739.611517][T26010] team_slave_1: entered allmulticast mode [ 739.769528][T26026] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6229'. [ 741.244075][T26101] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6249'. [ 741.553236][T26114] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6253'. [ 741.863182][T26125] IPVS: set_ctl: invalid protocol: 33 172.20.20.29:20001 [ 741.895041][T26129] mac80211_hwsim hwsim11 wlan1: Caught tx_queue_len zero misconfig [ 742.248753][T26151] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6263'. [ 742.311888][T26151] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6263'. [ 742.344534][T26158] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6268'. [ 742.447370][ C0] ip6_tnl_xmit_ctl: 21 callbacks suppressed [ 742.447394][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 742.637241][ T14] net_ratelimit: 51 callbacks suppressed [ 742.637269][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 742.693329][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 742.836649][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 742.846696][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 742.857054][T26181] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6277'. [ 743.059474][T26187] 8021q: VLANs not supported on wlan0 [ 743.116894][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 743.231989][T26199] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 743.276795][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 743.383440][T26201] bond15: peer notification delay (25) is not a multiple of miimon (28933), value rounded to 0 ms [ 743.396852][T26201] bond15: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 743.401856][T26209] netlink: 'syz.2.6283': attribute type 1 has an invalid length. [ 743.424403][T26201] bond15 (unregistering): Released all slaves [ 743.474921][T26209] netlink: 'syz.2.6283': attribute type 1 has an invalid length. [ 743.629670][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 743.639812][T26208] syzkaller0: entered promiscuous mode [ 743.645557][T26208] syzkaller0: entered allmulticast mode [ 743.746641][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 743.769052][T26228] netlink: 'syz.3.6288': attribute type 2 has an invalid length. [ 743.940726][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 744.031714][T26239] __nla_validate_parse: 8 callbacks suppressed [ 744.031733][T26239] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6291'. [ 744.168816][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 744.176796][T26245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6294'. [ 744.299327][T26249] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 744.346118][T26253] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6297'. [ 744.471874][T26262] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 744.479313][T26262] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 744.487500][T26262] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 744.522059][T26262] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 744.555559][T26262] batadv0 (unregistering): left promiscuous mode [ 744.655276][T26273] netlink: 'syz.0.6303': attribute type 4 has an invalid length. [ 744.663666][T26274] netlink: 'syz.0.6303': attribute type 4 has an invalid length. [ 744.679288][T26278] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6304'. [ 744.690528][T24169] C speed is unknown, defaulting to 1000 [ 744.696213][T24169] syś2: Port: 1 Link DOWN [ 744.817963][T26284] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6306'. [ 744.905000][T26289] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6308'. [ 744.926633][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 745.349039][T26316] syzkaller0: entered promiscuous mode [ 745.354659][T26316] syzkaller0: entered allmulticast mode [ 745.361950][T26316] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 745.385038][T26310] macsec2: entered promiscuous mode [ 745.503437][T26324] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6320'. [ 745.618138][T26332] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6323'. [ 745.917293][T26348] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6331'. [ 746.084753][T26357] netlink: 'syz.1.6334': attribute type 8 has an invalid length. [ 746.283393][T26368] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6340'. [ 746.301942][T26368] netlink: 'syz.2.6340': attribute type 5 has an invalid length. [ 746.390153][T26378] netlink: 'syz.4.6342': attribute type 1 has an invalid length. [ 746.534286][T26378] 8021q: adding VLAN 0 to HW filter on device bond11 [ 746.544466][T26378] bond10: (slave bond11): making interface the new active one [ 746.553648][T26378] bond10: (slave bond11): Enslaving as an active interface with an up link [ 746.586117][T26378] bond10: (slave gretap4): Enslaving as a backup interface with an up link [ 746.604715][T26378] 8021q: adding VLAN 0 to HW filter on device bond10 [ 746.737265][T26378] virt_wifi0 speed is unknown, defaulting to 1000 [ 746.750604][T26378] C speed is unknown, defaulting to 1000 [ 747.006699][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 747.328762][ T1314] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.341507][T26408] netlink: 'syz.1.6353': attribute type 7 has an invalid length. [ 747.693265][ T36] net_ratelimit: 28 callbacks suppressed [ 747.693285][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 748.138324][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 748.460097][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 748.596717][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 748.686869][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 748.695915][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 748.864684][T26473] netlink: 'syz.3.6373': attribute type 5 has an invalid length. [ 748.925131][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 749.086922][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 749.104626][T26490] __nla_validate_parse: 10 callbacks suppressed [ 749.104646][T26490] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6379'. [ 749.131731][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 749.170326][T26490] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 749.204952][T26494] netlink: 'syz.1.6381': attribute type 1 has an invalid length. [ 749.280713][T26498] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 749.297137][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 749.335339][T26494] bond14: (slave geneve4): making interface the new active one [ 749.453913][T26494] bond14: (slave geneve4): Enslaving as an active interface with an up link [ 749.515808][ T133] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 20004 - 0 [ 749.524226][ T133] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 20004 - 0 [ 749.561609][ T133] netdevsim netdevsim1 eth2: set [1, 2] type 2 family 0 port 20004 - 0 [ 749.570040][ T133] netdevsim netdevsim1 eth3: set [1, 2] type 2 family 0 port 20004 - 0 [ 749.681254][T26515] openvswitch: netlink: Message has 8 unknown bytes. [ 749.715766][T26517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6386'. [ 749.887417][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 750.089069][T26544] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6392'. [ 750.662917][T26568] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6401'. [ 750.724847][T26571] syzkaller0: entered promiscuous mode [ 750.730441][T26571] syzkaller0: entered allmulticast mode [ 751.168085][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 751.177015][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 751.233805][T26583] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6405'. [ 752.776647][ T36] net_ratelimit: 26 callbacks suppressed [ 752.776694][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 752.896676][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 752.934903][T26535] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 753.017817][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 753.169192][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 753.246753][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 753.313722][T26606] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6412'. [ 753.427002][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 753.477153][T26612] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6414'. [ 753.500302][T26617] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6416'. [ 753.610487][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 753.731855][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 753.848786][T26636] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 753.956567][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 754.066705][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 755.326653][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 756.648485][T26624] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 757.020652][T26683] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6433'. [ 757.063850][T26686] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6435'. [ 757.406656][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 757.550314][T26721] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6445'. [ 757.783938][T26730] netlink: 'syz.0.6448': attribute type 1 has an invalid length. [ 757.796944][T17868] net_ratelimit: 30 callbacks suppressed [ 757.796970][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 757.870032][T26730] 8021q: adding VLAN 0 to HW filter on device bond12 [ 757.969956][T26738] bond12: (slave veth11): Enslaving as an active interface with a down link [ 758.021609][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.057773][T26744] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6450'. [ 758.220381][T26755] netlink: 830 bytes leftover after parsing attributes in process `syz.1.6455'. [ 758.245948][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.291972][T26761] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 758.467665][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.587880][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.710603][T26776] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6460'. [ 758.758464][T26777] syzkaller0: entered promiscuous mode [ 758.764088][T26777] syzkaller0: entered allmulticast mode [ 758.797571][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.937107][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 758.987710][T26783] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 759.049645][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 759.497089][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 760.231352][T26701] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 760.397297][T26793] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6464'. [ 761.575821][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 763.362105][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 763.646928][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 763.878338][T17868] net_ratelimit: 2 callbacks suppressed [ 763.878365][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 763.898757][T26811] FAULT_INJECTION: forcing a failure. [ 763.898757][T26811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 763.917082][T26811] CPU: 0 UID: 0 PID: 26811 Comm: syz.2.6469 Not tainted syzkaller #0 PREEMPT(full) [ 763.917111][T26811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 763.917122][T26811] Call Trace: [ 763.917130][T26811] [ 763.917140][T26811] dump_stack_lvl+0xe8/0x150 [ 763.917175][T26811] should_fail_ex+0x40c/0x560 [ 763.917207][T26811] _copy_from_user+0x2d/0xb0 [ 763.917230][T26811] ___sys_sendmsg+0x1c6/0x360 [ 763.917283][T26811] ? __lock_acquire+0x683/0x2cf0 [ 763.917309][T26811] ? __pfx____sys_sendmsg+0x10/0x10 [ 763.917329][T26811] ? __lock_acquire+0x683/0x2cf0 [ 763.917354][T26811] ? kstrtouint+0x6e/0xe0 [ 763.917420][T26811] __sys_sendmmsg+0x273/0x4d0 [ 763.917448][T26811] ? __pfx___sys_sendmmsg+0x10/0x10 [ 763.917479][T26811] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 763.917525][T26811] ? ksys_write+0x242/0x270 [ 763.917553][T26811] ? __pfx_ksys_write+0x10/0x10 [ 763.917582][T26811] __x64_sys_sendmmsg+0xa0/0xc0 [ 763.917604][T26811] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.917625][T26811] do_syscall_64+0x174/0x580 [ 763.917643][T26811] ? trace_irq_disable+0x3b/0x140 [ 763.917662][T26811] ? clear_bhb_loop+0x40/0x90 [ 763.917691][T26811] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 763.917710][T26811] RIP: 0033:0x7f120ff9de59 [ 763.917730][T26811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 763.917746][T26811] RSP: 002b:00007f1210ec7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 763.917768][T26811] RAX: ffffffffffffffda RBX: 00007f1210225fa0 RCX: 00007f120ff9de59 [ 763.917783][T26811] RDX: 0000000000034000 RSI: 0000200000004380 RDI: 0000000000000005 [ 763.917796][T26811] RBP: 00007f1210ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 763.917809][T26811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 763.917820][T26811] R13: 00007f1210226038 R14: 00007f1210225fa0 R15: 00007ffdd3fec688 [ 763.917852][T26811] [ 764.137804][T26813] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 764.206055][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 764.303050][T26819] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 764.326665][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 764.573989][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 764.596129][T26834] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6477'. [ 764.607443][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 764.723693][T26842] netlink: 'syz.0.6479': attribute type 21 has an invalid length. [ 764.770746][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 764.779579][T26842] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6479'. [ 764.862194][T26850] xt_hashlimit: size too large, truncated to 1048576 [ 764.926279][T26854] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 764.953695][T26855] FAULT_INJECTION: forcing a failure. [ 764.953695][T26855] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 764.982345][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 765.009607][T26863] FAULT_INJECTION: forcing a failure. [ 765.009607][T26863] name failslab, interval 1, probability 0, space 0, times 0 [ 765.014919][T26855] CPU: 0 UID: 0 PID: 26855 Comm: syz.2.6484 Not tainted syzkaller #0 PREEMPT(full) [ 765.014949][T26855] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 765.014962][T26855] Call Trace: [ 765.014971][T26855] [ 765.014979][T26855] dump_stack_lvl+0xe8/0x150 [ 765.015013][T26855] should_fail_ex+0x40c/0x560 [ 765.015045][T26855] _copy_to_user+0x31/0xb0 [ 765.015070][T26855] simple_read_from_buffer+0xe1/0x170 [ 765.015097][T26855] proc_fail_nth_read+0x1bb/0x230 [ 765.015121][T26855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 765.015144][T26855] ? rw_verify_area+0x24a/0x4c0 [ 765.015176][T26855] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 765.015196][T26855] vfs_read+0x213/0xa80 [ 765.015222][T26855] ? __pfx___mutex_lock+0x10/0x10 [ 765.015244][T26855] ? __pfx_vfs_read+0x10/0x10 [ 765.015270][T26855] ? __fget_files+0x2a/0x420 [ 765.015294][T26855] ? __fget_files+0x3a2/0x420 [ 765.015311][T26855] ? __fget_files+0x2a/0x420 [ 765.015338][T26855] ksys_read+0x150/0x270 [ 765.015363][T26855] ? __pfx_ksys_read+0x10/0x10 [ 765.015393][T26855] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.015414][T26855] do_syscall_64+0x174/0x580 [ 765.015432][T26855] ? trace_irq_disable+0x3b/0x140 [ 765.015451][T26855] ? clear_bhb_loop+0x40/0x90 [ 765.015474][T26855] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.015493][T26855] RIP: 0033:0x7f120ff5e68e [ 765.015512][T26855] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 765.015528][T26855] RSP: 002b:00007f1210ea5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 765.015550][T26855] RAX: ffffffffffffffda RBX: 00007f1210ea66c0 RCX: 00007f120ff5e68e [ 765.015564][T26855] RDX: 000000000000000f RSI: 00007f1210ea60a0 RDI: 0000000000000004 [ 765.015576][T26855] RBP: 00007f1210ea6090 R08: 0000000000000000 R09: 0000000000000000 [ 765.015588][T26855] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 765.015599][T26855] R13: 00007f1210226128 R14: 00007f1210226090 R15: 00007ffdd3fec688 [ 765.015630][T26855] [ 765.119653][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 765.146884][T26863] CPU: 1 UID: 0 PID: 26863 Comm: syz.0.6488 Not tainted syzkaller #0 PREEMPT(full) [ 765.146915][T26863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 765.146927][T26863] Call Trace: [ 765.146935][T26863] [ 765.146946][T26863] dump_stack_lvl+0xe8/0x150 [ 765.146977][T26863] should_fail_ex+0x40c/0x560 [ 765.147011][T26863] should_failslab+0xa8/0x100 [ 765.147037][T26863] __kmalloc_noprof+0xfe/0x720 [ 765.147076][T26863] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 765.147105][T26863] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 765.147140][T26863] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 765.147175][T26863] genl_family_rcv_msg_doit+0xda/0x340 [ 765.147208][T26863] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 765.147242][T26863] ? apparmor_capable+0x126/0x170 [ 765.147271][T26863] ? bpf_lsm_capable+0x9/0x20 [ 765.147289][T26863] ? security_capable+0x7e/0x2c0 [ 765.147317][T26863] genl_rcv_msg+0x614/0x7a0 [ 765.147350][T26863] ? __pfx_genl_rcv_msg+0x10/0x10 [ 765.147374][T26863] ? __pfx_ovs_flow_cmd_set+0x10/0x10 [ 765.147495][T26863] ? __pfx_ref_tracker_free+0x10/0x10 [ 765.147534][T26863] netlink_rcv_skb+0x226/0x4a0 [ 765.147557][T26863] ? __pfx_genl_rcv_msg+0x10/0x10 [ 765.147583][T26863] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 765.147619][T26863] ? down_read+0x2be/0x330 [ 765.147644][T26863] genl_rcv+0x28/0x40 [ 765.147667][T26863] netlink_unicast+0x7bb/0x940 [ 765.147697][T26863] netlink_sendmsg+0x813/0xb40 [ 765.147728][T26863] ? __pfx_netlink_sendmsg+0x10/0x10 [ 765.147754][T26863] ? aa_sock_msg_perm+0xf1/0x1b0 [ 765.147781][T26863] ? __pfx_netlink_sendmsg+0x10/0x10 [ 765.147801][T26863] sock_sendmsg_nosec+0x13a/0x180 [ 765.147831][T26863] ____sys_sendmsg+0x54e/0x850 [ 765.147858][T26863] ? __pfx_____sys_sendmsg+0x10/0x10 [ 765.147887][T26863] ? import_iovec+0x73/0xa0 [ 765.147911][T26863] ___sys_sendmsg+0x2a5/0x360 [ 765.147930][T26863] ? __lock_acquire+0x683/0x2cf0 [ 765.147955][T26863] ? __pfx____sys_sendmsg+0x10/0x10 [ 765.148010][T26863] ? __fget_files+0x2a/0x420 [ 765.148028][T26863] ? __fget_files+0x3a2/0x420 [ 765.148057][T26863] __x64_sys_sendmsg+0x1b1/0x290 [ 765.148087][T26863] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 765.148126][T26863] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.148147][T26863] do_syscall_64+0x174/0x580 [ 765.148165][T26863] ? trace_irq_disable+0x3b/0x140 [ 765.148184][T26863] ? clear_bhb_loop+0x40/0x90 [ 765.148207][T26863] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 765.148228][T26863] RIP: 0033:0x7f00f3f9de59 [ 765.148248][T26863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 765.148265][T26863] RSP: 002b:00007f00f4f08028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 765.148286][T26863] RAX: ffffffffffffffda RBX: 00007f00f4225fa0 RCX: 00007f00f3f9de59 [ 765.148300][T26863] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 765.148312][T26863] RBP: 00007f00f4f08090 R08: 0000000000000000 R09: 0000000000000000 [ 765.148325][T26863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 765.148336][T26863] R13: 00007f00f4226038 R14: 00007f00f4225fa0 R15: 00007fff5f03ec88 [ 765.148375][T26863] [ 765.687395][T26877] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6493'. [ 765.697371][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 765.726635][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 765.806739][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 766.013397][T17961] block nbd6: Receive control failed (result -32) [ 766.024096][ T5642] block nbd6: Receive control failed (result -32) [ 766.056635][T26846] nbd6: detected capacity change from 0 to 63 [ 766.103059][ T25] block nbd6: Dead connection, failed to find a fallback [ 766.112701][ T25] block nbd6: shutting down sockets [ 766.121003][ T25] blk_print_req_error: 138 callbacks suppressed [ 766.121047][ T25] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.139672][ T25] buffer_io_error: 138 callbacks suppressed [ 766.139712][ T25] Buffer I/O error on dev nbd6, logical block 0, async page read [ 766.155962][ T25] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.166926][ T25] Buffer I/O error on dev nbd6, logical block 1, async page read [ 766.175831][ T25] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.184982][ T25] Buffer I/O error on dev nbd6, logical block 2, async page read [ 766.192960][ T25] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.202151][ T25] Buffer I/O error on dev nbd6, logical block 3, async page read [ 766.210220][ T25] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.219614][ T25] Buffer I/O error on dev nbd6, logical block 0, async page read [ 766.227754][ T25] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.237102][ T25] Buffer I/O error on dev nbd6, logical block 1, async page read [ 766.245169][ T25] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.254331][ T25] Buffer I/O error on dev nbd6, logical block 2, async page read [ 766.262488][ T25] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 766.271822][ T25] Buffer I/O error on dev nbd6, logical block 3, async page read [ 766.295606][ T25] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 766.305406][ T25] Buffer I/O error on dev nbd6, logical block 0, async page read [ 766.313241][ T25] Buffer I/O error on dev nbd6, logical block 1, async page read [ 766.321805][ T25] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 766.337732][T26889] ldm_validate_partition_table(): Disk read failed. [ 766.346688][T26889] Dev nbd6: unable to read RDB block 0 [ 766.378454][T26894] netlink: 216 bytes leftover after parsing attributes in process `syz.2.6498'. [ 766.384663][T26889] nbd6: unable to read partition table [ 766.420857][T26889] ldm_validate_partition_table(): Disk read failed. [ 766.429343][T26889] Dev nbd6: unable to read RDB block 0 [ 766.437179][T26889] nbd6: unable to read partition table [ 766.520191][T26909] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6498'. [ 766.627450][T26917] bond0: entered promiscuous mode [ 766.636148][T26917] bond_slave_0: entered promiscuous mode [ 766.653598][T26917] bond_slave_1: entered promiscuous mode [ 766.677649][T26917] bond0: left promiscuous mode [ 766.693664][T26917] bond_slave_0: left promiscuous mode [ 766.701286][T26917] bond_slave_1: left promiscuous mode [ 766.878632][T26935] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6510'. [ 766.903710][T26935] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6510'. [ 767.167005][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 767.807403][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 768.715902][T26940] netlink: 6208 bytes leftover after parsing attributes in process `syz.1.6512'. [ 768.917968][ T5785] net_ratelimit: 25 callbacks suppressed [ 768.918014][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 768.939593][T26958] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6516'. [ 769.037730][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.147171][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.256936][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.369177][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.482352][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.591830][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.801293][T26929] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 769.813595][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 769.887010][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 769.936209][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 770.045730][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 770.207672][T26989] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6526'. [ 770.328793][T26992] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6527'. [ 770.538490][T27008] netlink: 'syz.1.6532': attribute type 1 has an invalid length. [ 770.538972][T27005] syzkaller0: entered promiscuous mode [ 770.553209][T27005] syzkaller0: entered allmulticast mode [ 770.588490][T27008] 8021q: adding VLAN 0 to HW filter on device bond15 [ 771.646173][T27047] netlink: 200 bytes leftover after parsing attributes in process `syz.1.6546'. [ 771.967016][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 773.568459][T27011] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 773.769255][T27061] netlink: 6208 bytes leftover after parsing attributes in process `syz.3.6551'. [ 773.945780][T27073] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6556'. [ 773.961203][ T36] net_ratelimit: 33 callbacks suppressed [ 773.961230][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.046911][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 774.072107][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.198147][T27091] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 774.301241][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.402107][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.426723][T27104] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6565'. [ 774.518485][T27107] netlink: 6208 bytes leftover after parsing attributes in process `syz.2.6566'. [ 774.529523][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.628176][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.676306][T27117] bridge0: entered promiscuous mode [ 774.682438][T27117] bridge0: entered allmulticast mode [ 774.748110][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.860966][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 774.889499][T27123] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6572'. [ 775.088515][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 776.126825][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 777.185778][T27092] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 777.425868][T27140] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6576'. [ 777.498752][T27148] syzkaller0: entered promiscuous mode [ 777.527762][T27148] syzkaller0: entered allmulticast mode [ 777.717703][T27160] 8021q: VLANs not supported on syzkaller1 [ 777.807090][T27175] syzkaller1: entered promiscuous mode [ 777.808575][T27169] can: request_module (can-proto-0) failed. [ 777.812798][T27175] syzkaller1: entered allmulticast mode [ 777.831660][ T30] audit: type=1800 audit(1782924285.059:18): pid=27169 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.6587" name="memory.events" dev="tmpfs" ino=6833 res=0 errno=0 [ 778.145016][T27193] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6595'. [ 778.206631][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 778.403282][T27205] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6600'. [ 778.522749][ T30] audit: type=1800 audit(1782924285.779:19): pid=27207 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6601" name="memory.events" dev="tmpfs" ino=6555 res=0 errno=0 [ 778.978019][ T6721] net_ratelimit: 30 callbacks suppressed [ 778.978048][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.097194][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.207066][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.328296][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.493807][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.600686][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.717830][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.827171][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 779.937018][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 780.047590][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 780.286662][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 780.922345][T27178] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 781.070899][T27223] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6607'. [ 781.242560][T27232] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6610'. [ 781.350541][T27249] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6614'. [ 781.391708][T27239] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6613'. [ 781.412242][T27253] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6614'. [ 781.972127][T27282] netlink: 'syz.0.6625': attribute type 2 has an invalid length. [ 782.265983][T27305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6632'. [ 782.366853][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 784.056976][ T36] net_ratelimit: 50 callbacks suppressed [ 784.056999][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.176593][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.286779][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.396782][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.446828][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 784.506632][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.616602][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 784.628015][T27265] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 784.811213][T27309] netlink: 768 bytes leftover after parsing attributes in process `syz.0.6633'. [ 784.845445][T27315] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6636'. [ 784.915090][T27316] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6635'. [ 784.985327][T27316] tipc: Invalid UDP bearer configuration [ 784.985388][T27316] tipc: Enabling of bearer rejected, failed to enable media [ 785.000867][T27316] openvswitch: netlink: Actions may not be safe on all matching packets [ 785.090909][T27333] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6643'. [ 785.099969][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 785.276783][ T6721] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 785.389938][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 785.577906][T27367] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6657'. [ 785.745604][T27377] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6660'. [ 785.778044][T27385] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6661'. [ 785.994781][T27399] netlink: 'syz.4.6666': attribute type 21 has an invalid length. [ 786.006744][T27402] netlink: 'syz.4.6666': attribute type 21 has an invalid length. [ 786.078026][T27399] bond12: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 786.093942][T27399] bond12 (unregistering): Released all slaves [ 786.171872][T27402] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 786.184423][T27410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6668'. [ 786.203611][T27420] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.6670'. [ 786.226168][T27398] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 786.240528][T27419] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 786.251149][T27417] tipc: Enabled bearer , priority 0 [ 786.265022][T27417] syzkaller0: entered promiscuous mode [ 786.277776][T27417] syzkaller0: entered allmulticast mode [ 786.311469][T27417] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 786.411455][T27425] tipc: Resetting bearer [ 786.466184][T27416] tipc: Resetting bearer [ 786.474798][T27429] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6673'. [ 786.526637][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 786.615520][T27416] tipc: Disabling bearer [ 786.697065][T27440] FAULT_INJECTION: forcing a failure. [ 786.697065][T27440] name failslab, interval 1, probability 0, space 0, times 0 [ 786.711271][T27440] CPU: 1 UID: 0 PID: 27440 Comm: syz.3.6674 Not tainted syzkaller #0 PREEMPT(full) [ 786.711297][T27440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 786.711309][T27440] Call Trace: [ 786.711317][T27440] [ 786.711326][T27440] dump_stack_lvl+0xe8/0x150 [ 786.711357][T27440] should_fail_ex+0x40c/0x560 [ 786.711392][T27440] should_failslab+0xa8/0x100 [ 786.711419][T27440] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 786.711447][T27440] ? dst_alloc+0x105/0x170 [ 786.711547][T27440] ? dst_alloc+0x105/0x170 [ 786.711576][T27440] dst_alloc+0x105/0x170 [ 786.711604][T27440] ip_route_input_rcu+0x20ca/0x3190 [ 786.711704][T27440] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 786.711755][T27440] ? trace_irq_disable+0x3b/0x140 [ 786.711780][T27440] ? ip_route_input_noref+0xad/0x270 [ 786.711810][T27440] ip_route_input_noref+0x17c/0x270 [ 786.711840][T27440] ? __pfx_ip_route_input_noref+0x10/0x10 [ 786.711865][T27440] ? nft_do_chain_inet+0x360/0x4b0 [ 786.711953][T27440] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 786.711981][T27440] ? ipt_do_table+0x2b9/0x15d0 [ 786.712052][T27440] ip_rcv_finish_core+0x593/0x1c00 [ 786.712089][T27440] ip_rcv_finish+0x14c/0x2a0 [ 786.712115][T27440] NF_HOOK+0x336/0x3c0 [ 786.712138][T27440] ? __pfx_ip_rcv_finish+0x10/0x10 [ 786.712158][T27440] ? NF_HOOK+0x9e/0x3c0 [ 786.712178][T27440] ? __pfx_NF_HOOK+0x10/0x10 [ 786.712204][T27440] ? __pfx_ip_rcv_finish+0x10/0x10 [ 786.712232][T27440] ? netif_receive_skb+0x102/0xbf0 [ 786.712283][T27440] ? __pfx_ip_rcv+0x10/0x10 [ 786.712302][T27440] netif_receive_skb+0x45b/0xbf0 [ 786.712331][T27440] ? __pfx_netif_receive_skb+0x10/0x10 [ 786.712360][T27440] ? rcu_is_watching+0x15/0xb0 [ 786.712389][T27440] ? tun_rx_batched+0x185/0x790 [ 786.712503][T27440] tun_rx_batched+0x1de/0x790 [ 786.712536][T27440] ? __pfx_tun_rx_batched+0x10/0x10 [ 786.712564][T27440] ? tun_get_user+0x2717/0x4370 [ 786.712593][T27440] ? tun_get_user+0x2717/0x4370 [ 786.712620][T27440] ? tun_get_user+0x23cb/0x4370 [ 786.712648][T27440] ? tun_get_user+0x23cb/0x4370 [ 786.712675][T27440] ? __local_bh_enable_ip+0xd0/0x130 [ 786.712712][T27440] ? tun_get_user+0x2717/0x4370 [ 786.712739][T27440] ? tun_get_user+0x2717/0x4370 [ 786.712766][T27440] tun_get_user+0x2b44/0x4370 [ 786.712815][T27440] ? aa_file_perm+0x4ed/0x15f0 [ 786.712842][T27440] ? __pfx_tun_get_user+0x10/0x10 [ 786.712872][T27440] ? __lock_acquire+0x683/0x2cf0 [ 786.712910][T27440] ? ref_tracker_alloc+0x341/0x4b0 [ 786.712941][T27440] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 786.712989][T27440] ? tun_get+0x1c/0x2f0 [ 786.713022][T27440] ? tun_get+0x1c/0x2f0 [ 786.713053][T27440] ? tun_get+0x1c/0x2f0 [ 786.713079][T27440] ? tun_get+0x1c/0x2f0 [ 786.713112][T27440] tun_chr_write_iter+0x113/0x200 [ 786.713142][T27440] vfs_write+0x612/0xba0 [ 786.713178][T27440] ? __pfx_vfs_write+0x10/0x10 [ 786.713211][T27440] ? __fget_files+0x2a/0x420 [ 786.713237][T27440] ksys_write+0x150/0x270 [ 786.713263][T27440] ? __pfx_ksys_write+0x10/0x10 [ 786.713292][T27440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.713314][T27440] do_syscall_64+0x174/0x580 [ 786.713336][T27440] ? clear_bhb_loop+0x40/0x90 [ 786.713359][T27440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 786.713377][T27440] RIP: 0033:0x7fcc20d5e68e [ 786.713397][T27440] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 786.713413][T27440] RSP: 002b:00007fcc21d0afb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 786.713432][T27440] RAX: ffffffffffffffda RBX: 00007fcc21d0b6c0 RCX: 00007fcc20d5e68e [ 786.713446][T27440] RDX: 000000000000006a RSI: 0000200000000140 RDI: 00000000000000c8 [ 786.713458][T27440] RBP: 00007fcc21d0b090 R08: 0000000000000000 R09: 0000000000000000 [ 786.713469][T27440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 786.713481][T27440] R13: 00007fcc21026038 R14: 00007fcc21025fa0 R15: 00007ffffedcff78 [ 786.713509][T27440] [ 787.168784][T27445] FAULT_INJECTION: forcing a failure. [ 787.168784][T27445] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 787.186641][T27445] CPU: 1 UID: 0 PID: 27445 Comm: syz.2.6676 Not tainted syzkaller #0 PREEMPT(full) [ 787.186666][T27445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 787.186677][T27445] Call Trace: [ 787.186684][T27445] [ 787.186693][T27445] dump_stack_lvl+0xe8/0x150 [ 787.186722][T27445] should_fail_ex+0x40c/0x560 [ 787.186753][T27445] _copy_from_user+0x2d/0xb0 [ 787.186774][T27445] ___sys_recvmsg+0x173/0x5a0 [ 787.186802][T27445] ? __pfx____sys_recvmsg+0x10/0x10 [ 787.186828][T27445] ? __fget_files+0x2a/0x420 [ 787.186865][T27445] ? __fget_files+0x3a2/0x420 [ 787.186894][T27445] do_recvmmsg+0x31a/0x7f0 [ 787.186924][T27445] ? __pfx_do_recvmmsg+0x10/0x10 [ 787.186959][T27445] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 787.187001][T27445] ? __fget_files+0x3a2/0x420 [ 787.187030][T27445] __x64_sys_recvmmsg+0x198/0x250 [ 787.187054][T27445] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 787.187084][T27445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.187104][T27445] do_syscall_64+0x174/0x580 [ 787.187119][T27445] ? trace_irq_disable+0x3b/0x140 [ 787.187138][T27445] ? clear_bhb_loop+0x40/0x90 [ 787.187160][T27445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 787.187180][T27445] RIP: 0033:0x7f120ff9de59 [ 787.187198][T27445] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 787.187215][T27445] RSP: 002b:00007f1210ec7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 787.187236][T27445] RAX: ffffffffffffffda RBX: 00007f1210225fa0 RCX: 00007f120ff9de59 [ 787.187251][T27445] RDX: 0000000000000300 RSI: 0000200000001640 RDI: 0000000000000003 [ 787.187264][T27445] RBP: 00007f1210ec7090 R08: 0000000000000000 R09: 0000000000000000 [ 787.187276][T27445] R10: 0000000000034000 R11: 0000000000000246 R12: 0000000000000001 [ 787.187288][T27445] R13: 00007f1210226038 R14: 00007f1210225fa0 R15: 00007ffdd3fec688 [ 787.187319][T27445] [ 787.509332][T27451] bond2: left allmulticast mode [ 787.519390][T27451] netlink: 'syz.1.6679': attribute type 4 has an invalid length. [ 787.831047][T27471] bond0: entered promiscuous mode [ 787.840059][T27471] bond_slave_0: entered promiscuous mode [ 787.845997][T27471] bond_slave_1: entered promiscuous mode [ 787.853928][T27471] bond0: left promiscuous mode [ 787.858780][T27471] bond_slave_0: left promiscuous mode [ 787.864811][T27471] bond_slave_1: left promiscuous mode [ 788.222723][T27491] netlink: 'syz.2.6695': attribute type 4 has an invalid length. [ 788.387692][T27495] FAULT_INJECTION: forcing a failure. [ 788.387692][T27495] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 788.407892][T27495] CPU: 1 UID: 0 PID: 27495 Comm: syz.4.6696 Not tainted syzkaller #0 PREEMPT(full) [ 788.407920][T27495] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 788.407932][T27495] Call Trace: [ 788.407940][T27495] [ 788.407949][T27495] dump_stack_lvl+0xe8/0x150 [ 788.407980][T27495] should_fail_ex+0x40c/0x560 [ 788.408013][T27495] _copy_to_iter+0x404/0x1810 [ 788.408057][T27495] ? __pfx__copy_to_iter+0x10/0x10 [ 788.408085][T27495] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 788.408182][T27495] ? lockdep_hardirqs_on+0x7a/0x110 [ 788.408210][T27495] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 788.408234][T27495] ? __skb_try_recv_datagram+0x3de/0x4e0 [ 788.408300][T27495] __skb_datagram_iter+0xf8/0x980 [ 788.408320][T27495] ? __pfx_sk_busy_loop_end+0x10/0x10 [ 788.408348][T27495] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 788.408379][T27495] skb_copy_datagram_iter+0xb5/0x240 [ 788.408406][T27495] netlink_recvmsg+0x2b9/0xa50 [ 788.408439][T27495] ? __pfx_netlink_recvmsg+0x10/0x10 [ 788.408479][T27495] ? __lock_acquire+0x683/0x2cf0 [ 788.408499][T27495] ? aa_sock_msg_perm+0xf1/0x1b0 [ 788.408526][T27495] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 788.408551][T27495] ? security_socket_recvmsg+0x7e/0x2c0 [ 788.408616][T27495] ? __pfx_netlink_recvmsg+0x10/0x10 [ 788.408639][T27495] sock_recvmsg+0x196/0x1e0 [ 788.408670][T27495] ____sys_recvmsg+0x1e6/0x4a0 [ 788.408701][T27495] ? __pfx_____sys_recvmsg+0x10/0x10 [ 788.408739][T27495] ? import_iovec+0x73/0xa0 [ 788.408763][T27495] ___sys_recvmsg+0x213/0x5a0 [ 788.408791][T27495] ? __pfx____sys_recvmsg+0x10/0x10 [ 788.408816][T27495] ? __fget_files+0x2a/0x420 [ 788.408853][T27495] ? __fget_files+0x3a2/0x420 [ 788.408882][T27495] do_recvmmsg+0x31a/0x7f0 [ 788.408913][T27495] ? __pfx_do_recvmmsg+0x10/0x10 [ 788.408946][T27495] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 788.409036][T27495] __x64_sys_recvmmsg+0x198/0x250 [ 788.409061][T27495] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 788.409088][T27495] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.409108][T27495] do_syscall_64+0x174/0x580 [ 788.409127][T27495] ? clear_bhb_loop+0x40/0x90 [ 788.409150][T27495] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.409170][T27495] RIP: 0033:0x7f8d2539de59 [ 788.409188][T27495] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 788.409205][T27495] RSP: 002b:00007f8d26352028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 788.409225][T27495] RAX: ffffffffffffffda RBX: 00007f8d25625fa0 RCX: 00007f8d2539de59 [ 788.409239][T27495] RDX: 0000000000000300 RSI: 0000200000001640 RDI: 0000000000000003 [ 788.409252][T27495] RBP: 00007f8d26352090 R08: 0000000000000000 R09: 0000000000000000 [ 788.409265][T27495] R10: 0000000000034000 R11: 0000000000000246 R12: 0000000000000001 [ 788.409277][T27495] R13: 00007f8d25626038 R14: 00007f8d25625fa0 R15: 00007ffc8800a018 [ 788.409310][T27495] [ 788.626738][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 789.098673][ T14] net_ratelimit: 59 callbacks suppressed [ 789.098697][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.207789][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.366106][T27545] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 789.376942][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.483464][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.587527][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.700705][T27561] netlink: 'syz.3.6718': attribute type 2 has an invalid length. [ 789.713721][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.725353][T27561] netlink: 'syz.3.6718': attribute type 2 has an invalid length. [ 789.743836][T27561] Cannot find set identified by id 65534 to match [ 789.820154][T27563] __nla_validate_parse: 8 callbacks suppressed [ 789.820175][T27563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6719'. [ 789.837000][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 789.845588][T27563] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6719'. [ 789.862254][T27566] netlink: 'syz.3.6720': attribute type 11 has an invalid length. [ 789.875817][T27566] netlink: 'syz.3.6720': attribute type 1 has an invalid length. [ 789.884098][T27566] netlink: 'syz.3.6720': attribute type 1 has an invalid length. [ 789.946815][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 790.058548][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 790.128418][T27574] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6724'. [ 790.256726][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 790.338420][T27581] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6728'. [ 790.594047][T27593] syzkaller0: entered promiscuous mode [ 790.627405][T27593] syzkaller0: entered allmulticast mode [ 790.652091][T27599] x_tables: unsorted entry at hook 1 [ 790.766699][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 791.161036][T27623] syzkaller0: entered promiscuous mode [ 791.170987][T27623] syzkaller0: entered allmulticast mode [ 791.381752][T27637] netlink: 'syz.2.6745': attribute type 1 has an invalid length. [ 791.389544][T27637] netlink: 756 bytes leftover after parsing attributes in process `syz.2.6745'. [ 791.494075][T27644] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6745'. [ 792.167012][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 792.398997][T27684] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 792.408087][T27684] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 792.846777][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 794.046798][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 794.145596][T27692] net_ratelimit: 31 callbacks suppressed [ 794.145615][T27692] openvswitch: netlink: Actions may not be safe on all matching packets [ 794.153359][T27712] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6766'. [ 794.179788][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.287294][T17868] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.291774][T27717] block nbd0: reconnected socket [ 794.301605][T17961] block nbd0: Receive control failed (result -107) [ 794.446120][T27722] syzkaller0: entered promiscuous mode [ 794.453264][T27722] syzkaller0: entered allmulticast mode [ 794.496895][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.635555][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.717173][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 794.731038][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.842550][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.936872][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 794.948761][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 794.992341][T27748] vcan0: tx drop: invalid da for name 0x0000000000000015 [ 795.035010][T27754] openvswitch: netlink: Geneve option length err (len 856, max 255). [ 795.063817][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 795.110117][T27758] netlink: 'syz.1.6781': attribute type 1 has an invalid length. [ 795.232686][T27767] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6783'. [ 795.242736][T27758] workqueue: Failed to create a rescuer kthread for wq "bond16": -EINTR [ 795.486019][T27783] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6791'. [ 795.553265][T27783] syzkaller1: entered promiscuous mode [ 795.558783][T27783] syzkaller1: entered allmulticast mode [ 795.615470][T27783] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6791'. [ 795.656426][T27783] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6791'. [ 795.910395][T27812] syzkaller0: entered promiscuous mode [ 795.920057][T27812] syzkaller0: entered allmulticast mode [ 796.469185][T27840] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6812'. [ 797.007054][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 797.484881][T27881] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6827'. [ 798.034698][T27910] syzkaller0: entered promiscuous mode [ 798.051903][T27909] [ 798.054282][T27909] ====================================================== [ 798.057491][T27910] syzkaller0: entered allmulticast mode [ 798.061562][T27909] WARNING: possible circular locking dependency detected [ 798.061650][T27909] syzkaller #0 Not tainted [ 798.078612][T27909] ------------------------------------------------------ [ 798.085703][T27909] syz.1.6834/27909 is trying to acquire lock: [ 798.091768][T27909] ffffffff8ea5eb20 (pcpu_alloc_mutex){+.+.}-{4:4}, at: pcpu_alloc_noprof+0x231/0x1900 [ 798.101469][T27909] [ 798.101469][T27909] but task is already holding lock: [ 798.108842][T27909] ffff88805026a660 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sk_setsockopt+0xe6c/0x2f10 [ 798.118062][T27909] [ 798.118062][T27909] which lock already depends on the new lock. [ 798.118062][T27909] [ 798.128709][T27909] [ 798.128709][T27909] the existing dependency chain (in reverse order) is: [ 798.137706][T27909] [ 798.137706][T27909] -> #7 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 798.145882][T27909] lock_sock_nested+0x41/0x100 [ 798.151162][T27909] inet_shutdown+0x6a/0x390 [ 798.156467][T27909] nbd_mark_nsock_dead+0x2cb/0x550 [ 798.162264][T27909] recv_work+0x1cee/0x1e10 [ 798.167235][T27909] process_scheduled_works+0xa8e/0x14e0 [ 798.173300][T27909] worker_thread+0xa47/0xfb0 [ 798.178412][T27909] kthread+0x388/0x470 [ 798.182988][T27909] ret_from_fork+0x514/0xb70 [ 798.188091][T27909] ret_from_fork_asm+0x1a/0x30 [ 798.193369][T27909] [ 798.193369][T27909] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 798.201003][T27909] __mutex_lock+0x19d/0x1550 [ 798.206104][T27909] nbd_queue_rq+0x373/0x1150 [ 798.211379][T27909] blk_mq_dispatch_rq_list+0x499/0x1990 [ 798.217542][T27909] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 798.224686][T27909] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 798.231193][T27909] blk_mq_run_work_fn+0x16c/0x300 [ 798.236730][T27909] process_scheduled_works+0xa8e/0x14e0 [ 798.242790][T27909] worker_thread+0xa47/0xfb0 [ 798.248167][T27909] kthread+0x388/0x470 [ 798.252755][T27909] ret_from_fork+0x514/0xb70 [ 798.257967][T27909] ret_from_fork_asm+0x1a/0x30 [ 798.263265][T27909] [ 798.263265][T27909] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 798.270472][T27909] __mutex_lock+0x19d/0x1550 [ 798.275573][T27909] nbd_queue_rq+0xc1/0x1150 [ 798.280585][T27909] blk_mq_dispatch_rq_list+0x499/0x1990 [ 798.286652][T27909] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 798.293487][T27909] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 798.299973][T27909] blk_mq_run_work_fn+0x16c/0x300 [ 798.305515][T27909] process_scheduled_works+0xa8e/0x14e0 [ 798.311577][T27909] worker_thread+0xa47/0xfb0 [ 798.316690][T27909] kthread+0x388/0x470 [ 798.321359][T27909] ret_from_fork+0x514/0xb70 [ 798.326459][T27909] ret_from_fork_asm+0x1a/0x30 [ 798.331735][T27909] [ 798.331735][T27909] -> #4 (set->srcu){.+.+}-{0:0}: [ 798.338847][T27909] __synchronize_srcu+0xc9/0x2f0 [ 798.344293][T27909] elevator_switch+0x1e8/0x7b0 [ 798.349675][T27909] elevator_change+0x2fa/0x480 [ 798.354952][T27909] elevator_set_default+0x375/0x440 [ 798.360667][T27909] blk_register_queue+0x3f3/0x4e0 [ 798.366264][T27909] __add_disk+0x6cb/0xe30 [ 798.371387][T27909] add_disk_fwnode+0xfb/0x4b0 [ 798.376577][T27909] nbd_dev_add+0x733/0xb60 [ 798.381507][T27909] nbd_init+0x15f/0x1e0 [ 798.386254][T27909] do_one_initcall+0x250/0x870 [ 798.391552][T27909] do_initcall_level+0x10a/0x1a0 [ 798.397184][T27909] do_initcalls+0x59/0xa0 [ 798.402049][T27909] kernel_init_freeable+0x29d/0x3e0 [ 798.407762][T27909] kernel_init+0x1d/0x1d0 [ 798.412605][T27909] ret_from_fork+0x514/0xb70 [ 798.417704][T27909] ret_from_fork_asm+0x1a/0x30 [ 798.423157][T27909] [ 798.423157][T27909] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 798.431150][T27909] __mutex_lock+0x19d/0x1550 [ 798.436268][T27909] elevator_change+0x1af/0x480 [ 798.441570][T27909] elevator_set_none+0xb5/0x140 [ 798.446953][T27909] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 798.453282][T27909] nbd_start_device+0x189/0xb30 [ 798.458672][T27909] nbd_genl_connect+0x1597/0x1c10 [ 798.464210][T27909] genl_family_rcv_msg_doit+0x233/0x340 [ 798.470531][T27909] genl_rcv_msg+0x614/0x7a0 [ 798.475546][T27909] netlink_rcv_skb+0x226/0x4a0 [ 798.480815][T27909] genl_rcv+0x28/0x40 [ 798.485362][T27909] netlink_unicast+0x7bb/0x940 [ 798.490824][T27909] netlink_sendmsg+0x813/0xb40 [ 798.496094][T27909] sock_sendmsg_nosec+0x13a/0x180 [ 798.501631][T27909] ____sys_sendmsg+0x54e/0x850 [ 798.506904][T27909] ___sys_sendmsg+0x2a5/0x360 [ 798.512092][T27909] __x64_sys_sendmsg+0x1b1/0x290 [ 798.517625][T27909] do_syscall_64+0x174/0x580 [ 798.522764][T27909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.529615][T27909] [ 798.529615][T27909] -> #2 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 798.538241][T27909] blk_alloc_queue+0x544/0x690 [ 798.543547][T27909] __blk_mq_alloc_disk+0x194/0x390 [ 798.549204][T27909] nbd_dev_add+0x494/0xb60 [ 798.554153][T27909] nbd_init+0x15f/0x1e0 [ 798.558915][T27909] do_one_initcall+0x250/0x870 [ 798.564191][T27909] do_initcall_level+0x10a/0x1a0 [ 798.569644][T27909] do_initcalls+0x59/0xa0 [ 798.574488][T27909] kernel_init_freeable+0x29d/0x3e0 [ 798.580285][T27909] kernel_init+0x1d/0x1d0 [ 798.585145][T27909] ret_from_fork+0x514/0xb70 [ 798.590291][T27909] ret_from_fork_asm+0x1a/0x30 [ 798.595591][T27909] [ 798.595591][T27909] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 798.602815][T27909] fs_reclaim_acquire+0x71/0x100 [ 798.608283][T27909] prepare_alloc_pages+0x15b/0x650 [ 798.614091][T27909] __alloc_frozen_pages_noprof+0x12f/0x380 [ 798.620407][T27909] __alloc_pages_noprof+0x10/0x100 [ 798.626031][T27909] pcpu_populate_chunk+0x181/0xb30 [ 798.631673][T27909] pcpu_alloc_noprof+0xbca/0x1900 [ 798.637222][T27909] xt_percpu_counter_alloc+0x145/0x1e0 [ 798.643272][T27909] translate_table+0x129a/0x1f80 [ 798.648809][T27909] do_ipt_set_ctl+0xa53/0xe20 [ 798.653996][T27909] nf_setsockopt+0x26f/0x290 [ 798.659154][T27909] do_sock_setsockopt+0x17c/0x1b0 [ 798.664775][T27909] __x64_sys_setsockopt+0x13d/0x1b0 [ 798.670571][T27909] do_syscall_64+0x174/0x580 [ 798.675680][T27909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.682116][T27909] [ 798.682116][T27909] -> #0 (pcpu_alloc_mutex){+.+.}-{4:4}: [ 798.689851][T27909] __lock_acquire+0x1520/0x2cf0 [ 798.695414][T27909] lock_acquire+0x106/0x350 [ 798.700442][T27909] __mutex_lock+0x19d/0x1550 [ 798.705623][T27909] pcpu_alloc_noprof+0x231/0x1900 [ 798.711170][T27909] bpf_prog_alloc_no_stats+0x10b/0x4f0 [ 798.717302][T27909] bpf_prog_alloc+0x3c/0x1a0 [ 798.722440][T27909] __get_filter+0xf2/0x420 [ 798.727468][T27909] sk_reuseport_attach_filter+0x24/0x210 [ 798.733618][T27909] sk_setsockopt+0x1ee5/0x2f10 [ 798.738894][T27909] udp_lib_setsockopt+0xbc/0x6b0 [ 798.744346][T27909] udpv6_setsockopt+0x67/0xb0 [ 798.749605][T27909] do_sock_setsockopt+0x17c/0x1b0 [ 798.755146][T27909] __x64_sys_setsockopt+0x13d/0x1b0 [ 798.760853][T27909] do_syscall_64+0x174/0x580 [ 798.765951][T27909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.772440][T27909] [ 798.772440][T27909] other info that might help us debug this: [ 798.772440][T27909] [ 798.782754][T27909] Chain exists of: [ 798.782754][T27909] pcpu_alloc_mutex --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 798.782754][T27909] [ 798.796229][T27909] Possible unsafe locking scenario: [ 798.796229][T27909] [ 798.803689][T27909] CPU0 CPU1 [ 798.809131][T27909] ---- ---- [ 798.814543][T27909] lock(sk_lock-AF_INET6); [ 798.819037][T27909] lock(&nsock->tx_lock); [ 798.825960][T27909] lock(sk_lock-AF_INET6); [ 798.832970][T27909] lock(pcpu_alloc_mutex); [ 798.837461][T27909] [ 798.837461][T27909] *** DEADLOCK *** [ 798.837461][T27909] [ 798.845613][T27909] 1 lock held by syz.1.6834/27909: [ 798.850710][T27909] #0: ffff88805026a660 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sk_setsockopt+0xe6c/0x2f10 [ 798.860433][T27909] [ 798.860433][T27909] stack backtrace: [ 798.866311][T27909] CPU: 1 UID: 0 PID: 27909 Comm: syz.1.6834 Not tainted syzkaller #0 PREEMPT(full) [ 798.866330][T27909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 798.866340][T27909] Call Trace: [ 798.866349][T27909] [ 798.866357][T27909] dump_stack_lvl+0xe8/0x150 [ 798.866379][T27909] print_circular_bug+0x2e1/0x300 [ 798.866401][T27909] check_noncircular+0x12e/0x150 [ 798.866421][T27909] __lock_acquire+0x1520/0x2cf0 [ 798.866443][T27909] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 798.866467][T27909] ? lockdep_hardirqs_on+0x7a/0x110 [ 798.866491][T27909] ? pcpu_alloc_noprof+0x231/0x1900 [ 798.866512][T27909] lock_acquire+0x106/0x350 [ 798.866527][T27909] ? pcpu_alloc_noprof+0x231/0x1900 [ 798.866552][T27909] __mutex_lock+0x19d/0x1550 [ 798.866566][T27909] ? pcpu_alloc_noprof+0x231/0x1900 [ 798.866588][T27909] ? trylock_stock+0xac/0x280 [ 798.866610][T27909] ? lock_acquire+0x106/0x350 [ 798.866624][T27909] ? trylock_stock+0xac/0x280 [ 798.866643][T27909] ? pcpu_alloc_noprof+0x231/0x1900 [ 798.866681][T27909] ? __pfx___mutex_lock+0x10/0x10 [ 798.866698][T27909] ? unlock_stock+0x12e/0x250 [ 798.866718][T27909] ? obj_cgroup_charge+0x15e/0x210 [ 798.866739][T27909] pcpu_alloc_noprof+0x231/0x1900 [ 798.866768][T27909] ? __kmalloc_cache_noprof+0x150/0x660 [ 798.866791][T27909] ? bpf_prog_alloc_no_stats+0xd8/0x4f0 [ 798.866808][T27909] bpf_prog_alloc_no_stats+0x10b/0x4f0 [ 798.866823][T27909] ? bpf_prog_alloc+0x2a/0x1a0 [ 798.866838][T27909] bpf_prog_alloc+0x3c/0x1a0 [ 798.866852][T27909] __get_filter+0xf2/0x420 [ 798.866874][T27909] sk_reuseport_attach_filter+0x24/0x210 [ 798.866895][T27909] sk_setsockopt+0x1ee5/0x2f10 [ 798.866911][T27909] ? __pfx_sk_setsockopt+0x10/0x10 [ 798.866924][T27909] ? futex_wait+0x2a2/0x390 [ 798.866969][T27909] ? __lock_acquire+0x683/0x2cf0 [ 798.866990][T27909] ? aa_sk_perm+0x6d5/0x900 [ 798.867008][T27909] udp_lib_setsockopt+0xbc/0x6b0 [ 798.867027][T27909] ? __pfx_udp_lib_setsockopt+0x10/0x10 [ 798.867045][T27909] ? __fget_files+0x2a/0x420 [ 798.867058][T27909] ? aa_sock_opt_perm+0xff/0x1a0 [ 798.867076][T27909] udpv6_setsockopt+0x67/0xb0 [ 798.867095][T27909] ? __pfx_udp_v6_push_pending_frames+0x10/0x10 [ 798.867114][T27909] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 798.867135][T27909] do_sock_setsockopt+0x17c/0x1b0 [ 798.867153][T27909] __x64_sys_setsockopt+0x13d/0x1b0 [ 798.867169][T27909] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.867184][T27909] do_syscall_64+0x174/0x580 [ 798.867199][T27909] ? clear_bhb_loop+0x40/0x90 [ 798.867216][T27909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 798.867232][T27909] RIP: 0033:0x7fb9d6d9de59 [ 798.867247][T27909] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 798.867261][T27909] RSP: 002b:00007fb9d7b85028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 798.867278][T27909] RAX: ffffffffffffffda RBX: 00007fb9d7026090 RCX: 00007fb9d6d9de59 [ 798.867290][T27909] RDX: 0000000000000033 RSI: 0000000000000001 RDI: 000000000000000c [ 798.867300][T27909] RBP: 00007fb9d6e33e6f R08: 0000000000000010 R09: 0000000000000000 [ 798.867310][T27909] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 798.867321][T27909] R13: 00007fb9d7026128 R14: 00007fb9d7026090 R15: 00007ffe0db714f8 [ 798.867338][T27909] [ 799.126758][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 799.199221][ T36] net_ratelimit: 22 callbacks suppressed [ 799.199251][ T36] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.296755][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.407871][ T48] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.517974][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.626860][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.737076][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.806890][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 799.847465][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 799.957147][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 800.066948][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 800.177895][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 801.276667][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 803.326707][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 804.247581][ T133] net_ratelimit: 36 callbacks suppressed [ 804.247621][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.368581][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.477205][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.586766][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.696776][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.807190][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 804.916689][ T133] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 805.026639][ T14] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 805.136693][ T6719] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 805.246616][ T5785] bond4: (slave ip6gretap1): failed to get link speed/duplex [ 805.406647][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 807.486797][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured!