last executing test programs: 2.246644805s ago: executing program 0 (id=2970): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd2a, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x2b}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$pptp(r1, &(0x7f00000018c0)={0x18, 0x2, {0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x1e) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, 0x0, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {}, {0x8, 0x11, 0x66c}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4800) r4 = socket$netlink(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xb0, 0x1403, 0x8, 0x70bd2a, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'gretap0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'vlan0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'caif0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'team_slave_0\x00'}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2.105436598s ago: executing program 0 (id=2973): r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x80) 2.03353346s ago: executing program 0 (id=2975): sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000000d0a01030000000000000000050000000000020073797a32000000000900020073797a320000000008000400000000000900010073797a30000000000800044000000003"], 0x48}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="140100002000010000000000fbdbdf25040117800c0003"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x8, 0x7, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @dev={0xfe, 0x80, '\x00', 0xf}, 0x80, 0x10, 0x7, 0x6ef87721}}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000140)=0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@bridge_dellink={0x38, 0x11, 0x400, 0x70bd28, 0x25dfdbfd, {0x7, 0x0, 0x0, r2, 0x0, 0x4}, [@IFLA_NET_NS_PID={0x8, 0x13, r3}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0xdb2}, @IFLA_PHYS_SWITCH_ID={0x8, 0x24, "6f520804"}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x6040) 1.901168737s ago: executing program 4 (id=2977): r0 = socket$inet6(0xa, 0x802, 0x88) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f00000003c0)=0x4, 0x4) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x89b0, &(0x7f0000000080)={'bond0\x00', &(0x7f00000000c0)=@ethtool_channels={0x1, 0x7c4d2537, 0x0, 0xfffffffd}}) sendto$inet6(r0, 0x0, 0x0, 0x4, &(0x7f0000000180)={0xa, 0x4e23, 0x90, @mcast2}, 0x1c) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000640)=@ipv6_getaddr={0x94, 0x16, 0x300, 0x70bd28, 0x25dfdbff, {0xa, 0x18, 0x11}, [@IFA_ADDRESS={0x14, 0x1, @local}, @IFA_FLAGS={0x8, 0x8, 0x200}, @IFA_LOCAL={0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x10}}, @IFA_RT_PRIORITY={0x8, 0x9, 0x4}, @IFA_ADDRESS={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @empty}}, @IFA_ADDRESS={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFA_RT_PRIORITY={0x8, 0x9, 0x4}, @IFA_CACHEINFO={0x14, 0x6, {0xfffffffb, 0x5, 0xf5, 0x2}}]}, 0x94}}, 0x40) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000000)=ANY=[@ANYRESDEC=r0], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e000100fdffffff00000000ff00", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\n\x00'], 0x28}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000006d0001000000000000000000003c0000", @ANYRES32=r8, @ANYBLOB="000000000000000018003480140035"], 0x38}}, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSMAXCID(r7, 0x40047451, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x2800, &(0x7f0000000080)={&(0x7f00000001c0)={0x54, r6, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_BEARER_SET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010028bd7000fddbdf2505000000280001800d0001007564703a73797a32000000001400028008000200f6010000080001000b00000078dea1bdfbd8fff2eb84f156f0fe19dbe2d50e3751cdced1b4254ba27c1e132624393b240f2152577db01c293c0b1d2bd4f9966361e7f6a7d340104f4b09d30bb19a9950187cf33511e0bfcd082bcf1e2275a307e20aadb4766a0cf6bab7de2b4f09bab4"], 0x3c}, 0x1, 0x0, 0x0, 0x4c445}, 0x4040140) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x66, &(0x7f00000004c0)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0xb, 0x0, 0x0, 0x4, 0x6558}, {0x0, 0x0, 0x0, 0x0, 0x11}, {}, {0x8, 0x88be, 0x1000002, {{0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0xfffff788}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0xffff}}}, {0x8, 0x6558, 0xfffffffe}}}}}}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x300, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x7d}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r12 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x18, r12, 0xf13, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x4}]}, 0x18}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0x2c, r12, 0x200, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x4}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8134}, 0x8040) 1.811528916s ago: executing program 0 (id=2979): r0 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x30, r0, 0x1, 0x0, 0xffffffea, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x0) 1.689891657s ago: executing program 0 (id=2982): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000005b80)=@delchain={0x24, 0x26, 0x100, 0x70bd28, 0x100000, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff1}, {0xc, 0x8}, {0xb}}}, 0x24}}, 0x0) recvmmsg(r1, &(0x7f0000004880)=[{{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x9}], 0x3, 0x2100, 0x0) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000000), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000ffdbdf250700000014000200fe80000000000000000000000000004208000400ac1414bb140003"], 0x44}, 0x1, 0x0, 0x0, 0x24080850}, 0xc010) socket$inet6(0xa, 0x5, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0xffc5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="650a00000000000061112800000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x90) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073"], 0x7c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000500)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="280000001d000100000000000400000007000000", @ANYRES32=r8, @ANYBLOB="800002000a0002"], 0x28}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000020900e2216f9b7a310000000034000000030a01020000000000000000010000000900030073797a320000000008000a40000000040900010073797a31000000002c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000000140000001100010000000000000000000500000a"], 0xa8}}, 0x0) socket$inet_sctp(0x2, 0x4, 0x84) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.kill\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000005, 0x12, r10, 0x43018000) ioctl$FIBMAP(r10, 0x1, 0x0) write$cgroup_subtree(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="ee6f86b1e90671e110a6ea2db30862", @ANYRES8=r6, @ANYRESHEX=r5], 0x10448) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r11 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2010, r11, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r4, 0x84, 0x65, &(0x7f0000000440)=[@in6={0xa, 0x4e21, 0x3, @mcast1, 0x400}, @in6={0xa, 0x4e21, 0xe1b3, @local, 0x3}, @in={0x2, 0x4e23, @multicast2}, @in6={0xa, 0x4e22, 0x21d, @dev={0xfe, 0x80, '\x00', 0x18}, 0x7}, @in6={0xa, 0x4e21, 0x6, @mcast1, 0xe2}], 0x80) 1.389543466s ago: executing program 4 (id=2986): r0 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x4}, 0x68) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000180)={0x14, 0x13, 0x1, 0x0, 0x0, "", [@typed={0x6}]}, 0x14}], 0x1}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000001a00010000000000000000008180806a"], 0x30}}, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0xe8, r3, 0x20, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x7}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x3ff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9d2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffe01}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x5f}]}, @TIPC_NLA_PUBL={0x44, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x10}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x401}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xeb4}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3}]}, @TIPC_NLA_SOCK={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x8000}, 0x42) 1.144550378s ago: executing program 1 (id=2987): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYRES32=0xffffffffffffffff], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a}, 0x94) close(r0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000380)="4c22cd3b", 0x4}], 0x1}, 0xc4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000440)=ANY=[@ANYRES32=r4, @ANYRES16=r1, @ANYRESHEX=r4], 0x10) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f00000002c0)=r0}, 0x20) (async) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) (async) recvmsg$unix(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000800)=""/231, 0xe7}], 0x1}, 0x42) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r6 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r6, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket(0x40000000015, 0x5, 0x0) connect$inet(r8, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) (async) setsockopt$SO_RDS_TRANSPORT(r8, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f00006dbffc), 0x4) (async) bind$inet(r8, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) (async) setsockopt$RDS_CONG_MONITOR(r8, 0x114, 0x6, 0x0, 0x0) (async) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) (async) sendmsg$NL80211_CMD_JOIN_MESH(r8, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) (async) r9 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f0000000000)={0x30000001}) r10 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), r7) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="050427bd0008000000000000000002000000eb0000000000006323a7db00", @ANYRES32=r11, @ANYBLOB="3c00028038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000050003000300000008000400ffff0000"], 0x58}, 0x1, 0x0, 0x0, 0x20000401}, 0x44084) (async) socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'lo\x00'}) 1.057656964s ago: executing program 4 (id=2989): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000b800000095"], &(0x7f00000008c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x90) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000240)={0x4, {{0xa, 0x4e22, 0x80000001, @rand_addr=' \x01\x00', 0x1000}}}, 0x88) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x30, r3, 0x1, 0x70bd29, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x41, 0x60}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x39a}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_FLUSH_PMKSA(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r3, 0x10, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}}, 0x40) 881.813788ms ago: executing program 2 (id=2991): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073113600000000008510000002000000850000007600000095000810000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6}, 0x70) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000b00), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), r3) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x1c}}, 0x0) (async) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x19, 0x4, 0x8, 0x6}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000020000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000fbffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000900)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x118, r4, 0x10, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffff7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1ff}, @IPVS_CMD_ATTR_DEST={0x40, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x596}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1000}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6tnl0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xd9}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xea48}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x5}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x48800}, 0x0) (async) r6 = socket$kcm(0x15, 0x5, 0x0) sendmsg$inet(r6, &(0x7f0000000cc0)={&(0x7f00000004c0)={0xa, 0x0, @multicast2}, 0x10, 0x0}, 0x4000000) sendmsg$DEVLINK_CMD_GET(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000b40)={0x34, r2, 0x1, 0x70bd28, 0x25dfdbfc, {}, [@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20004004}, 0x20000000) (async) sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xec, r2, 0x400, 0x70bd2d, 0x25dfdbfe, {}, [{{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0xec}, 0x1, 0x0, 0x0, 0x4001}, 0x8000) 817.107323ms ago: executing program 4 (id=2992): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = accept(r0, &(0x7f0000000140)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f0000000040)=0x80) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000280)=0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@empty, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@private}}, &(0x7f00000005c0)=0xe8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) r8 = syz_open_procfs$namespace(r5, &(0x7f0000001780)='ns/ipc\x00') r9 = getpid() r10 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) setsockopt$llc_int(r10, 0x10c, 0x8, &(0x7f0000000200)=0x7b8d, 0x4) sendmmsg$unix(r4, &(0x7f0000001b00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@cred={{0x1c, 0x1, 0x2, {r5, 0x0, 0xee00}}}], 0x20, 0x4044014}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000001bc0)=[@cred={{0x1c, 0x1, 0x2, {r5, 0x0, r7}}}, @cred={{0x1c, 0x1, 0x2, {r9, r6}}}, @rights={{0x18, 0x1, 0x1, [r8, 0xffffffffffffffff]}}], 0x58, 0x800}}], 0x2, 0x0) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r11, 0x0) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x8, 0x42, 0x40, 0x42}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r12}, 0x4) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x1003, r12}, 0x38) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r11, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r11, 0x84, 0x66, &(0x7f0000000980)={r13, 0x9}, &(0x7f00000009c0)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r11, 0x84, 0x9, &(0x7f00000000c0)={r13, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2, 0x40000002, 0x0, 0xa17433da3c5d69a5, 0x2, 0x81}, 0x9c) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000600)={0x0}, &(0x7f0000000640)=0xc) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000680)=0x0) r16 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r16, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r17 = getgid() ioctl$TUNSETGROUP(r16, 0x400454ce, r17) sendmsg$unix(r1, &(0x7f0000000700)={&(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000240)=[{&(0x7f0000000300)="39658e44bef7880ed6e62638bebb2412b493b3e77e58e79ca15092598f5218dfad988e447b405c29f31b9227f148af63aa241331729e517eca7017e19a3952295bf0ffcb640e535006e7c99366ae4aa4ff2afa1aac8aea27e2571bb2437dc4dbfe0b27915565a7f777ebee83e1384adcffdbcd60e9337c646f299ce7c06bca0fdeb485a5aeb9961977d587bced3f7e77ab025c6c0e5880b1ab970d70c54f156ffab7935842b82235c925055d08c3", 0xae}, {&(0x7f00000003c0)="7841fc7f280fcdd72686415557851e0c8a29663319be396db31ede5a73fb5f61ef44920efc164b9dae1e603f53dec9fc6cc8d96ba361b34bf60258bd914876eb56ac2da1702d941facb6b9959a9f3cf93a059ef6a44a041b87e0d9a95aa8326ea84aafcc4cbb2e32f29244fcf6be2244285cf807ea20f7d4811b02b992cd67c375b2e41029f770d5b16f8843adb13c628c011be0689e3678ee47a8c3e5aa2f1be2aca8e10058b81fc229c088a37ddce9768acd7b4869a3ad1f8e2d53ecb2c2105124f65842f18f632070621d9107", 0xce}], 0x2, &(0x7f00000006c0)=[@cred={{0x1c, 0x1, 0x2, {r2, r3, r7}}}, @cred={{0x1c, 0x1, 0x2, {r14, r15, r17}}}], 0x40, 0x20008010}, 0x40804) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB="4400000010000104000002000000000000000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000140012800b0001006970766c616e000038fd028008000500", @ANYRES32=r18, @ANYBLOB='\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="b61c924708a8739fc7be5cc11db9c1977f0223cf2ce277ff6c7a2989ab474746fecf9cb93d1b07537c0c49e40bcd55cd54593511d11fd012e2f40e74c383fbba9deefc528d73ef4f5b2c41bae8b523ca1e51fd8f45de3e4b91ad5e4ca9a843b274c2d6d1820fc574e97bf60527b817dd92e4f6954b73811727fcb780e8d817e1fbecaeb3eaa5cb05afebc8a38c153709ad606c2bef0699668b956ac27b6dec769ed0f08fad0e55e414e42ee3261a795b2bd1564921fea886e18b87eb8ca28bd3ec5df92dab61252ee16e4365d08f3618cd21160948d976a158840627"], 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x0) 741.835242ms ago: executing program 3 (id=2993): r0 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001a80)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe50a10a000600014002020c600e41b0000900ac000a0501000000160012000a00ff120048035c3b61c1d67f6f94007134cf6efb8007a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x894) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{0x0, 0x114}], 0x1}, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r6 = socket(0x400000000010, 0x3, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="5200000002"], 0x8) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r7}, 0x8) r8 = socket$unix(0x1, 0x1, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000380)=0x8, 0x4) unshare(0x6020400) r9 = socket(0x10, 0x80002, 0x0) r10 = accept4$netrom(r3, &(0x7f0000000140)={{0x3, @bcast}, [@rose, @null, @null, @bcast, @default, @null, @default, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) getpeername$netrom(r10, &(0x7f0000000280)={{0x3, @netrom}, [@default, @null, @rose, @null, @null, @netrom, @netrom, @null]}, &(0x7f0000000340)=0x48) connect$netlink(r9, &(0x7f00000014c0)=@proc, 0xa) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=@gettaction={0xbc, 0x32, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x40, 0x1, [{0x10, 0xd, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x1, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0xf, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x68, 0x1, [{0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xf0}}, {0x14, 0x1f, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fff}}, {0xc, 0xc, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x1e, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x9, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0xbc}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) clock_gettime(0x23eaa8d54bacd65c, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0x0, 0xf}, {}, {0x7, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000014}, 0x20084084) 729.850693ms ago: executing program 2 (id=2994): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069108e0000000000bc001000000000009500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x90, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'dvmrp0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x40}, 0x1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000600)=@getsa={0x34, 0x12, 0x1, 0x0, 0x0, {@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x0, 0xff}, [@mark={0xc}]}, 0x34}}, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r4, 0x8933, &(0x7f0000000100)) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x28, r3, 0x1, 0x2000000, 0x0, {{}, {}, {0xc, 0x13, @l2={'ib', 0x3a, 'sit0\x00'}}}}, 0x28}}, 0x0) pread64(r0, &(0x7f0000000000)=""/196, 0xc4, 0xfffffffffffff801) syz_emit_ethernet(0xe7, &(0x7f0000000280)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xd9, 0x0, 0x0, 0xfd, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x5, 0x0, 0x0, 0x5, 0x1, {0x2f, 0x4, 0x0, 0x9, 0x686, 0x67, 0xfff9, 0x7, 0x2f, 0x1000, @multicast1, @rand_addr=0x64010102, {[@timestamp_prespec={0x44, 0x4, 0xc7, 0x3, 0xc}, @timestamp_addr={0x44, 0x14, 0xf2, 0x1, 0x2, [{@initdev={0xac, 0x1e, 0x0, 0x0}}, {@broadcast, 0x6}]}, @ssrr={0x89, 0x23, 0x5f, [@multicast1, @remote, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @multicast1, @remote, @local]}, @lsrr={0x83, 0x1b, 0xf7, [@remote, @multicast2, @private=0xa010102, @multicast2, @multicast1, @dev={0xac, 0x14, 0x14, 0x35}]}, @timestamp={0x44, 0x20, 0xb3, 0x0, 0xd, [0x2, 0xd, 0x8, 0x80000001, 0xffffffff, 0x5, 0xb2a0]}, @lsrr={0x83, 0x2f, 0x71, [@empty, @local, @multicast2, @dev={0xac, 0x14, 0x14, 0x41}, @local, @dev={0xac, 0x14, 0x14, 0x32}, @multicast2, @dev={0xac, 0x14, 0x14, 0x15}, @rand_addr=0x64010100, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x39}]}]}}, "bc"}}}}}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000400)={0x0, 'ip6gre0\x00', {0x4}, 0x4}) 620.156307ms ago: executing program 0 (id=2995): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r2, &(0x7f0000000140)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x4}, 0xa) ppoll(&(0x7f0000000080)=[{r2, 0x2}], 0x1, &(0x7f00000000c0)={0x0, 0x3938700}, 0x0, 0x0) setsockopt$inet_int(r1, 0x0, 0xb, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}}}}}}, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000004000000020000000000001103000000ffffffff000000000100000d010000000000000001000000020000000000000802000000000061"], 0x0, 0x4c}, 0x20) setsockopt$MRT_INIT(r3, 0x0, 0xc8, &(0x7f0000003d40), 0x4) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=@newsa={0xfc, 0x10, 0x713, 0x70bd25, 0x0, {{@in=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@mcast2, 0x0, 0x3c}, @in=@local, {0x200000, 0x0, 0xffffffffffff7fff, 0x2000}, {}, {}, 0x0, 0x0, 0x2}, [@offload={0xc, 0x1c, {0x0, 0x3}}]}, 0xfc}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r7, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) writev(r6, &(0x7f0000000240)=[{&(0x7f00000000c0)}, {&(0x7f0000000200)="fbe04481999f6961ce53b1aaded717025b8c6a5b0e6ecaa36c9b2167cd248ac498d1", 0x22}], 0x2) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@newtfilter={0x2c, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r7, {0xfff3, 0x10}, {0xfff1, 0x9}, {0x2, 0x8}}, [@TCA_CHAIN={0x8, 0xb, 0x2}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x48044}, 0x40000) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r8, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x58, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d81b0fa, 0xc574450d1af3b5bc}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_TO_UCAST={0x5, 0x1c, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044010}, 0x40) 619.560799ms ago: executing program 1 (id=2996): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000001c0)={r1, 0x2}, 0x8) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000840)='ns/time_for_children\x00') (async) r3 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@dev={0xfe, 0x80, '\x00', 0x16}, 0x0, 0x2, 0x3, 0x4, 0x8, 0xf}, 0x20) (async) ioctl$NS_GET_OWNER_UID(r2, 0x8008b70d, 0x0) (async) r4 = socket(0x2d, 0x2, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x6a98cf64}, 0x10}, 0x94) (async) r5 = socket$l2tp(0x2, 0x2, 0x73) sendto$l2tp(r5, 0x0, 0x43, 0x0, &(0x7f0000000100)={0x2, 0x0, @broadcast, 0x4}, 0x10) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0x7, &(0x7f0000000280)={0x7, 0x0, 0x4, 0x4}, 0x10) (async) recvmmsg(r6, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)=""/149, 0x95}, {&(0x7f0000001340)=""/4051, 0xfd3}, {&(0x7f0000000040)=""/114, 0x72}], 0x3}, 0x1}], 0x1, 0x0, 0x0) (async) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000000)={r4}) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f00000002c0)={'wg0\x00'}) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f00000003c0)={'gre0\x00', &(0x7f0000000300)={'erspan0\x00', 0x0, 0x1, 0x8000, 0x10, 0x4, {{0x1b, 0x4, 0x1, 0x26, 0x6c, 0x66, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x16}, @remote, {[@cipso={0x86, 0xf, 0x3, [{0x5, 0x4, "47ae"}, {0x6, 0x5, "c2fc40"}]}, @cipso={0x86, 0x3c, 0x2, [{0x5, 0x7, "bf82a46d2e"}, {0x7, 0x6, "58cf4deb"}, {0x0, 0xf, "cab8b0ce61e8876c92cdcee96b"}, {0x2, 0x8, "f28e9f6b7da9"}, {0x6, 0x12, "e01ef3471c0589a7cb319de8ff3ccdf2"}]}, @generic={0x83, 0x8, "683cda732c90"}, @generic={0x7, 0x4, "9848"}]}}}}}) (async) r9 = socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="480000001000010010000000ffdbdf2500000000", @ANYRES32=r11, @ANYBLOB="20000000280e0400280012800b0001006d61637365630000180002800500030008"], 0x48}, 0x1, 0x0, 0x0, 0x24008001}, 0x0) getsockopt$SO_TIMESTAMPING(r8, 0x1, 0x25, &(0x7f0000000580), &(0x7f00000005c0)=0x4) (async) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000480)={'ip6_vti0\x00', &(0x7f0000000400)={'ip6tnl0\x00', 0x0, 0x29, 0x6, 0x1, 0x6, 0x10, @dev={0xfe, 0x80, '\x00', 0x33}, @private2={0xfc, 0x2, '\x00', 0x1}, 0x700, 0x7800, 0xc1, 0x5}}) r12 = socket(0x2d, 0x2, 0x0) bind$xdp(r12, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) connect$qrtr(r12, &(0x7f0000000300)={0x2d, 0x1, 0x4001}, 0xc) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'pimreg\x00'}) 489.36762ms ago: executing program 2 (id=2997): r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r0, &(0x7f0000000100)='reno\x00', 0x5) write$tcp_congestion(r0, &(0x7f0000000300)='reno\x00', 0x5) r1 = socket$inet6(0xa, 0x80002, 0x88) sendmmsg$inet(r1, &(0x7f0000003b40)=[{{&(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10, 0x0}}, {{&(0x7f0000001b00)={0x2, 0x4e22, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000037c0)=[@ip_ttl={{0x10, 0x0, 0x2, 0x10001}}], 0x10}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0xc4}}], 0x3, 0x40000) 487.903226ms ago: executing program 1 (id=2998): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x100}) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)={0x28, r1, 0x1, 0x60000000, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(0x0, r2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) 483.309026ms ago: executing program 2 (id=2999): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x24, 0x14, 0x65c28d33709e660d, 0x0, 0x0, {0x11, 0x36}, [@INET_DIAG_REQ_BYTECODE={0xd, 0x1, "91fabc0b03e55e3719"}]}, 0x24}}, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000180)={0xfffffc}, 0x10) write(r1, &(0x7f0000000000)="240000001a005f0214f9f407000901000000000000000005000000000800040001000000", 0x24) 465.433333ms ago: executing program 3 (id=3000): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELRULE={0x20, 0x8, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x14}}, 0x0) 410.150535ms ago: executing program 4 (id=3001): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x5, 0x7, 0x4932, 0x7f, 0x1, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0xca, r0}, 0x38) ioctl$F2FS_IOC_DEFRAGMENT(r0, 0xc010f508, &(0x7f0000000000)={0x2, 0x180001}) 409.944394ms ago: executing program 2 (id=3002): r0 = socket(0x21, 0x3, 0x10200) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$inet6(0xa, 0x800, 0x1000) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'syzkaller1\x00', &(0x7f0000000140)=@ethtool_cmd={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800feea, [0x1]}}) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000006c0)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x4, 0x8002}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) 383.162264ms ago: executing program 1 (id=3003): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000800)=ANY=[@ANYBLOB="611234000000003061134c0000000000bf3000000000000015000200000000103d030100000000009500000000000000bc26080000000000bf67000000000000070300000fff07006702000003000000160600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f909ad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305865050df26469fac5202d6293c3d5e11f4f83e7455baeeba4f"], &(0x7f0000000100)='GPL\x00'}, 0x48) 324.445921ms ago: executing program 3 (id=3004): openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="b8000000190001000000000000000000dc020078000000000000000000000000ff02000000000000e26ea7250000000100000000000000000a"], 0xb8}, 0x1, 0x0, 0x0, 0x20000080}, 0x2000004) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="650100001b"], 0x188}}, 0x48090) 261.37555ms ago: executing program 4 (id=3005): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x60, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x4c, 0x1, [@m_sample={0x48, 0xe, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0xc}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x1}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x4}}}}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x8085}, 0x20040000) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="030700000000000000000800000068000480040007801300010062726f6164636173742d6c696e6b00001900078008000300000000000800020000000000080003000000000008000200000000000800030000000000040004"], 0x7c}}, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x800) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a50000000060a0b0400000000000000000200000024000480200001800a00010071756f7461000000100002800c03004000000000400000030900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x78}}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200)=0xffffffffffffffff, 0x12) sendfile(r5, r4, 0x0, 0xbdc4) r6 = socket(0x10, 0x803, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x100, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x94, 0x2c, 0xd27, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0xf, 0xfff3}, {}, {0x8, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x54, 0x2, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6fe2}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0xb380, 0x4, 0x0, 0x100d87, 0x6}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x8880}, 0x0) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c000000190a0102"], 0x2c}, 0x1, 0x0, 0x0, 0x24008810}, 0x2404c045) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmmsg$alg(r10, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000400)="552daed3", 0x4}, {&(0x7f0000000600)="3f28e5487621f07da0862a2c3f644e3d27125d57201ccfc0597af94301f04535f4c81762423e42cc4c5e255201526fdcff26810ced87e5a830787448ea0173e02a80ec632fa272625a48bc70bd75eeb6bfd7c5eb0f694f24131894a06aeb05210f621358bbc7d9e10e3c291f36b7edd1a88c295b9e2969a239c8fd67f12dab0330494164bf152099f66ce5e7235526d64bca30ff7c394b1b6564d4c020cd0863a469b81cd061e0c4780f66b3e3b57e15c511b6d188784cd81678ae34a354f16f76bbc843", 0xc4}, {&(0x7f0000000540)="7da6a9b53a58f47d6009573edbf982d3c749d2ff52a20153bd305ee46b6b9bd5ec280e799f5ff396198c58de9b174ae84c3f33273569d9d8b7c86ace97b9a0e63a1db517b1583fedab3e5ae8506929afb98d58be56fdbba84916f862304213e33c0c4d84bef1eee65b85b6a29bb6e82fc3a3281f6cde75605c9c2e9fa46eca", 0x7f}], 0x3, &(0x7f0000000840)=[@op={0x18}, @iv={0xa0, 0x117, 0x2, 0x8b, "33ca6a1c18f5586aab6ecaac6b3ebe91added72c7e78ac54ed203b7c87d0e221f0e7aeb31e3e30628b6a17572148e28469b15a896941b962ade4a1178d4bf17b4cfb3f9869db86efda2b9ea37790398b020b26c46e51ae772d90c1144704df39ae2a7d91efa4360c7ca2b9c6becf692e825330e94b63048567577c9cb9a6213d7ac5202fd8be42e8d3a4c4"}], 0xb8, 0x804}, {0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000900)="ce685fa60b6aa4aeee1936e495215461e45ebdcc2485f841faa96cd9661835b09a7afc0ec0bd8f3c7970fc324706352f097c7d07c5abad17124d4cfbf18678da116e538591847f4da939247b5bf32e90c8b89f7545e9fe928cc8340dd912349ded9e226897f754ee6d41fd3ccd48aaac2c246805b512d6707b408b0d9596de95d7ae2ffaa965d0ee04fef4fb3fd2264e30212bc2bdc4aa38522aecf6ea8b8e87de6c69c6fe480805769fe26e117231d7f5cea38a6d757268af2be20acb35cfab4be913922d501050ee1b8f149264c70b", 0xd0}, {&(0x7f0000000a00)="1a6813424d06e6446bd1b372359cd971b49077f658def15a53ed9ccc82cf49a948bcd66a7edf84364f72b4aecebac819a20599e4be4c4064a81490fb8491ef36680aafd45dcbbf7a17a80d30bb14c8133ce1ea96af138322b9b17c91e3e43eceed7e377857801fc97cafeeb0ea696270fb68cf02ecf20bd020c23b59772db370a743c1e364b915d5fa678401a72f27ab358ed141dc2da3131d5a18465bd25778fa205f62238526e2e376eafd", 0xac}, {&(0x7f0000000ac0)="6356b0f36dbfc0e4693bc722ef9debd569d743bf5e331f4712d7374b20aa0c220f121d437b4cd408121bba8eb4adf4bce2c9239a76a7aae46925c290f08268b3bf7638f8a83cd2cc43d86236e13d76f7555250bffdee281a9908c0e751e7474a837cfc8a032afbba04829b333edd4cf4faba9615e0a7b2675a9b0c5049b024e6d6f53a38", 0x84}, {&(0x7f0000000b80)="78ed11d6628fd96c5e3fa9db909cefe511aeb5568bbe8c45a5363a47445effda5caf1f4eb48ad274db87e2a5106deae0fcce85be37e3e96081f7750fbbb23d78aff888bf98c254afe591bf15f61cc6174f04fbb7720c27e08c5a7b12e870d27df0f96a1bbbe5e506edf4d0bb86133c859a7d79358fc9e0d6cf6539b7b09cdb9382582aeaab1a073edc8c29025e0a7f0c0de05bc23ffd000c3f5bfb5cc30d086d43c26dca66dbe863ab9754fb1bd507150816ec2eee2ca14c162579c17789", 0xbe}, {&(0x7f0000000c40)="21376d6c3d1ca6d0b974890f69247d5ed9d86e41cbb9eca6f2feb821ad02ec1c16d8dae6358209720c4041a7c25654e7b1ef0e29bb1d4ab6bbf8039f1a564694d66c0d3e273e7fc771446baca1d291a082b946a50edac380f16df9ebe18a0b752540191e978c87f2c09f4d8a9165e51ec781d2c1e927ace69018599b684bdb3a50bc228abab2320ac9b44c793991c2aeff6b3c6d677c1dc8889658f9b569067bf7188bb2f79d16", 0xa7}, {&(0x7f0000000d00)="2be7453c92f808a1784b76faae1a29d6ba513626bfa8542ff5c773ae1fa5bde37030081dfb5dff08189a968469afd8f4f8054bfd8adc2da2961bb62ab47de69fbd3f28c61d423e29f1cc0d0b0f0ee126263df803ab28257005744afff9c41046d9249b0f", 0x64}, {&(0x7f0000000d80)="98226b2e9ca00a276a68f6ce2a09e69aa0fb5ddeb78f567e36be1655cd4afff44e24fb9141a518852a84bdf4975f67036b7ec2d7b0da2c80de937a46c53bb0ba98fdfdc18ff23e3eaa3d14e9749ed478e5ef28e385d218d3412cf7d909a4a47ee6276b06ded70b6fbc2951b48c20eaa162b5119e361ba6a1272d3a431bb236d65c0c6b3bde99090003ec6f", 0x8b}], 0x7, &(0x7f0000000ec0)=ANY=[@ANYBLOB="f0000000000000001701000002000000d5000000cdcb47d3db5d726327f4e99a7ab5304ea44a3f3d434c503ca98ae6209841175656021eebd635fdcfe6273b16228e2d1266d9b0d32f161bcc9e236d80ccf4edbfa1daef4569fa6eedeb15cb624c8fd7e415a24396b70ef8f8882e12a6b716ad59e5d7b214f804df9cac39797e9d29a15bffce5521ce5efdc8f676002e9263f575443c726c782d3429c87275db37e9415cdff85eebf6ea51dafacb1ec2100c6cbfb400e3f4ed3c6d804659c509a07553315aaa6324c6ffa641561c5e2f6c5ce728053b1a6760abb2c7b9a63866d378ade727bae1cf2b0000000000000018000000000000001701000004000000800100000000000018000000000000001701000003000000010000000000000018000000000000001701000004000000010000000000000000010000000000001701000002000000ec000000a70974d1daaf8c702ee8ecd69fa4c647908ab088a3e49b34aabaa60a4d6bb08e4271978c69067bdca50a54ccca6b4f097ff410a0f54a6c3bd6c72f03eb9ec73af0cc3e60c3ea173f29cbd2664d566b4f721751734a4f9d218ce3def8ca6746d8b4302ecc5f222c08570c0ef290c7e6a07ed2de43a863970c4059acac7324e0cd6aa49ebfb825a55bd1602e22da99eee25f3926f2599723737c74c68b426ef8fe93fb8c916c0d10dac0db1c50212c2f147000b8658cd87896231268dc8a0f1a23923c054f365e8bc20bf302ce6294bd3f5d7031c6e658a6a4a95ce8d7457f65f12b68fbf8f4099434d7bb7288d8000000000000001701000002000000bd00000088d0424d6d18a84406727025aafbd5a2b8a744c51b09a2545e9f9228d60ed06e58830770783d5871642008146cb5321e0d0ccb3b6a21a0e25cc39cf9e4b48a7f9902e1461072582e5e617723270ef763291224998e861db5731aadd29fc015ef7cc710b6e0c378fbb6764572738e7a91af6b254e27d057bbd9ff26ecdefcb7d726cfbee0eda22ded74dc32698055b8bbd03bf8870e914cadd64983a6fde81caec6ee03e6b6150e28c447a7962bf2c0c12af982c75404c071d346ab8ae100000000000000180000000000000017010000040000008000000000000000180000000000000017010000040000000100000000000000"], 0x340, 0x800}], 0x2, 0x4001) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 232.159517ms ago: executing program 3 (id=3006): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r1, 0x10c, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x874, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0x840, 0x2, [@TCA_MATCHALL_ACT={0x83c, 0x2, [@m_police={0x838, 0x1, 0x0, 0x0, {{0xb}, {0x80c, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x1ff, 0x3, 0x10000, 0x81, 0x7f, 0xfffffffb, 0x4, 0x2, 0xffffffc0, 0x5, 0x2234, 0x7f, 0x81b, 0x800, 0x5, 0x0, 0x3, 0x7ed53619, 0x1, 0x2, 0x9644, 0x4, 0x58b, 0x85a, 0x3ff, 0x9, 0x2, 0x1, 0x0, 0x80000000, 0x10001, 0x790, 0x5, 0xab2, 0xfffffff9, 0x1a77, 0x9, 0x3, 0x400, 0x63c, 0x4, 0xffffffff, 0x1, 0x5, 0x1, 0x5b1f, 0x7b0, 0x7, 0x100, 0x6, 0xd, 0xff, 0x3, 0x10000, 0x6, 0x6b7, 0x1ff, 0x80, 0x4, 0x7, 0x3, 0xa14, 0x3, 0x2, 0x80000000, 0x81, 0x7, 0x8, 0x5, 0x10001, 0xf7, 0x3, 0xfffffff9, 0x9, 0x4, 0x8, 0xfff, 0x3, 0x1, 0x6, 0x7, 0x8, 0x100, 0xc0000000, 0x6, 0x6, 0x6, 0x12a, 0x80000001, 0x8, 0x1d24, 0x2, 0x9, 0x0, 0x7f, 0x7, 0x863c, 0xff, 0x24, 0x5, 0x7, 0x6, 0x7a, 0x8, 0x0, 0x7, 0x470, 0x7f, 0x6, 0x0, 0x1, 0x0, 0x4, 0x9, 0x61, 0x200, 0x6, 0x2, 0x2, 0x6, 0x10001, 0x8, 0x7, 0xf, 0xda56, 0x7ffffffe, 0x80, 0x2f0cb955, 0x7, 0xfed, 0xf, 0x6ae, 0x2, 0x1, 0x9, 0x8001, 0x0, 0xec000, 0x0, 0x1, 0x2, 0xfffffffb, 0x7, 0x8, 0x4, 0x1, 0xffffcf1b, 0x282, 0x5517bc7b, 0x3, 0x4, 0xb6b, 0x5, 0x0, 0xac, 0x9, 0x6, 0x10, 0x9, 0x8, 0x80000001, 0x0, 0x74, 0x2, 0x7fffffff, 0x0, 0xa, 0x6, 0xffffffff, 0x8, 0x2, 0x7, 0x7f, 0x5, 0x3, 0xa, 0x1, 0x0, 0x9, 0x300, 0x5, 0x3, 0x6, 0xffffffff, 0xffb, 0xff, 0x5, 0x8, 0x3, 0x2, 0x5, 0xfca, 0x399d, 0x6, 0x8ab6, 0x18000, 0x2, 0xfffffff9, 0x2, 0x2, 0x528c, 0x5, 0x200, 0xac, 0xf, 0xd05, 0x9a2ce73, 0x4, 0x6, 0xe074, 0x6b10, 0x5, 0x1, 0x6, 0xb, 0xa26, 0xaf6, 0x0, 0xec, 0x8, 0xde16, 0xc418, 0xffffffff, 0xffffffff, 0x9, 0x400, 0x80001, 0x5, 0x354d, 0x5, 0x2, 0x1, 0x2007, 0x1, 0x177, 0x7, 0x0, 0x80, 0x5, 0x8, 0xfffffffb, 0x9, 0xe7b, 0x0, 0x7, 0x42bf, 0x10000, 0x9, 0x9, 0x6, 0x4b75, 0x80000001, 0x1000, 0x5915, 0x10001, 0x1]}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1080, 0x4, 0xec2, 0x6, 0x8, 0x400, 0x5, 0x1, 0x7, 0x470, 0x487, 0x100, 0xa99, 0xffffff01, 0x5, 0x37f, 0x30, 0x6, 0x3, 0x3, 0x800, 0xd2f5, 0x40, 0x4, 0x4, 0x5, 0x7, 0x12, 0x2, 0x8, 0x101, 0xffffffff, 0x2, 0x10000, 0xa6, 0x3, 0x10000, 0x5, 0x4, 0x0, 0x3, 0x0, 0xd, 0x40006, 0x98, 0x8, 0x6, 0x9, 0x1000, 0xb3000, 0xf, 0x3, 0x9, 0xb4, 0x94d, 0x9, 0x8, 0x6, 0x100, 0xec0, 0xffff, 0x4, 0x2, 0x3ff, 0x3e, 0xb828, 0x0, 0x0, 0x365, 0x8, 0x8, 0xf, 0x1, 0xfffffffe, 0xfffffff6, 0x93, 0x7ff, 0x92, 0x0, 0x7, 0xfffffffc, 0x7ff, 0x9, 0x2, 0x0, 0x2, 0x8, 0x4, 0x3, 0x9, 0xc, 0x0, 0x3, 0x3, 0x400, 0x100000, 0x7f, 0x2, 0x8, 0x4, 0x7, 0x4, 0x7, 0xfffffffa, 0x101, 0xadd9, 0x1, 0x0, 0x7, 0x7fffffff, 0x2, 0x4, 0x0, 0x9, 0x4, 0x3, 0x8, 0x9, 0x6, 0x6, 0x2, 0xb, 0x3, 0x7f, 0xffff, 0x401, 0x1685, 0xa252, 0x2, 0x200, 0x3, 0x1, 0x400, 0xfffffffc, 0xfffffffc, 0x1000, 0x7ff, 0x1, 0x1f6, 0x751, 0x7, 0x40000000, 0x4, 0xffffdbb7, 0x50, 0xf, 0xf, 0xe, 0x3, 0x0, 0x81, 0xfff80000, 0x7a7, 0x1, 0x6, 0x3, 0x8, 0x7, 0x5, 0x2, 0x0, 0x4e8, 0x80, 0x3, 0x8, 0x5, 0x0, 0x5, 0x7fff, 0x7, 0x8, 0x6a4941c5, 0x2ea567b4, 0x8, 0x80000000, 0x6, 0x40, 0x2, 0xfff, 0x8, 0x7, 0x1, 0x1, 0x0, 0x0, 0xd3bed341, 0x691f, 0x0, 0x2, 0x9, 0x6, 0x0, 0x1ff, 0x3, 0x3, 0x6, 0x5fc8462f, 0x0, 0x7, 0xffff, 0xfffffffc, 0x5, 0x0, 0xb9a6, 0x522, 0x2, 0x2, 0x900, 0x8, 0xbb99, 0xb8000000, 0x8, 0xffffff01, 0xc0a1, 0x8, 0x8, 0x7, 0x59, 0x9, 0x2, 0x101, 0x5f502dca, 0x7, 0x0, 0x4, 0x6, 0x80000001, 0x3, 0xffffff97, 0x2, 0xfff, 0x1, 0x40, 0x8, 0x3, 0x710, 0x8, 0x1, 0xfffff339, 0x3, 0x8001, 0x1, 0x8001, 0x9, 0x8, 0xfffffffa, 0x8, 0x9, 0x3, 0xe, 0x10000, 0x9, 0x9, 0x7, 0xfffffff8]}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x874}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021840000000c0a0101000000000000d955070000000900020073797a31000000000900010073797a30000000005800038054000080080003400000000248000b80340001800a0001006c696d69740000002400028008000440000000010c00024000000000000000000c000140"], 0x108}}, 0x0) 214.308939ms ago: executing program 1 (id=3007): r0 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000a8e000/0x2000)=nil, 0x2000, 0x0, 0x3032, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000002100)=""/4127, &(0x7f0000000000)=0x101f) 134.075542ms ago: executing program 3 (id=3008): ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000180)={'gretap0\x00', 0x0, 0x7, 0x8, 0xe48, 0x100, {{0x11, 0x4, 0x3, 0x2, 0x44, 0x64, 0x0, 0x8, 0x0, 0x0, @empty, @multicast1, {[@timestamp_prespec={0x44, 0xc, 0x6f, 0x3, 0x1, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xff}]}, @timestamp_prespec={0x44, 0x24, 0x40, 0x3, 0xa, [{@loopback, 0x1}, {@dev={0xac, 0x14, 0x14, 0x37}, 0x1}, {@empty, 0xb7be}, {@broadcast, 0x2}]}]}}}}}) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100"], 0x38}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000400)="390000001300090468fe070000000000000eac3736000000480100100000000004002b000a00010014a4ee1ee438d2fd00000000000000720896", 0x3a}], 0x1) 133.245082ms ago: executing program 2 (id=3009): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001c00010429bd7000fddbdf2507000000", @ANYRES32=r2, @ANYBLOB="4000b7030a0002"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x20000040) (async) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001c00010429bd7000fddbdf2507000000", @ANYRES32=r2, @ANYBLOB="4000b7030a0002"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x20000040) connect$bt_rfcomm(r0, &(0x7f00000001c0)={0x1f, @any, 0x1}, 0xa) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4020000000000007911000000000000850000006b0000009500000000000000359bb9f4ffffb136000440c89844f3cec063027b45b1bf3fa2cef4363021028e2b63040fcfd3a9b59fed6aa4172c30b77f38d6daaed700"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000300)=""/197, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000002c0), 0xffffffffffffff35}, 0x54) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x44, r4, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@ETHTOOL_A_COALESCE_TX_MAX_FRAMES_HIGH={0x8, 0x16, 0xf9b}, @ETHTOOL_A_COALESCE_TX_USECS={0x8, 0x6, 0x814c}, @ETHTOOL_A_COALESCE_TX_USECS={0x8, 0x6, 0xfffffffd}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_RX={0x5, 0x19, 0x1}, @ETHTOOL_A_COALESCE_TX_USECS_LOW={0x8, 0x10, 0x656}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_RX={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 95.635085ms ago: executing program 1 (id=3010): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800e00010069703665727370616e000000100002800400120006001800177b000008000a00", @ANYRES32=r3], 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4000) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c0001802000060090390000100002"], 0x34}, 0x1, 0x0, 0x0, 0x4000895}, 0xc000) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x0, 0x8}, 0x48) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r4, 0x890b, &(0x7f0000000280)={0x1, @default, @bpq0, 0xfffd, 'syz0\x00', @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0xfffffdb8, 0x2, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}) 0s ago: executing program 3 (id=3011): getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x100}) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x3}]}, 0x28}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)={0x28, r1, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000800) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(0x0, r4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) kernel console output (not intermixed with test programs): ributes in process `syz.2.1429'. [ 256.882695][T11161] netlink: 'syz.4.1432': attribute type 9 has an invalid length. [ 256.937832][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 256.946000][ C1] lec:lec_tx_timeout: lec0 [ 256.950704][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 256.992719][T11165] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1435'. [ 257.092107][T11168] syzkaller0: entered promiscuous mode [ 257.108234][T11168] syzkaller0: entered allmulticast mode [ 257.309275][T11175] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 257.327411][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1443'. [ 257.337032][T11184] netlink: 'syz.0.1443': attribute type 7 has an invalid length. [ 257.337112][T11182] mac80211_hwsim hwsim10 wlan1: Caught tx_queue_len zero misconfig [ 257.389285][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1443'. [ 257.401800][T11187] syzkaller0: entered promiscuous mode [ 257.407299][T11187] syzkaller0: entered allmulticast mode [ 257.419672][T11184] netlink: 'syz.0.1443': attribute type 7 has an invalid length. [ 257.450812][ T3948] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.472589][ T3948] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.483355][T11188] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1441'. [ 257.566367][T11200] FAULT_INJECTION: forcing a failure. [ 257.566367][T11200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 257.580290][T11200] CPU: 1 UID: 0 PID: 11200 Comm: syz.4.1446 Not tainted syzkaller #0 PREEMPT(full) [ 257.580315][T11200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 257.580339][T11200] Call Trace: [ 257.580346][T11200] [ 257.580354][T11200] dump_stack_lvl+0xe8/0x150 [ 257.580383][T11200] should_fail_ex+0x412/0x560 [ 257.580411][T11200] _copy_from_user+0x2d/0xb0 [ 257.580437][T11200] do_sock_getsockopt+0x165/0x3f0 [ 257.580460][T11200] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 257.580479][T11200] ? __fget_files+0x3a0/0x420 [ 257.580497][T11200] ? __fget_files+0x2a/0x420 [ 257.580519][T11200] __x64_sys_getsockopt+0x1a4/0x240 [ 257.580543][T11200] do_syscall_64+0xe2/0xf80 [ 257.580560][T11200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.580575][T11200] ? trace_irq_disable+0x37/0x100 [ 257.580591][T11200] ? clear_bhb_loop+0x60/0xb0 [ 257.580611][T11200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.580626][T11200] RIP: 0033:0x7f0fa359aeb9 [ 257.580641][T11200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.580653][T11200] RSP: 002b:00007f0fa43a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 257.580671][T11200] RAX: ffffffffffffffda RBX: 00007f0fa3815fa0 RCX: 00007f0fa359aeb9 [ 257.580683][T11200] RDX: 0000000000002718 RSI: 0000200000000114 RDI: 0000000000000003 [ 257.580695][T11200] RBP: 00007f0fa43a6090 R08: 0000200000000000 R09: 0000000000000000 [ 257.580707][T11200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.580717][T11200] R13: 00007f0fa3816038 R14: 00007f0fa3815fa0 R15: 00007ffc5e8a4f18 [ 257.580746][T11200] [ 257.805520][ T3948] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.817191][ T3948] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 257.956869][T11210] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1449'. [ 258.224554][T11222] syzkaller0: entered promiscuous mode [ 258.230388][T11222] syzkaller0: entered allmulticast mode [ 258.248635][T11225] netlink: 'syz.3.1454': attribute type 29 has an invalid length. [ 258.257569][T11228] FAULT_INJECTION: forcing a failure. [ 258.257569][T11228] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 258.257944][T11225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1454'. [ 258.271622][T11228] CPU: 1 UID: 0 PID: 11228 Comm: syz.1.1455 Not tainted syzkaller #0 PREEMPT(full) [ 258.271646][T11228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 258.271657][T11228] Call Trace: [ 258.271664][T11228] [ 258.271671][T11228] dump_stack_lvl+0xe8/0x150 [ 258.271700][T11228] should_fail_ex+0x412/0x560 [ 258.271726][T11228] _copy_from_user+0x2d/0xb0 [ 258.271753][T11228] generic_map_update_batch+0x572/0x810 [ 258.271788][T11228] ? __pfx_generic_map_update_batch+0x10/0x10 [ 258.271811][T11228] ? __fget_files+0x2a/0x420 [ 258.271837][T11228] ? __pfx_generic_map_update_batch+0x10/0x10 [ 258.271860][T11228] bpf_map_do_batch+0x39b/0x630 [ 258.271885][T11228] __sys_bpf+0x709/0x920 [ 258.271903][T11228] ? __pfx___sys_bpf+0x10/0x10 [ 258.271935][T11228] ? ksys_write+0x242/0x270 [ 258.271961][T11228] ? __pfx_ksys_write+0x10/0x10 [ 258.271993][T11228] __x64_sys_bpf+0x7c/0x90 [ 258.272018][T11228] do_syscall_64+0xe2/0xf80 [ 258.272035][T11228] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.272053][T11228] ? trace_irq_disable+0x37/0x100 [ 258.272069][T11228] ? clear_bhb_loop+0x60/0xb0 [ 258.272089][T11228] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 258.272106][T11228] RIP: 0033:0x7fcb33b9aeb9 [ 258.272122][T11228] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 258.272138][T11228] RSP: 002b:00007fcb3499f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 258.272157][T11228] RAX: ffffffffffffffda RBX: 00007fcb33e15fa0 RCX: 00007fcb33b9aeb9 [ 258.272170][T11228] RDX: 0000000000000038 RSI: 00002000000006c0 RDI: 000000000000001a [ 258.272181][T11228] RBP: 00007fcb3499f090 R08: 0000000000000000 R09: 0000000000000000 [ 258.272199][T11228] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 258.272209][T11228] R13: 00007fcb33e16038 R14: 00007fcb33e15fa0 R15: 00007ffcf147a3f8 [ 258.272237][T11228] [ 258.310171][T11232] netlink: 'syz.4.1456': attribute type 10 has an invalid length. [ 258.503531][T11231] netlink: 'syz.3.1454': attribute type 29 has an invalid length. [ 258.511547][T11231] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1454'. [ 258.623378][T11240] syzkaller0: entered promiscuous mode [ 258.629230][T11240] syzkaller0: entered allmulticast mode [ 258.968888][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1467'. [ 258.990779][T11258] netlink: 'syz.3.1467': attribute type 7 has an invalid length. [ 259.001787][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1467'. [ 259.010105][T11262] netlink: 'syz.0.1469': attribute type 29 has an invalid length. [ 259.040130][T11258] netlink: 'syz.3.1467': attribute type 7 has an invalid length. [ 259.052979][T11262] netlink: 'syz.0.1469': attribute type 29 has an invalid length. [ 259.074804][T11266] syzkaller0: entered promiscuous mode [ 259.088039][T11266] syzkaller0: entered allmulticast mode [ 259.284318][T11277] syzkaller0: entered promiscuous mode [ 259.303394][T11277] syzkaller0: entered allmulticast mode [ 259.341163][T11282] mac80211_hwsim hwsim11 wlan1: Caught tx_queue_len zero misconfig [ 259.546118][T11296] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 259.562693][T11296] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 260.089683][T11334] syzkaller0: entered promiscuous mode [ 260.095199][T11334] syzkaller0: entered allmulticast mode [ 260.103267][T11336] syzkaller0: entered promiscuous mode [ 260.118100][T11336] syzkaller0: entered allmulticast mode [ 260.503245][T11359] 8021q: adding VLAN 0 to HW filter on device bond1 [ 260.592848][T11365] 8021q: adding VLAN 0 to HW filter on device bond1 [ 260.600637][T11365] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 260.611958][T11365] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 260.633275][T11371] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 260.699577][T11359] veth3: entered promiscuous mode [ 260.710825][T11374] 8021q: adding VLAN 0 to HW filter on device bond1 [ 260.761039][T11380] syzkaller0: entered promiscuous mode [ 260.766551][T11380] syzkaller0: entered allmulticast mode [ 261.237674][T11409] 8021q: adding VLAN 0 to HW filter on device bond2 [ 261.378149][T11414] 8021q: adding VLAN 0 to HW filter on device bond2 [ 261.385169][T11414] bond2: (slave vxcan3): The slave device specified does not support setting the MAC address [ 261.398929][T11414] bond2: (slave vxcan3): Error -95 calling set_mac_address [ 261.449493][T11418] veth5: entered promiscuous mode [ 261.463077][T11409] 8021q: adding VLAN 0 to HW filter on device bond2 [ 261.644385][T11440] syzkaller0: entered promiscuous mode [ 261.658407][T11440] syzkaller0: entered allmulticast mode [ 261.745311][T11447] syzkaller0: entered promiscuous mode [ 261.752222][T11447] syzkaller0: entered allmulticast mode [ 261.775042][T11451] syzkaller0: entered promiscuous mode [ 261.787609][T11451] syzkaller0: entered allmulticast mode [ 261.816501][T11455] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 261.957821][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 261.965893][ C1] lec:lec_tx_timeout: lec0 [ 261.971909][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 261.980637][T11460] validate_nla: 5 callbacks suppressed [ 261.980655][T11460] netlink: 'syz.2.1536': attribute type 1 has an invalid length. [ 262.162466][T11473] __nla_validate_parse: 11 callbacks suppressed [ 262.162499][T11473] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1536'. [ 262.164310][T11460] 8021q: adding VLAN 0 to HW filter on device bond3 [ 262.251979][T11468] veth5: entered promiscuous mode [ 262.305919][T11479] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1539'. [ 262.325008][T11482] FAULT_INJECTION: forcing a failure. [ 262.325008][T11482] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.344707][T11482] CPU: 0 UID: 0 PID: 11482 Comm: syz.0.1542 Not tainted syzkaller #0 PREEMPT(full) [ 262.344734][T11482] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 262.344745][T11482] Call Trace: [ 262.344752][T11482] [ 262.344760][T11482] dump_stack_lvl+0xe8/0x150 [ 262.344788][T11482] should_fail_ex+0x412/0x560 [ 262.344815][T11482] _copy_from_user+0x2d/0xb0 [ 262.344854][T11482] generic_map_update_batch+0x572/0x810 [ 262.344889][T11482] ? __pfx_generic_map_update_batch+0x10/0x10 [ 262.344912][T11482] ? __fget_files+0x2a/0x420 [ 262.344938][T11482] ? __pfx_generic_map_update_batch+0x10/0x10 [ 262.344959][T11482] bpf_map_do_batch+0x39b/0x630 [ 262.344984][T11482] __sys_bpf+0x709/0x920 [ 262.345005][T11482] ? __pfx___sys_bpf+0x10/0x10 [ 262.345037][T11482] ? ksys_write+0x242/0x270 [ 262.345065][T11482] ? __pfx_ksys_write+0x10/0x10 [ 262.345096][T11482] __x64_sys_bpf+0x7c/0x90 [ 262.345121][T11482] do_syscall_64+0xe2/0xf80 [ 262.345138][T11482] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.345156][T11482] ? trace_irq_disable+0x37/0x100 [ 262.345173][T11482] ? clear_bhb_loop+0x60/0xb0 [ 262.345194][T11482] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.345211][T11482] RIP: 0033:0x7f1eb279aeb9 [ 262.345227][T11482] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 262.345242][T11482] RSP: 002b:00007f1eb35fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 262.345260][T11482] RAX: ffffffffffffffda RBX: 00007f1eb2a15fa0 RCX: 00007f1eb279aeb9 [ 262.345273][T11482] RDX: 0000000000000038 RSI: 00002000000006c0 RDI: 000000000000001a [ 262.345284][T11482] RBP: 00007f1eb35fe090 R08: 0000000000000000 R09: 0000000000000000 [ 262.345296][T11482] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 262.345306][T11482] R13: 00007f1eb2a16038 R14: 00007f1eb2a15fa0 R15: 00007fff78436ae8 [ 262.345335][T11482] [ 262.743116][T11497] syzkaller0: entered promiscuous mode [ 262.751539][T11497] syzkaller0: entered allmulticast mode [ 262.752004][T11490] Bluetooth: MGMT ver 1.23 [ 262.827212][T11500] syzkaller0: entered promiscuous mode [ 262.833197][T11500] syzkaller0: entered allmulticast mode [ 262.870432][T11503] syzkaller0: entered promiscuous mode [ 262.886318][T11503] syzkaller0: entered allmulticast mode [ 262.912789][T11507] netlink: 'syz.4.1549': attribute type 1 has an invalid length. [ 262.925226][T11507] netlink: 'syz.4.1549': attribute type 4 has an invalid length. [ 262.951273][T11507] netlink: 9491 bytes leftover after parsing attributes in process `syz.4.1549'. [ 262.951925][T11503] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 262.975019][T11490] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1543'. [ 263.126983][T11521] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1550'. [ 263.362578][T11531] netlink: 'syz.1.1553': attribute type 1 has an invalid length. [ 263.408733][T11531] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.485251][T11540] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1553'. [ 263.522539][T11531] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.533887][T11531] bond0: (slave vxcan3): The slave device specified does not support setting the MAC address [ 263.545445][T11531] bond0: (slave vxcan3): Error -95 calling set_mac_address [ 263.579255][T11534] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 263.610677][T11540] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.630879][T11539] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1556'. [ 263.666499][T11547] syzkaller0: entered promiscuous mode [ 263.679824][T11547] syzkaller0: entered allmulticast mode [ 263.876002][T11558] bond4: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 265.437224][T11559] syzkaller0: entered promiscuous mode [ 265.442803][T11559] syzkaller0: entered allmulticast mode [ 265.597120][T11603] FAULT_INJECTION: forcing a failure. [ 265.597120][T11603] name failslab, interval 1, probability 0, space 0, times 0 [ 265.612438][T11603] CPU: 1 UID: 0 PID: 11603 Comm: syz.3.1567 Not tainted syzkaller #0 PREEMPT(full) [ 265.612466][T11603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 265.612477][T11603] Call Trace: [ 265.612485][T11603] [ 265.612493][T11603] dump_stack_lvl+0xe8/0x150 [ 265.612522][T11603] should_fail_ex+0x412/0x560 [ 265.612549][T11603] should_failslab+0xa8/0x100 [ 265.612572][T11603] kmem_cache_alloc_noprof+0x87/0x6e0 [ 265.612598][T11603] ? __netlink_lookup+0xc6/0x8b0 [ 265.612619][T11603] ? skb_clone+0x212/0x3a0 [ 265.612647][T11603] skb_clone+0x212/0x3a0 [ 265.612674][T11603] __netlink_deliver_tap+0x404/0x850 [ 265.612704][T11603] ? netlink_deliver_tap+0x2e/0x1b0 [ 265.612723][T11603] netlink_deliver_tap+0x19c/0x1b0 [ 265.612743][T11603] netlink_unicast+0x7e3/0x9b0 [ 265.612779][T11603] ? __pfx_netlink_unicast+0x10/0x10 [ 265.612804][T11603] ? __alloc_skb+0x193/0x390 [ 265.612825][T11603] ? netlink_sendmsg+0x650/0xb40 [ 265.612842][T11603] ? skb_put+0x11b/0x210 [ 265.612866][T11603] netlink_sendmsg+0x813/0xb40 [ 265.612894][T11603] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.612916][T11603] ? aa_sock_msg_perm+0xf1/0x1b0 [ 265.612940][T11603] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 265.612963][T11603] ? __pfx_netlink_sendmsg+0x10/0x10 [ 265.612981][T11603] ____sys_sendmsg+0xa68/0xad0 [ 265.613005][T11603] ? __might_fault+0xaf/0x130 [ 265.613037][T11603] ? __pfx_____sys_sendmsg+0x10/0x10 [ 265.613069][T11603] ? import_iovec+0x73/0xa0 [ 265.613106][T11603] ___sys_sendmsg+0x2a5/0x360 [ 265.613128][T11603] ? __lock_acquire+0x6b5/0x2cf0 [ 265.613166][T11603] ? __pfx____sys_sendmsg+0x10/0x10 [ 265.613223][T11603] ? __fget_files+0x2a/0x420 [ 265.613242][T11603] ? __fget_files+0x3a0/0x420 [ 265.613271][T11603] __x64_sys_sendmsg+0x1bd/0x2a0 [ 265.613298][T11603] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 265.613331][T11603] ? __pfx_ksys_write+0x10/0x10 [ 265.613368][T11603] do_syscall_64+0xe2/0xf80 [ 265.613388][T11603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.613405][T11603] ? trace_irq_disable+0x37/0x100 [ 265.613422][T11603] ? clear_bhb_loop+0x60/0xb0 [ 265.613444][T11603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 265.613462][T11603] RIP: 0033:0x7f902ed9aeb9 [ 265.613480][T11603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 265.613496][T11603] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 265.613516][T11603] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 265.613530][T11603] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000003 [ 265.613542][T11603] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 265.613553][T11603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 265.613564][T11603] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 265.613593][T11603] [ 265.741271][T11609] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1569'. [ 266.998027][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 267.006114][ C1] lec:lec_tx_timeout: lec0 [ 267.010767][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 267.251790][T11613] netlink: 'syz.2.1570': attribute type 1 has an invalid length. [ 267.383235][T11615] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1570'. [ 268.326443][T11607] syzkaller0: entered promiscuous mode [ 268.333987][T11607] syzkaller0: entered allmulticast mode [ 268.393095][T11613] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 268.774582][T11639] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1579'. [ 268.779303][T11633] syzkaller0: entered promiscuous mode [ 268.792037][T11639] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1579'. [ 268.810775][T11633] syzkaller0: entered allmulticast mode [ 269.085481][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.108375][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.122361][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.143405][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.174160][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.200586][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.220807][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.230273][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.240615][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 269.267220][T11667] openvswitch: netlink: IP tunnel dst address not specified [ 270.738540][T11654] syzkaller0: entered promiscuous mode [ 270.744063][T11654] syzkaller0: entered allmulticast mode [ 272.019170][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 272.027214][ C1] lec:lec_tx_timeout: lec0 [ 272.031835][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 272.378582][T11727] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1593'. [ 272.378677][T11726] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1591'. [ 272.406604][T11725] syzkaller0: entered promiscuous mode [ 272.412721][T11725] syzkaller0: entered allmulticast mode [ 272.736431][T11739] syzkaller0: entered promiscuous mode [ 272.796905][T11739] syzkaller0: entered allmulticast mode [ 272.968468][T11762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1604'. [ 273.007853][T11762] netlink: 'syz.2.1604': attribute type 7 has an invalid length. [ 273.019482][T11764] netlink: 'syz.0.1605': attribute type 1 has an invalid length. [ 273.582398][T11794] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1609'. [ 275.094756][T11762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1604'. [ 275.103934][T11762] netlink: 'syz.2.1604': attribute type 7 has an invalid length. [ 275.251288][T11834] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1611'. [ 275.334777][T11839] net_ratelimit: 25 callbacks suppressed [ 275.334800][T11839] openvswitch: netlink: Missing valid actions attribute. [ 275.361525][T11839] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 275.564989][T11854] syzkaller0: entered promiscuous mode [ 275.585311][T11854] syzkaller0: entered allmulticast mode [ 275.594820][T11860] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1619'. [ 275.642044][T11861] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1619'. [ 275.858404][T11877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1623'. [ 275.889274][T11869] syzkaller0: entered promiscuous mode [ 275.910920][T11869] syzkaller0: entered allmulticast mode [ 275.918808][T11877] netlink: 'syz.2.1623': attribute type 7 has an invalid length. [ 275.934426][T11881] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1624'. [ 277.040251][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 277.048326][ C1] lec:lec_tx_timeout: lec0 [ 277.053045][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 277.512109][T11877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1623'. [ 277.521413][T11877] netlink: 'syz.2.1623': attribute type 7 has an invalid length. [ 277.665834][T11915] syzkaller0: entered promiscuous mode [ 277.680555][T11915] syzkaller0: entered allmulticast mode [ 277.835163][T11930] netlink: 16215 bytes leftover after parsing attributes in process `syz.3.1629'. [ 278.001488][T11939] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1636'. [ 278.024088][T11936] syzkaller0: entered promiscuous mode [ 278.031704][T11939] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1636'. [ 278.048222][T11936] syzkaller0: entered allmulticast mode [ 278.056761][T11940] syzkaller0: entered promiscuous mode [ 278.062396][T11940] syzkaller0: entered allmulticast mode [ 278.347167][T11963] netlink: 'syz.4.1645': attribute type 1 has an invalid length. [ 278.391344][T11968] netlink: 'syz.1.1647': attribute type 1 has an invalid length. [ 278.396029][T11963] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.476110][T11968] 8021q: adding VLAN 0 to HW filter on device bond4 [ 278.507210][T11963] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1645'. [ 278.524200][T11969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.531725][T11969] bond0: (slave vxcan3): The slave device specified does not support setting the MAC address [ 278.544131][T11969] bond0: (slave vxcan3): Error -95 calling set_mac_address [ 278.591788][T11974] 8021q: adding VLAN 0 to HW filter on device bond4 [ 278.601147][T11974] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 278.613879][T11985] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1647'. [ 278.628155][T11974] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 278.675754][T11977] netlink: 'syz.0.1649': attribute type 29 has an invalid length. [ 278.693529][T11977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1649'. [ 278.699595][T11990] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1644'. [ 278.725830][T11963] 8021q: adding VLAN 0 to HW filter on device bond0 [ 278.764626][T11968] veth5: entered promiscuous mode [ 278.796883][T11985] 8021q: adding VLAN 0 to HW filter on device bond4 [ 278.811453][T11982] netlink: 'syz.0.1649': attribute type 29 has an invalid length. [ 278.827607][T11982] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1649'. [ 278.961698][T12001] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1652'. [ 278.971292][T12001] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1652'. [ 279.074929][T12001] netlink: 'syz.4.1652': attribute type 9 has an invalid length. [ 279.114153][T12005] syzkaller0: entered promiscuous mode [ 279.119815][T12005] syzkaller0: entered allmulticast mode [ 279.717106][T12047] x_tables: duplicate underflow at hook 2 [ 279.761076][T12055] netlink: 'syz.3.1669': attribute type 9 has an invalid length. [ 279.856264][T12056] syzkaller0: entered promiscuous mode [ 279.864080][T12056] syzkaller0: entered allmulticast mode [ 279.957020][T12065] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.1674'. [ 280.635625][T12103] syzkaller1: entered promiscuous mode [ 280.644335][T12103] syzkaller1: entered allmulticast mode [ 280.802868][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.021049][T12121] syzkaller0: entered promiscuous mode [ 281.026570][T12121] syzkaller0: entered allmulticast mode [ 281.314877][T12142] xt_HMARK: spi-set and port-set can't be combined [ 281.553570][T12160] ieee802154 phy1 wpan1: encryption failed: -22 [ 281.725112][T12160] bond5: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 281.779320][T12160] bond5 (unregistering): Released all slaves [ 281.806924][T12165] netlink: 'syz.2.1702': attribute type 29 has an invalid length. [ 281.855036][T12167] netlink: 'syz.2.1702': attribute type 29 has an invalid length. [ 282.058167][T12185] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 282.067891][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 282.075936][ C1] lec:lec_tx_timeout: lec0 [ 282.080945][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 282.304100][T12204] netlink: 'syz.1.1716': attribute type 21 has an invalid length. [ 282.351108][T12205] netlink: 'syz.1.1716': attribute type 21 has an invalid length. [ 283.240707][T12249] __nla_validate_parse: 12 callbacks suppressed [ 283.240731][T12249] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1725'. [ 283.267544][T12251] xt_nfacct: accounting object `\$‚9ZúM#íü¾mUµ|±^cÁ\F9YⳈ«ÃÖ' does not exist [ 283.340290][T12254] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1725'. [ 283.642401][T12211] bond2: left promiscuous mode [ 283.647193][T12211] bond2: left allmulticast mode [ 283.775179][ T2040] netdevsim netdevsim4 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.788667][ T2040] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.797267][ T2040] netdevsim netdevsim4 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.806837][ T2040] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.850426][ T2040] netdevsim netdevsim4 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.866296][ T2040] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.918280][ T2040] netdevsim netdevsim4 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 283.926679][ T2040] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 283.978173][T12264] netlink: 'syz.3.1730': attribute type 5 has an invalid length. [ 284.777402][T12294] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1737'. [ 284.983809][T12299] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1739'. [ 285.888927][T12281] bridge: RTM_NEWNEIGH with unconfigured vlan 4 on bridge_slave_0 [ 286.023554][T12320] netlink: 'syz.1.1745': attribute type 9 has an invalid length. [ 286.050750][T12323] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 286.061005][T12324] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 286.204433][T12333] FAULT_INJECTION: forcing a failure. [ 286.204433][T12333] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 286.220727][T12333] CPU: 0 UID: 0 PID: 12333 Comm: syz.3.1751 Not tainted syzkaller #0 PREEMPT(full) [ 286.220753][T12333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 286.220764][T12333] Call Trace: [ 286.220772][T12333] [ 286.220780][T12333] dump_stack_lvl+0xe8/0x150 [ 286.220808][T12333] should_fail_ex+0x412/0x560 [ 286.220834][T12333] _copy_from_iter+0x1d3/0x1670 [ 286.220865][T12333] ? trace_kmem_cache_alloc+0x1f/0xb0 [ 286.220897][T12333] ? __pfx__copy_from_iter+0x10/0x10 [ 286.220921][T12333] ? __build_skb_around+0x22d/0x3c0 [ 286.220945][T12333] ? __alloc_skb+0x193/0x390 [ 286.220964][T12333] ? netlink_sendmsg+0x650/0xb40 [ 286.220983][T12333] ? skb_put+0x11b/0x210 [ 286.221007][T12333] netlink_sendmsg+0x6c0/0xb40 [ 286.221034][T12333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 286.221056][T12333] ? aa_sock_msg_perm+0xf1/0x1b0 [ 286.221081][T12333] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 286.221103][T12333] ? __pfx_netlink_sendmsg+0x10/0x10 [ 286.221120][T12333] ____sys_sendmsg+0xa68/0xad0 [ 286.221143][T12333] ? __might_fault+0xaf/0x130 [ 286.221175][T12333] ? __pfx_____sys_sendmsg+0x10/0x10 [ 286.221207][T12333] ? import_iovec+0x73/0xa0 [ 286.221235][T12333] ___sys_sendmsg+0x2a5/0x360 [ 286.221257][T12333] ? __lock_acquire+0x6b5/0x2cf0 [ 286.221285][T12333] ? __pfx____sys_sendmsg+0x10/0x10 [ 286.221342][T12333] ? __fget_files+0x2a/0x420 [ 286.221361][T12333] ? __fget_files+0x3a0/0x420 [ 286.221390][T12333] __x64_sys_sendmsg+0x1bd/0x2a0 [ 286.221415][T12333] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 286.221448][T12333] ? __pfx_ksys_write+0x10/0x10 [ 286.221485][T12333] do_syscall_64+0xe2/0xf80 [ 286.221504][T12333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.221522][T12333] ? trace_irq_disable+0x37/0x100 [ 286.221539][T12333] ? clear_bhb_loop+0x60/0xb0 [ 286.221561][T12333] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.221579][T12333] RIP: 0033:0x7f902ed9aeb9 [ 286.221596][T12333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.221611][T12333] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 286.221632][T12333] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 286.221652][T12333] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000003 [ 286.221663][T12333] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 286.221675][T12333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.221684][T12333] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 286.221714][T12333] [ 286.645124][T12343] bond0: left promiscuous mode [ 286.650171][T12343] bond_slave_0: left promiscuous mode [ 286.655839][T12343] bond_slave_1: left promiscuous mode [ 286.712035][T12343] veth3: left promiscuous mode [ 286.727469][T12343] veth5: left promiscuous mode [ 286.818431][T12349] syzkaller0: entered promiscuous mode [ 286.824373][T12349] syzkaller0: entered allmulticast mode [ 286.891441][T12352] syzkaller0: entered promiscuous mode [ 286.908593][T12352] syzkaller0: entered allmulticast mode [ 286.964827][T12357] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1761'. [ 286.988628][T12357] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1761'. [ 287.087853][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 287.095948][ C1] lec:lec_tx_timeout: lec0 [ 287.101199][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 287.140772][T12368] xt_hashlimit: size too large, truncated to 1048576 [ 287.370854][T12378] netlink: 'syz.2.1768': attribute type 1 has an invalid length. [ 287.458882][T12385] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1768'. [ 287.519428][T12385] bridge1: entered allmulticast mode [ 287.563151][T12385] bond5: (slave bridge1): making interface the new active one [ 287.591747][T12385] bond5: (slave bridge1): Enslaving as an active interface with an up link [ 287.607353][T12382] syzkaller0: entered promiscuous mode [ 287.614440][T12382] syzkaller0: entered allmulticast mode [ 287.723815][T12395] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1773'. [ 287.935500][T12407] IPVS: set_ctl: invalid protocol: 12 172.20.20.11:21 [ 288.002485][T12411] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.1780'. [ 288.226116][T12427] netlink: 'syz.1.1783': attribute type 1 has an invalid length. [ 288.329821][T12427] 8021q: adding VLAN 0 to HW filter on device bond5 [ 288.419788][T12442] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1783'. [ 288.446849][T12435] 8021q: adding VLAN 0 to HW filter on device bond5 [ 288.450267][T12443] FAULT_INJECTION: forcing a failure. [ 288.450267][T12443] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 288.472112][T12443] CPU: 1 UID: 0 PID: 12443 Comm: syz.2.1788 Not tainted syzkaller #0 PREEMPT(full) [ 288.472140][T12443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 288.472151][T12443] Call Trace: [ 288.472158][T12443] [ 288.472165][T12443] dump_stack_lvl+0xe8/0x150 [ 288.472192][T12443] should_fail_ex+0x412/0x560 [ 288.472219][T12443] _copy_to_user+0x31/0xb0 [ 288.472254][T12443] simple_read_from_buffer+0xe1/0x170 [ 288.472278][T12443] proc_fail_nth_read+0x1bb/0x230 [ 288.472306][T12443] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 288.472334][T12443] ? rw_verify_area+0x2a6/0x4d0 [ 288.472359][T12443] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 288.472385][T12443] vfs_read+0x20c/0xa70 [ 288.472407][T12443] ? fdget_pos+0x246/0x320 [ 288.472429][T12443] ? __pfx___mutex_lock+0x10/0x10 [ 288.472449][T12443] ? __pfx_vfs_read+0x10/0x10 [ 288.472472][T12443] ? __fget_files+0x2a/0x420 [ 288.472495][T12443] ? __fget_files+0x3a0/0x420 [ 288.472511][T12443] ? __fget_files+0x2a/0x420 [ 288.472537][T12443] ksys_read+0x150/0x270 [ 288.472570][T12443] ? __pfx_ksys_read+0x10/0x10 [ 288.472604][T12443] do_syscall_64+0xe2/0xf80 [ 288.472622][T12443] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.472639][T12443] ? trace_irq_disable+0x37/0x100 [ 288.472655][T12443] ? clear_bhb_loop+0x60/0xb0 [ 288.472676][T12443] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 288.472694][T12443] RIP: 0033:0x7f4d2e95b78e [ 288.472710][T12443] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 288.472726][T12443] RSP: 002b:00007f4d2f7edfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 288.472743][T12443] RAX: ffffffffffffffda RBX: 00007f4d2f7ee6c0 RCX: 00007f4d2e95b78e [ 288.472760][T12443] RDX: 000000000000000f RSI: 00007f4d2f7ee0a0 RDI: 0000000000000004 [ 288.472770][T12443] RBP: 00007f4d2f7ee090 R08: 0000000000000000 R09: 0000000000000000 [ 288.472780][T12443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 288.472789][T12443] R13: 00007f4d2ec16038 R14: 00007f4d2ec15fa0 R15: 00007ffd996d2458 [ 288.472818][T12443] [ 288.473570][T12435] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 288.697905][T12435] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 288.728831][T12427] veth7: entered promiscuous mode [ 288.737117][T12427] bond5: (slave veth7): Enslaving as an active interface with a down link [ 288.931711][T12467] x_tables: duplicate underflow at hook 1 [ 288.972519][T12472] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1795'. [ 289.501073][T12506] netlink: 'syz.0.1805': attribute type 1 has an invalid length. [ 289.624351][T12506] 8021q: adding VLAN 0 to HW filter on device bond5 [ 289.659956][T12514] 8021q: adding VLAN 0 to HW filter on device bond5 [ 289.686301][T12514] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 289.712570][T12514] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 289.736245][T12518] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1805'. [ 289.826432][T12506] veth3: entered promiscuous mode [ 289.848110][T12506] bond5: (slave veth3): Enslaving as an active interface with a down link [ 290.132645][T12542] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1811'. [ 290.331667][T12556] bond0: Caught tx_queue_len zero misconfig [ 290.627207][T12571] netlink: 'syz.2.1820': attribute type 1 has an invalid length. [ 290.699657][T12571] 8021q: adding VLAN 0 to HW filter on device bond6 [ 290.828755][T12584] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1820'. [ 290.863765][T12579] 8021q: adding VLAN 0 to HW filter on device bond6 [ 290.888383][T12579] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 290.930909][T12579] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 290.999532][T12571] veth7: entered promiscuous mode [ 291.016136][T12571] bond6: (slave veth7): Enslaving as an active interface with a down link [ 291.081906][T12595] netlink: 76 bytes leftover after parsing attributes in process `syz.1.1823'. [ 291.224343][T12603] syzkaller0: entered promiscuous mode [ 291.230436][T12603] syzkaller0: entered allmulticast mode [ 291.361948][T12613] netlink: 'syz.0.1830': attribute type 29 has an invalid length. [ 291.370092][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1830'. [ 291.384239][T12613] netlink: 'syz.0.1830': attribute type 29 has an invalid length. [ 291.409883][T12613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1830'. [ 291.487333][T12620] openvswitch: netlink: IP tunnel dst address not specified [ 291.634303][T12634] syzkaller0: entered promiscuous mode [ 291.650119][T12634] syzkaller0: entered allmulticast mode [ 291.663078][T12636] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 291.674795][T12636] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 291.783512][T12636] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1834'. [ 292.203063][T12664] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1841'. [ 292.237523][ T4521] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.255051][ T4521] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.293669][ T4521] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.336332][ T4521] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 292.495224][T12667] syzkaller0: entered promiscuous mode [ 292.528815][T12667] syzkaller0: entered allmulticast mode [ 292.611392][T12689] syzkaller0: entered promiscuous mode [ 292.622375][T12689] syzkaller0: entered allmulticast mode [ 292.878116][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 292.886183][ C1] lec:lec_tx_timeout: lec0 [ 292.891608][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 294.884703][T12760] __nla_validate_parse: 1 callbacks suppressed [ 294.884723][T12760] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1864'. [ 295.056682][T12774] syzkaller0: entered promiscuous mode [ 295.062410][T12774] syzkaller0: entered allmulticast mode [ 295.389458][T12795] sit0: entered promiscuous mode [ 295.420354][T12795] netlink: 'syz.0.1869': attribute type 1 has an invalid length. [ 295.448764][T12795] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1869'. [ 295.661908][T12814] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1875'. [ 295.707926][T12814] netlink: 'syz.4.1875': attribute type 7 has an invalid length. [ 295.739475][T12814] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1875'. [ 295.789430][T12814] netlink: 'syz.4.1875': attribute type 7 has an invalid length. [ 295.915308][T12829] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1879'. [ 296.500836][T12865] netlink: 'syz.1.1887': attribute type 9 has an invalid length. [ 296.626101][T12875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1891'. [ 296.668355][T12875] netlink: 'syz.3.1891': attribute type 7 has an invalid length. [ 296.718953][T12875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1891'. [ 296.751202][T12882] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1894'. [ 296.777996][T12875] netlink: 'syz.3.1891': attribute type 7 has an invalid length. [ 297.202314][T12911] netlink: 'syz.2.1903': attribute type 9 has an invalid length. [ 297.300968][T12916] openvswitch: netlink: Flow actions attr not present in new flow. [ 297.356406][T12919] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1906'. [ 297.467022][T12919] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1906'. [ 297.917957][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 297.926014][ C1] lec:lec_tx_timeout: lec0 [ 297.930636][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 302.937879][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 302.945942][ C1] lec:lec_tx_timeout: lec0 [ 302.950580][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 307.957894][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 307.965940][ C1] lec:lec_tx_timeout: lec0 [ 307.970545][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 312.977846][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 312.985868][ C1] lec:lec_tx_timeout: lec0 [ 312.990484][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 317.201961][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.997937][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 318.005960][ C1] lec:lec_tx_timeout: lec0 [ 318.010514][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 323.017955][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 323.025975][ C1] lec:lec_tx_timeout: lec0 [ 323.030703][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 325.621811][T12951] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1912'. [ 325.849220][T12966] TC_ACT_REPEAT abuse ? [ 325.932367][T12970] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1919'. [ 325.969133][T12970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1919'. [ 326.072699][T12978] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1920'. [ 326.218063][T12985] netlink: 'syz.2.1921': attribute type 9 has an invalid length. [ 326.342467][T12989] netlink: 'syz.3.1924': attribute type 1 has an invalid length. [ 326.589184][T13011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1931'. [ 326.635775][T13011] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1931'. [ 326.647200][T13005] TC_ACT_REPEAT abuse ? [ 326.657040][T13010] syzkaller0: entered promiscuous mode [ 326.662907][T13010] syzkaller0: entered allmulticast mode [ 326.745413][T13002] netlink: 'syz.4.1929': attribute type 1 has an invalid length. [ 326.849136][T13024] netlink: 'syz.2.1935': attribute type 9 has an invalid length. [ 326.944403][T13028] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1937'. [ 326.975888][T13028] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 326.989893][T13030] syzkaller0: entered promiscuous mode [ 326.995560][T13030] syzkaller0: entered allmulticast mode [ 327.124371][T13039] netlink: 'syz.3.1937': attribute type 1 has an invalid length. [ 327.200499][T13032] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1937'. [ 327.232805][T13032] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1937'. [ 327.925198][T13084] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.926893][T13083] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.945600][T13073] netlink: 'syz.0.1946': attribute type 29 has an invalid length. [ 327.958044][T13073] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1946'. [ 327.979456][T13073] netlink: 'syz.0.1946': attribute type 29 has an invalid length. [ 328.038157][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 328.046229][ C1] lec:lec_tx_timeout: lec0 [ 328.051182][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 328.261198][T13100] syzkaller0: entered promiscuous mode [ 328.277006][T13100] syzkaller0: entered allmulticast mode [ 328.541177][T13109] syzkaller0: entered promiscuous mode [ 328.557016][T13109] syzkaller0: entered allmulticast mode [ 328.905843][T13123] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 329.061287][T13144] xt_hashlimit: invalid rate [ 329.066727][T13143] xt_hashlimit: invalid rate [ 329.858466][T13196] bond0: entered promiscuous mode [ 329.901516][T13196] bond0: left promiscuous mode [ 330.459293][T13243] netlink: 'syz.1.2000': attribute type 3 has an invalid length. [ 330.816025][T13262] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 330.911961][T13268] __nla_validate_parse: 12 callbacks suppressed [ 330.911981][T13268] netlink: 212360 bytes leftover after parsing attributes in process `syz.2.2011'. [ 330.929309][T13268] netlink: 'syz.2.2011': attribute type 11 has an invalid length. [ 330.937149][T13268] netlink: 'syz.2.2011': attribute type 11 has an invalid length. [ 330.963182][T13268] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2011'. [ 331.016307][T13273] netlink: 'syz.1.2012': attribute type 1 has an invalid length. [ 331.072830][T13273] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2012'. [ 331.168771][T13285] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2015'. [ 331.332615][T13296] syzkaller0: entered promiscuous mode [ 331.367241][T13296] syzkaller0: entered allmulticast mode [ 331.714843][T13307] macsec0: entered promiscuous mode [ 331.902370][T13324] bond3: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 331.934118][T13324] bond3 (unregistering): Released all slaves [ 332.156230][T13340] FAULT_INJECTION: forcing a failure. [ 332.156230][T13340] name failslab, interval 1, probability 0, space 0, times 0 [ 332.200256][T13340] CPU: 0 UID: 0 PID: 13340 Comm: syz.2.2033 Not tainted syzkaller #0 PREEMPT(full) [ 332.200283][T13340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 332.200295][T13340] Call Trace: [ 332.200302][T13340] [ 332.200310][T13340] dump_stack_lvl+0xe8/0x150 [ 332.200340][T13340] should_fail_ex+0x412/0x560 [ 332.200365][T13340] should_failslab+0xa8/0x100 [ 332.200385][T13340] __kmalloc_noprof+0xde/0x7e0 [ 332.200400][T13340] ? kfree+0x4d/0x650 [ 332.200421][T13340] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 332.200447][T13340] tomoyo_realpath_from_path+0xe3/0x5d0 [ 332.200469][T13340] ? tomoyo_domain+0xd7/0x130 [ 332.200493][T13340] ? tomoyo_path_number_perm+0x219/0x630 [ 332.200511][T13340] tomoyo_path_number_perm+0x246/0x630 [ 332.200531][T13340] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 332.200547][T13340] ? __lock_acquire+0x6b5/0x2cf0 [ 332.200581][T13340] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 332.200616][T13340] ? __fget_files+0x2a/0x420 [ 332.200635][T13340] ? __fget_files+0x2a/0x420 [ 332.200650][T13340] ? __fget_files+0x3a0/0x420 [ 332.200666][T13340] ? __fget_files+0x2a/0x420 [ 332.200686][T13340] security_file_ioctl+0xc3/0x2a0 [ 332.200704][T13340] __se_sys_ioctl+0x47/0x170 [ 332.200729][T13340] do_syscall_64+0xe2/0xf80 [ 332.200745][T13340] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.200760][T13340] ? trace_irq_disable+0x37/0x100 [ 332.200776][T13340] ? clear_bhb_loop+0x60/0xb0 [ 332.200795][T13340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 332.200811][T13340] RIP: 0033:0x7f4d2e99aeb9 [ 332.200827][T13340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 332.200841][T13340] RSP: 002b:00007f4d2f7ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 332.200861][T13340] RAX: ffffffffffffffda RBX: 00007f4d2ec15fa0 RCX: 00007f4d2e99aeb9 [ 332.200874][T13340] RDX: 0000200000000000 RSI: 0000000000008b1a RDI: 0000000000000003 [ 332.200885][T13340] RBP: 00007f4d2f7ee090 R08: 0000000000000000 R09: 0000000000000000 [ 332.200895][T13340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 332.200905][T13340] R13: 00007f4d2ec16038 R14: 00007f4d2ec15fa0 R15: 00007ffd996d2458 [ 332.200932][T13340] [ 332.200951][T13340] ERROR: Out of memory at tomoyo_realpath_from_path. [ 332.692290][T13362] netlink: 'syz.2.2040': attribute type 1 has an invalid length. [ 332.701514][T13360] syzkaller0: entered promiscuous mode [ 332.707005][T13360] syzkaller0: entered allmulticast mode [ 332.751390][T13362] bond7: entered promiscuous mode [ 332.778592][T13362] bond7: entered allmulticast mode [ 332.784300][T13362] 8021q: adding VLAN 0 to HW filter on device bond7 [ 332.789870][T13373] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2044'. [ 332.961025][T13386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2044'. [ 333.003706][T13374] pimreg: entered allmulticast mode [ 333.057815][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 333.065916][ C1] lec:lec_tx_timeout: lec0 [ 333.070560][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 333.081985][T13391] netlink: 'syz.0.2048': attribute type 19 has an invalid length. [ 333.669864][T13425] netlink: 'syz.0.2057': attribute type 16 has an invalid length. [ 333.677732][T13425] netlink: 'syz.0.2057': attribute type 17 has an invalid length. [ 333.709677][T13425] gre0: left promiscuous mode [ 333.719800][T13425] gre0: left allmulticast mode [ 333.740683][T13425] sit0: left promiscuous mode [ 333.825115][T13425] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 333.888039][T13437] bridge_slave_0: left allmulticast mode [ 333.912016][T13437] bridge_slave_0: left promiscuous mode [ 333.928606][T13437] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.967554][T13437] bridge_slave_1: left allmulticast mode [ 333.976429][T13437] bridge_slave_1: left promiscuous mode [ 333.982679][T13437] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.996451][T13437] veth0_to_bond: left allmulticast mode [ 334.003456][T13437] veth0_to_bond: left promiscuous mode [ 334.010135][T13437] bridge3: port 2(veth0_to_bond) entered disabled state [ 334.023478][T13437] `: (slave bond_slave_0): Releasing backup interface [ 334.038509][T13437] `: (slave bond_slave_1): Releasing backup interface [ 334.047121][T13443] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2063'. [ 334.057578][T13437] team0: Port device team_slave_0 removed [ 334.065561][T13437] team0: Port device team_slave_1 removed [ 334.072942][T13437] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 334.098652][T13436] bridge_slave_0: left allmulticast mode [ 334.104469][T13436] bridge_slave_0: left promiscuous mode [ 334.110755][T13436] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.123745][T13436] bridge_slave_1: left allmulticast mode [ 334.134052][T13436] bridge_slave_1: left promiscuous mode [ 334.150153][T13436] bridge0: port 2(bridge_slave_1) entered disabled state [ 334.161767][T13436] bond0: (slave bond_slave_0): Releasing backup interface [ 334.181691][T13436] bond0: (slave bond_slave_1): Releasing backup interface [ 334.215064][T13436] team0: Port device team_slave_0 removed [ 334.241068][T13436] team0: Port device team_slave_1 removed [ 334.247510][T13436] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 334.260721][T13436] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 334.271698][T13436] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 334.279970][T13436] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.290520][T13436] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 334.385487][T13441] syzkaller0: entered promiscuous mode [ 334.404026][T13441] syzkaller0: entered allmulticast mode [ 334.744032][T13482] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2073'. [ 336.498031][T13510] erspan0: entered promiscuous mode [ 336.511928][T13510] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2081'. [ 336.513338][T13513] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2079'. [ 336.568876][T13516] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2083'. [ 336.586071][T13513] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2079'. [ 336.597606][T13516] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2083'. [ 336.611291][T13506] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2079'. [ 336.627300][T13516] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2083'. [ 336.652035][T13516] bond0: Caught tx_queue_len zero misconfig [ 336.722780][T13520] syzkaller0: entered promiscuous mode [ 336.728687][T13520] syzkaller0: entered allmulticast mode [ 336.772570][T13523] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2086'. [ 336.829817][T13528] syzkaller0: entered promiscuous mode [ 336.839319][T13528] syzkaller0: entered allmulticast mode [ 337.019957][T13542] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2092'. [ 337.117122][T13539] syzkaller0: entered promiscuous mode [ 337.135004][T13539] syzkaller0: entered allmulticast mode [ 337.277631][T13557] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2097'. [ 337.315256][T13557] pim6reg: entered allmulticast mode [ 337.378638][T13557] pim6reg: left allmulticast mode [ 337.477825][T13573] FAULT_INJECTION: forcing a failure. [ 337.477825][T13573] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 337.520152][T13573] CPU: 0 UID: 0 PID: 13573 Comm: syz.4.2102 Not tainted syzkaller #0 PREEMPT(full) [ 337.520177][T13573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 337.520188][T13573] Call Trace: [ 337.520195][T13573] [ 337.520203][T13573] dump_stack_lvl+0xe8/0x150 [ 337.520232][T13573] should_fail_ex+0x412/0x560 [ 337.520260][T13573] _copy_to_user+0x31/0xb0 [ 337.520287][T13573] simple_read_from_buffer+0xe1/0x170 [ 337.520311][T13573] proc_fail_nth_read+0x1bb/0x230 [ 337.520336][T13573] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 337.520361][T13573] ? rw_verify_area+0x2a6/0x4d0 [ 337.520383][T13573] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 337.520407][T13573] vfs_read+0x20c/0xa70 [ 337.520435][T13573] ? fdget_pos+0x246/0x320 [ 337.520455][T13573] ? __pfx___mutex_lock+0x10/0x10 [ 337.520475][T13573] ? __pfx_vfs_read+0x10/0x10 [ 337.520499][T13573] ? __fget_files+0x2a/0x420 [ 337.520521][T13573] ? __fget_files+0x3a0/0x420 [ 337.520538][T13573] ? __fget_files+0x2a/0x420 [ 337.520560][T13573] ksys_read+0x150/0x270 [ 337.520583][T13573] ? __pfx_ksys_read+0x10/0x10 [ 337.520615][T13573] do_syscall_64+0xe2/0xf80 [ 337.520632][T13573] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.520647][T13573] ? trace_irq_disable+0x37/0x100 [ 337.520662][T13573] ? clear_bhb_loop+0x60/0xb0 [ 337.520681][T13573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.520696][T13573] RIP: 0033:0x7f0fa355b78e [ 337.520712][T13573] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 337.520727][T13573] RSP: 002b:00007f0fa43a5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 337.520747][T13573] RAX: ffffffffffffffda RBX: 00007f0fa43a66c0 RCX: 00007f0fa355b78e [ 337.520759][T13573] RDX: 000000000000000f RSI: 00007f0fa43a60a0 RDI: 0000000000000003 [ 337.520769][T13573] RBP: 00007f0fa43a6090 R08: 0000000000000000 R09: 0000000000000000 [ 337.520780][T13573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 337.520789][T13573] R13: 00007f0fa3816038 R14: 00007f0fa3815fa0 R15: 00007ffc5e8a4f18 [ 337.520818][T13573] [ 338.077826][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 338.085863][ C1] lec:lec_tx_timeout: lec0 [ 338.093505][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 338.668188][T13650] netlink: 'syz.2.2130': attribute type 1 has an invalid length. [ 338.708822][T13642] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 338.783759][T13650] 8021q: adding VLAN 0 to HW filter on device bond8 [ 338.824409][T13659] 8021q: adding VLAN 0 to HW filter on device bond8 [ 338.855941][T13659] bond8: (slave vxcan1): The slave device specified does not support setting the MAC address [ 338.873063][T13659] bond8: (slave vxcan1): Error -95 calling set_mac_address [ 338.926414][T13650] veth9: entered promiscuous mode [ 338.939867][T13650] bond8: (slave veth9): Enslaving as an active interface with a down link [ 338.953853][T13660] netlink: 'syz.3.2133': attribute type 21 has an invalid length. [ 338.968325][T13660] IPv6: NLM_F_CREATE should be specified when creating new route [ 339.152673][T13684] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 339.467205][T13708] team0: Port device dummy0 removed [ 339.483435][T13708] bridge_slave_0: left allmulticast mode [ 339.490557][T13708] bridge_slave_0: left promiscuous mode [ 339.496443][T13708] bridge0: port 1(bridge_slave_0) entered disabled state [ 339.504609][T13711] openvswitch: netlink: IP tunnel dst address not specified [ 339.528259][T13708] bridge_slave_1: left allmulticast mode [ 339.539602][T13708] bridge_slave_1: left promiscuous mode [ 339.554446][T13708] bridge0: port 2(bridge_slave_1) entered disabled state [ 339.582867][T13708] `: (slave bond_slave_0): Releasing backup interface [ 339.600933][T13708] bond_slave_0: left allmulticast mode [ 339.629074][T13708] `: (slave bond_slave_1): Releasing backup interface [ 339.639245][T13708] bond_slave_1: left allmulticast mode [ 339.662753][T13708] team0: Port device team_slave_0 removed [ 339.691076][T13708] team0: Port device team_slave_1 removed [ 339.706770][T13708] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 339.715822][T13708] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 339.802727][T13708] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 339.810886][T13708] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 339.822045][T13708] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 339.857412][ T3581] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 339.877851][ T3581] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 340.180916][T13741] bridge_slave_0: left allmulticast mode [ 340.217044][T13741] bridge_slave_0: left promiscuous mode [ 340.253660][T13741] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.295887][T13741] bridge_slave_1: left allmulticast mode [ 340.307364][T13741] bridge_slave_1: left promiscuous mode [ 340.314319][T13741] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.349462][T13741] bond0: (slave bond_slave_0): Releasing backup interface [ 340.365159][T13741] bond0: (slave bond_slave_1): Releasing backup interface [ 340.377103][T13741] team0: Port device team_slave_0 removed [ 340.386171][T13741] team0: Port device team_slave_1 removed [ 340.392621][T13741] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 340.404095][T13741] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 340.413301][T13741] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 341.590773][T13802] __nla_validate_parse: 18 callbacks suppressed [ 341.590794][T13802] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2166'. [ 342.344346][T13780] syzkaller0: entered promiscuous mode [ 342.351211][T13780] syzkaller0: entered allmulticast mode [ 342.379526][T13806] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2168'. [ 343.648570][T13812] bridge_slave_0: left allmulticast mode [ 343.654259][T13812] bridge_slave_0: left promiscuous mode [ 343.660256][T13812] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.671845][T13812] bridge_slave_1: left allmulticast mode [ 343.677578][T13812] bridge_slave_1: left promiscuous mode [ 343.704035][T13812] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.725004][T13816] netlink: 6 bytes leftover after parsing attributes in process `syz.4.2172'. [ 343.736550][T13812] bond3: (slave veth0_to_bond): Releasing active interface [ 343.747491][T13812] bond0: (slave bond_slave_0): Releasing backup interface [ 343.757717][T13812] bond0: (slave bond_slave_1): Releasing backup interface [ 343.767930][T13812] team0: Port device team_slave_0 removed [ 343.774881][T13812] team0: Port device team_slave_1 removed [ 343.782548][T13812] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 343.790351][T13812] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 343.798924][T13812] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 343.812585][T13820] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2173'. [ 343.917824][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5820 ms [ 343.925875][ C1] lec:lec_tx_timeout: lec0 [ 343.931127][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 343.962861][T13822] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2174'. [ 344.161212][T13844] netlink: 'syz.2.2180': attribute type 1 has an invalid length. [ 344.236505][T13844] 8021q: adding VLAN 0 to HW filter on device bond9 [ 344.246012][T13853] netlink: zone id is out of range [ 344.252451][T13853] netlink: zone id is out of range [ 344.259154][T13853] netlink: zone id is out of range [ 344.277136][T13853] netlink: zone id is out of range [ 344.328233][T13853] netlink: zone id is out of range [ 344.335106][T13853] netlink: zone id is out of range [ 344.341559][T13853] netlink: zone id is out of range [ 344.346927][T13853] netlink: zone id is out of range [ 344.352657][T13853] netlink: zone id is out of range [ 344.364193][T13853] netlink: zone id is out of range [ 344.380779][T13850] 8021q: adding VLAN 0 to HW filter on device bond9 [ 344.399562][T13850] bond9: (slave vxcan1): The slave device specified does not support setting the MAC address [ 344.415131][T13850] bond9: (slave vxcan1): Error -95 calling set_mac_address [ 344.527709][T13859] team0: Cannot enslave team device to itself [ 344.551862][T13844] veth11: entered promiscuous mode [ 344.563871][T13844] bond9: (slave veth11): Enslaving as an active interface with a down link [ 344.582622][T13865] delete_channel: no stack [ 346.245529][T13903] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2198'. [ 346.266748][T13903] netlink: 'syz.4.2198': attribute type 7 has an invalid length. [ 346.285693][T13903] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2198'. [ 346.306096][T13906] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2199'. [ 346.316264][T13903] netlink: 'syz.4.2198': attribute type 7 has an invalid length. [ 346.372522][T13915] netlink: 'syz.0.2200': attribute type 10 has an invalid length. [ 346.380616][T13915] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2200'. [ 346.422028][T13915] team0: Port device geneve0 added [ 346.442523][ T3948] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.474774][ T3948] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.521564][ T3948] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.555941][ T3948] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 346.614910][T13930] team0: Device gtp0 is up. Set it down before adding it as a team port [ 346.687065][T13936] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2207'. [ 346.901640][T13947] syzkaller0: entered promiscuous mode [ 346.907244][T13947] syzkaller0: entered allmulticast mode [ 347.130878][T13958] netlink: 'syz.4.2213': attribute type 29 has an invalid length. [ 347.140224][T13958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2213'. [ 348.937830][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 348.945949][ C1] lec:lec_tx_timeout: lec0 [ 348.950670][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 349.302776][T13917] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 349.557622][T13980] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2221'. [ 349.602300][T13977] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2217'. [ 349.870643][T14000] net_ratelimit: 45 callbacks suppressed [ 349.870664][T14000] openvswitch: netlink: Multiple metadata blocks provided [ 350.034267][T14006] netlink: 207952 bytes leftover after parsing attributes in process `syz.3.2226'. [ 350.215138][T14019] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2228'. [ 350.224403][T14019] ip6tnl0: Caught tx_queue_len zero misconfig [ 350.243529][T14019] openvswitch: netlink: Message has 89 unknown bytes. [ 350.598439][T14043] openvswitch: netlink: Multiple metadata blocks provided [ 350.649179][T14045] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2241'. [ 350.916369][T14061] netlink: 'syz.2.2246': attribute type 1 has an invalid length. [ 351.091419][T14081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2249'. [ 351.100575][T14081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2249'. [ 351.103659][T14061] 8021q: adding VLAN 0 to HW filter on device bond10 [ 351.146627][T14086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 351.151604][T14079] 8021q: adding VLAN 0 to HW filter on device bond10 [ 351.164669][T14079] bond10: (slave vxcan1): The slave device specified does not support setting the MAC address [ 351.176893][T14079] bond10: (slave vxcan1): Error -95 calling set_mac_address [ 351.186466][T14061] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2246'. [ 351.235788][T14092] openvswitch: netlink: Key 6 has unexpected len 0 expected 2 [ 351.290604][T14084] veth13: entered promiscuous mode [ 351.311904][T14084] bond10: (slave veth13): Enslaving as an active interface with a down link [ 351.519727][T14109] xt_CT: You must specify a L4 protocol and not use inversions on it [ 351.544727][T14101] netlink: 'syz.4.2256': attribute type 9 has an invalid length. [ 351.546912][T14113] sctp: [Deprecated]: syz.2.2259 (pid 14113) Use of int in maxseg socket option. [ 351.546912][T14113] Use struct sctp_assoc_value instead [ 351.576701][T14101] netlink: 'syz.4.2256': attribute type 11 has an invalid length. [ 351.587416][T14101] netlink: 'syz.4.2256': attribute type 12 has an invalid length. [ 351.689111][T14116] geneve2: entered promiscuous mode [ 351.697035][T14116] __nla_validate_parse: 4 callbacks suppressed [ 351.697053][T14116] netlink: 92 bytes leftover after parsing attributes in process `syz.1.2261'. [ 351.776945][T14127] FAULT_INJECTION: forcing a failure. [ 351.776945][T14127] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 351.816795][T14127] CPU: 1 UID: 0 PID: 14127 Comm: syz.0.2264 Not tainted syzkaller #0 PREEMPT(full) [ 351.816832][T14127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 351.816848][T14127] Call Trace: [ 351.816856][T14127] [ 351.816863][T14127] dump_stack_lvl+0xe8/0x150 [ 351.816890][T14127] should_fail_ex+0x412/0x560 [ 351.816916][T14127] _copy_from_user+0x2d/0xb0 [ 351.816950][T14127] get_user_ifreq+0x6b/0x180 [ 351.816975][T14127] inet_ioctl+0x3ec/0x560 [ 351.816999][T14127] ? __pfx_inet_ioctl+0x10/0x10 [ 351.817039][T14127] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 351.817067][T14127] sock_do_ioctl+0x101/0x320 [ 351.817092][T14127] ? __pfx_sock_do_ioctl+0x10/0x10 [ 351.817113][T14127] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 351.817145][T14127] sock_ioctl+0x5c6/0x7f0 [ 351.817169][T14127] ? __pfx_sock_ioctl+0x10/0x10 [ 351.817191][T14127] ? __fget_files+0x2a/0x420 [ 351.817207][T14127] ? __fget_files+0x3a0/0x420 [ 351.817223][T14127] ? __fget_files+0x2a/0x420 [ 351.817242][T14127] ? bpf_lsm_file_ioctl+0x9/0x20 [ 351.817261][T14127] ? __pfx_sock_ioctl+0x10/0x10 [ 351.817283][T14127] __se_sys_ioctl+0xfc/0x170 [ 351.817306][T14127] do_syscall_64+0xe2/0xf80 [ 351.817323][T14127] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.817338][T14127] ? trace_irq_disable+0x37/0x100 [ 351.817354][T14127] ? clear_bhb_loop+0x60/0xb0 [ 351.817373][T14127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 351.817389][T14127] RIP: 0033:0x7f1eb279aeb9 [ 351.817405][T14127] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 351.817419][T14127] RSP: 002b:00007f1eb35fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 351.817438][T14127] RAX: ffffffffffffffda RBX: 00007f1eb2a15fa0 RCX: 00007f1eb279aeb9 [ 351.817450][T14127] RDX: 0000200000000080 RSI: 0000000000008916 RDI: 0000000000000003 [ 351.817461][T14127] RBP: 00007f1eb35fe090 R08: 0000000000000000 R09: 0000000000000000 [ 351.817471][T14127] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 351.817481][T14127] R13: 00007f1eb2a16038 R14: 00007f1eb2a15fa0 R15: 00007fff78436ae8 [ 351.817509][T14127] [ 352.222111][T14144] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 352.303198][T14152] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 352.336617][T14151] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2270'. [ 352.372506][T14162] netlink: 'syz.2.2275': attribute type 1 has an invalid length. [ 352.382193][T14162] netlink: 'syz.2.2275': attribute type 1 has an invalid length. [ 352.392659][T14162] netlink: 'syz.2.2275': attribute type 2 has an invalid length. [ 352.403602][T14162] netlink: 'syz.2.2275': attribute type 1 has an invalid length. [ 352.412867][T14162] netlink: 'syz.2.2275': attribute type 1 has an invalid length. [ 352.834441][T14189] xt_cluster: node mask cannot exceed total number of nodes [ 353.957883][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 353.965911][ C1] lec:lec_tx_timeout: lec0 [ 355.200828][T14142] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 355.384353][T14212] netlink: 'syz.4.2287': attribute type 1 has an invalid length. [ 355.529278][T14230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 355.590402][T14230] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 355.634892][T14239] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2299'. [ 355.644672][T14239] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2299'. [ 355.668742][T14244] netlink: 'syz.3.2300': attribute type 11 has an invalid length. [ 355.676658][T14244] netlink: 199828 bytes leftover after parsing attributes in process `syz.3.2300'. [ 355.757328][T14249] netlink: 224 bytes leftover after parsing attributes in process `syz.1.2301'. [ 355.891170][T14251] 8021q: adding VLAN 0 to HW filter on device bond6 [ 355.935622][T14267] bond6: (slave veth5): Enslaving as an active interface with a down link [ 356.068336][T14280] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 356.113297][T14287] SET target dimension over the limit! [ 356.130122][T14285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2312'. [ 356.138889][T14287] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2311'. [ 356.149391][T14287] openvswitch: netlink: Message has 4096 unknown bytes. [ 356.164469][T14289] validate_nla: 8 callbacks suppressed [ 356.164486][T14289] netlink: 'syz.3.2313': attribute type 7 has an invalid length. [ 356.198969][T14289] netlink: 'syz.3.2313': attribute type 7 has an invalid length. [ 356.344652][T14302] openvswitch: netlink: Multiple metadata blocks provided [ 356.610021][T14308] syzkaller1: entered promiscuous mode [ 356.612387][T14318] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 356.628565][T14317] netlink: 'syz.4.2322': attribute type 1 has an invalid length. [ 356.636902][T14308] syzkaller1: entered allmulticast mode [ 356.641841][T14318] netlink: 'syz.3.2319': attribute type 4 has an invalid length. [ 356.829339][T14330] __nla_validate_parse: 4 callbacks suppressed [ 356.829356][T14330] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2327'. [ 356.887237][T14332] netlink: 'syz.0.2326': attribute type 1 has an invalid length. [ 356.890840][T14334] netlink: 'syz.4.2328': attribute type 1 has an invalid length. [ 356.903270][T14334] netlink: 228 bytes leftover after parsing attributes in process `syz.4.2328'. [ 356.937333][T14332] bond7: entered promiscuous mode [ 356.943173][T14332] bond7: entered allmulticast mode [ 356.949912][T14332] 8021q: adding VLAN 0 to HW filter on device bond7 [ 357.040481][T14338] netlink: 'syz.2.2329': attribute type 2 has an invalid length. [ 357.140382][T14334] syz.4.2328 (14334) used greatest stack depth: 17656 bytes left [ 357.325036][T14362] netlink: 'syz.2.2338': attribute type 1 has an invalid length. [ 357.333450][T14358] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2336'. [ 357.349947][T14366] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2339'. [ 357.361547][T14366] netlink: 'syz.4.2339': attribute type 7 has an invalid length. [ 357.381163][T14366] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2339'. [ 357.391373][T14366] netlink: 'syz.4.2339': attribute type 7 has an invalid length. [ 357.479918][T14360] syzkaller0: entered allmulticast mode [ 357.515565][T14375] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2341'. [ 357.525792][T14375] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2341'. [ 357.673204][T14386] raw_sendmsg: syz.0.2346 forgot to set AF_INET. Fix it! [ 357.673426][T14383] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2344'. [ 357.876119][T14401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2351'. [ 358.329515][T14370] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 358.504578][T14445] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2362'. [ 358.698340][T14453] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 358.782662][T14464] syzkaller0: entered promiscuous mode [ 358.802606][T14464] syzkaller0: entered allmulticast mode [ 358.913445][T14466] tap0: tun_chr_ioctl cmd 1074025672 [ 358.918932][T14466] tap0: ignored: set checksum disabled [ 359.183372][T14495] IPVS: set_ctl: invalid protocol: 60 224.0.0.2:20004 [ 359.357083][T14512] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 359.390085][T14520] openvswitch: netlink: Flow actions attr not present in new flow. [ 360.034572][T14562] : entered promiscuous mode [ 360.077101][T14563] tipc: Enabled bearer , priority 10 [ 360.360182][T14569] tipc: Enabled bearer , priority 0 [ 360.474156][T14569] syzkaller0: entered promiscuous mode [ 360.480205][T14569] syzkaller0: entered allmulticast mode [ 360.486446][T14569] tipc: Resetting bearer [ 360.493635][T14593] openvswitch: netlink: Multiple metadata blocks provided [ 360.536844][T14568] tipc: Resetting bearer [ 360.715142][T14606] sctp: [Deprecated]: syz.2.2409 (pid 14606) Use of int in maxseg socket option. [ 360.715142][T14606] Use struct sctp_assoc_value instead [ 361.984104][T14568] tipc: Disabling bearer [ 362.012352][T14620] validate_nla: 4 callbacks suppressed [ 362.012369][T14620] netlink: 'syz.4.2411': attribute type 29 has an invalid length. [ 362.026862][T14620] __nla_validate_parse: 6 callbacks suppressed [ 362.026877][T14620] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2411'. [ 362.051527][ T9] tipc: Node number set to 4139541329 [ 362.188634][T14640] openvswitch: netlink: Multiple metadata blocks provided [ 362.206199][T14639] syzkaller0: entered promiscuous mode [ 362.211896][T14639] syzkaller0: entered allmulticast mode [ 362.374353][T14648] ref_ctr_offset mismatch. inode: 0x64 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x10 [ 362.425531][T14652] bridge2: entered promiscuous mode [ 362.444502][T14652] bridge2: entered allmulticast mode [ 362.650700][T14665] netlink: 'syz.2.2430': attribute type 8 has an invalid length. [ 363.191557][T14701] netlink: 'syz.0.2441': attribute type 9 has an invalid length. [ 363.315076][T14699] bond15: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 363.334465][T14699] bond15 (unregistering): Released all slaves [ 363.642920][T14721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2442'. [ 363.670933][T14721] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2442'. [ 363.692291][T14726] openvswitch: netlink: Multiple metadata blocks provided [ 363.730480][T14721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2442'. [ 363.739963][T14721] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2442'. [ 363.860093][T14738] FAULT_INJECTION: forcing a failure. [ 363.860093][T14738] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 363.889859][T14738] CPU: 1 UID: 0 PID: 14738 Comm: syz.3.2451 Not tainted syzkaller #0 PREEMPT(full) [ 363.889886][T14738] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 363.889897][T14738] Call Trace: [ 363.889904][T14738] [ 363.889912][T14738] dump_stack_lvl+0xe8/0x150 [ 363.889941][T14738] should_fail_ex+0x412/0x560 [ 363.889967][T14738] _copy_from_user+0x2d/0xb0 [ 363.889995][T14738] ___sys_sendmsg+0x1c6/0x360 [ 363.890019][T14738] ? __lock_acquire+0x6b5/0x2cf0 [ 363.890048][T14738] ? __pfx____sys_sendmsg+0x10/0x10 [ 363.890104][T14738] ? __fget_files+0x2a/0x420 [ 363.890122][T14738] ? __fget_files+0x3a0/0x420 [ 363.890151][T14738] __x64_sys_sendmsg+0x1bd/0x2a0 [ 363.890177][T14738] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 363.890209][T14738] ? __pfx_ksys_write+0x10/0x10 [ 363.890252][T14738] do_syscall_64+0xe2/0xf80 [ 363.890271][T14738] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.890288][T14738] ? trace_irq_disable+0x37/0x100 [ 363.890305][T14738] ? clear_bhb_loop+0x60/0xb0 [ 363.890327][T14738] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 363.890345][T14738] RIP: 0033:0x7f902ed9aeb9 [ 363.890361][T14738] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 363.890377][T14738] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 363.890397][T14738] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 363.890411][T14738] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 363.890422][T14738] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 363.890434][T14738] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 363.890443][T14738] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 363.890471][T14738] [ 364.606941][T14752] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2455'. [ 364.716889][T14759] netlink: 'syz.2.2455': attribute type 5 has an invalid length. [ 364.728165][T14759] netlink: 3681 bytes leftover after parsing attributes in process `syz.2.2455'. [ 364.852127][T14769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2461'. [ 364.876665][T14769] netlink: 'syz.0.2461': attribute type 7 has an invalid length. [ 364.895730][T14769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2461'. [ 364.932448][T14774] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 364.959947][T14769] netlink: 'syz.0.2461': attribute type 7 has an invalid length. [ 365.100604][T14784] FAULT_INJECTION: forcing a failure. [ 365.100604][T14784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 365.110391][T14787] netlink: 'syz.0.2468': attribute type 1 has an invalid length. [ 365.123510][T14787] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2468'. [ 365.141395][T14787] xt_CT: You must specify a L4 protocol and not use inversions on it [ 365.152530][T14784] CPU: 0 UID: 0 PID: 14784 Comm: syz.2.2467 Not tainted syzkaller #0 PREEMPT(full) [ 365.152556][T14784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 365.152570][T14784] Call Trace: [ 365.152577][T14784] [ 365.152585][T14784] dump_stack_lvl+0xe8/0x150 [ 365.152611][T14784] should_fail_ex+0x412/0x560 [ 365.152636][T14784] _copy_from_user+0x2d/0xb0 [ 365.152659][T14784] nr_rt_ioctl+0x966/0xf90 [ 365.152692][T14784] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 365.152722][T14784] ? apparmor_capable+0x137/0x1a0 [ 365.152752][T14784] ? capable+0x88/0xe0 [ 365.152769][T14784] ? nr_ioctl+0x1b1/0x3b0 [ 365.152792][T14784] sock_do_ioctl+0x101/0x320 [ 365.152818][T14784] ? __pfx_sock_do_ioctl+0x10/0x10 [ 365.152841][T14784] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 365.152873][T14784] sock_ioctl+0x5c6/0x7f0 [ 365.152898][T14784] ? __pfx_sock_ioctl+0x10/0x10 [ 365.152921][T14784] ? __fget_files+0x2a/0x420 [ 365.152939][T14784] ? __fget_files+0x3a0/0x420 [ 365.152955][T14784] ? __fget_files+0x2a/0x420 [ 365.152975][T14784] ? bpf_lsm_file_ioctl+0x9/0x20 [ 365.152995][T14784] ? __pfx_sock_ioctl+0x10/0x10 [ 365.153017][T14784] __se_sys_ioctl+0xfc/0x170 [ 365.153040][T14784] do_syscall_64+0xe2/0xf80 [ 365.153057][T14784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.153073][T14784] ? trace_irq_disable+0x37/0x100 [ 365.153088][T14784] ? clear_bhb_loop+0x60/0xb0 [ 365.153107][T14784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 365.153139][T14784] RIP: 0033:0x7f4d2e99aeb9 [ 365.153156][T14784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 365.153170][T14784] RSP: 002b:00007f4d2f7ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 365.153188][T14784] RAX: ffffffffffffffda RBX: 00007f4d2ec15fa0 RCX: 00007f4d2e99aeb9 [ 365.153200][T14784] RDX: 0000200000000280 RSI: 000000000000890b RDI: 0000000000000004 [ 365.153210][T14784] RBP: 00007f4d2f7ee090 R08: 0000000000000000 R09: 0000000000000000 [ 365.153221][T14784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 365.153231][T14784] R13: 00007f4d2ec16038 R14: 00007f4d2ec15fa0 R15: 00007ffd996d2458 [ 365.153260][T14784] [ 365.442959][ T6953] lec:lec_start_xmit: lec0:No lecd attached [ 365.839215][T14821] tipc: Started in network mode [ 365.854402][T14821] tipc: Node identity ac14140f, cluster identity 4711 [ 365.868867][T14821] tipc: New replicast peer: 255.255.255.255 [ 365.885802][T14821] tipc: Enabled bearer , priority 10 [ 366.041015][T14837] syzkaller0: entered promiscuous mode [ 366.047860][T14837] syzkaller0: entered allmulticast mode [ 366.249651][T14852] netlink: 'syz.2.2488': attribute type 1 has an invalid length. [ 366.473472][T14866] netlink: 'syz.2.2493': attribute type 9 has an invalid length. [ 366.533254][T14872] tipc: New replicast peer: 255.255.255.255 [ 366.547293][T14872] tipc: Enabled bearer , priority 10 [ 366.686681][T14877] syzkaller0: entered promiscuous mode [ 366.704615][T14877] syzkaller0: entered allmulticast mode [ 366.728864][T14877] 0: reclassify loop, rule prio 0, protocol 800 [ 366.998753][ T9] tipc: Node number set to 2886997007 [ 367.052940][T14907] __nla_validate_parse: 1 callbacks suppressed [ 367.052962][T14907] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2508'. [ 367.125178][T14910] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2509'. [ 367.152543][T14911] ipvlan2: entered allmulticast mode [ 367.159307][T14911] dummy0: entered allmulticast mode [ 367.172915][T14911] batman_adv: batadv0: Adding interface: ipvlan2 [ 367.180019][T14911] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 367.222824][T14911] batman_adv: batadv0: Interface activated: ipvlan2 [ 367.283102][T14919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2514'. [ 367.292310][T14919] netlink: 'syz.2.2514': attribute type 7 has an invalid length. [ 367.316341][T14919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2514'. [ 367.326990][T14919] netlink: 'syz.2.2514': attribute type 7 has an invalid length. [ 367.391843][T14921] syzkaller0: entered promiscuous mode [ 367.397454][T14921] syzkaller0: entered allmulticast mode [ 367.405190][ T12] 0: reclassify loop, rule prio 0, protocol 800 [ 367.482634][T14930] netlink: 'syz.0.2518': attribute type 3 has an invalid length. [ 367.484603][T14929] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2519'. [ 367.498023][T14930] netlink: 666 bytes leftover after parsing attributes in process `syz.0.2518'. [ 367.516585][T14929] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 367.679965][T14940] 8021q: adding VLAN 0 to HW filter on device bond0 [ 367.724387][T14940] bond0: (slave rose0): Enslaving as an active interface with an up link [ 367.762262][ T9] tipc: Node number set to 100663296 [ 367.809544][T14948] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 368.034488][T14963] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 368.233389][T14979] syzkaller0: entered promiscuous mode [ 368.239411][T14979] syzkaller0: entered allmulticast mode [ 368.397119][T14991] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2538'. [ 368.429720][T14995] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2540'. [ 368.685753][T15011] xt_hashlimit: size too large, truncated to 1048576 [ 368.776808][T15018] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2547'. [ 368.818148][T15018] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 368.942060][T15026] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 368.956972][T15027] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 369.057028][T15034] netlink: 256 bytes leftover after parsing attributes in process `syz.3.2551'. [ 369.645776][T15061] tipc: Enabled bearer , priority 0 [ 369.681683][T15061] syzkaller0: entered allmulticast mode [ 369.726841][T15078] netlink: 'syz.0.2563': attribute type 9 has an invalid length. [ 370.013536][T15098] x_tables: duplicate underflow at hook 2 [ 370.037073][T15101] bridge_slave_0: default FDB implementation only supports local addresses [ 370.089282][T15105] netlink: 'syz.2.2571': attribute type 13 has an invalid length. [ 370.097345][T15102] tipc: Enabling of bearer rejected, already enabled [ 370.127708][T15105] macvtap0: entered allmulticast mode [ 370.140667][T15105] macvtap0: refused to change device tx_queue_len [ 370.191689][T15061] tipc: Resetting bearer [ 370.291820][T15060] tipc: Disabling bearer [ 370.322536][T15120] netlink: 'syz.4.2575': attribute type 9 has an invalid length. [ 370.487748][T15123] bond8: option xmit_hash_policy: invalid value (64) [ 370.510406][T15123] bond8 (unregistering): Released all slaves [ 370.564730][T15134] tipc: Enabling of bearer rejected, already enabled [ 370.852792][T15154] syzkaller0: entered promiscuous mode [ 370.877837][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5430 ms [ 370.881398][T15154] syzkaller0: entered allmulticast mode [ 370.885911][ C1] lec:lec_tx_timeout: lec0 [ 371.049545][T15166] netlink: 'syz.1.2589': attribute type 9 has an invalid length. [ 371.142942][T15171] syzkaller0: entered promiscuous mode [ 371.169409][T15171] syzkaller0: entered allmulticast mode [ 371.200200][T15174] 0: reclassify loop, rule prio 0, protocol 800 [ 371.530655][T15194] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 372.189910][T15235] netlink: 'syz.4.2609': attribute type 16 has an invalid length. [ 372.198877][T15235] netlink: 'syz.4.2609': attribute type 17 has an invalid length. [ 372.283730][T15235] 8021q: adding VLAN 0 to HW filter on device ` [ 372.292539][T15235] 8021q: adding VLAN 0 to HW filter on device team0 [ 372.314401][T15235] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 372.385824][ T9] C speed is unknown, defaulting to 1000 [ 372.391730][ T9] syz2: Port: 1 Link ACTIVE [ 372.402109][T15242] __nla_validate_parse: 11 callbacks suppressed [ 372.402129][T15242] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2611'. [ 372.444501][ T9] C speed is unknown, defaulting to 1000 [ 372.463311][T15245] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2612'. [ 372.736538][T15263] netlink: 'syz.0.2620': attribute type 1 has an invalid length. [ 372.796768][T15263] 8021q: adding VLAN 0 to HW filter on device bond8 [ 372.822149][T15263] bond8: (slave ip6gretap1): making interface the new active one [ 372.833475][T15263] bond8: (slave ip6gretap1): Enslaving as an active interface with an up link [ 372.860519][T15271] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2621'. [ 372.953564][T15283] netlink: 'syz.3.2623': attribute type 16 has an invalid length. [ 372.974773][T15283] netlink: 'syz.3.2623': attribute type 17 has an invalid length. [ 372.997310][T15285] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2626'. [ 373.016686][T15283] erspan0: left promiscuous mode [ 373.033547][T15283] 8021q: adding VLAN 0 to HW filter on device bond0 [ 373.047116][T15283] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 373.142079][T15280] C speed is unknown, defaulting to 1000 [ 373.292490][T15299] tipc: New replicast peer: 255.255.255.255 [ 373.305174][T15299] tipc: Enabled bearer , priority 10 [ 373.316707][T15299] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2630'. [ 373.326209][T15299] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2630'. [ 373.368605][T15307] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2633'. [ 373.382649][T15307] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 373.394145][T15307] FAULT_INJECTION: forcing a failure. [ 373.394145][T15307] name failslab, interval 1, probability 0, space 0, times 0 [ 373.410006][T15307] CPU: 1 UID: 0 PID: 15307 Comm: syz.3.2633 Not tainted syzkaller #0 PREEMPT(full) [ 373.410030][T15307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 373.410040][T15307] Call Trace: [ 373.410047][T15307] [ 373.410054][T15307] dump_stack_lvl+0xe8/0x150 [ 373.410083][T15307] should_fail_ex+0x412/0x560 [ 373.410110][T15307] should_failslab+0xa8/0x100 [ 373.410133][T15307] kmem_cache_alloc_noprof+0x87/0x6e0 [ 373.410161][T15307] ? skb_clone+0x212/0x3a0 [ 373.410190][T15307] skb_clone+0x212/0x3a0 [ 373.410217][T15307] __netlink_deliver_tap+0x404/0x850 [ 373.410250][T15307] ? netlink_deliver_tap+0x2e/0x1b0 [ 373.410270][T15307] netlink_deliver_tap+0x19c/0x1b0 [ 373.410298][T15307] netlink_sendskb+0x68/0x140 [ 373.410326][T15307] netlink_unicast+0x3a3/0x9b0 [ 373.410361][T15307] ? __pfx_netlink_unicast+0x10/0x10 [ 373.410397][T15307] netlink_rcv_skb+0x2b6/0x4b0 [ 373.410416][T15307] ? __pfx_genl_rcv_msg+0x10/0x10 [ 373.410441][T15307] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 373.410457][T15307] ? genl_rcv+0x19/0x40 [ 373.410499][T15307] ? down_read+0x272/0x2e0 [ 373.410518][T15307] ? genl_rcv+0xd/0x40 [ 373.410541][T15307] genl_rcv+0x28/0x40 [ 373.410561][T15307] netlink_unicast+0x80f/0x9b0 [ 373.410597][T15307] ? __pfx_netlink_unicast+0x10/0x10 [ 373.410621][T15307] ? __alloc_skb+0x193/0x390 [ 373.410642][T15307] ? netlink_sendmsg+0x650/0xb40 [ 373.410658][T15307] ? skb_put+0x11b/0x210 [ 373.410683][T15307] netlink_sendmsg+0x813/0xb40 [ 373.410712][T15307] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.410735][T15307] ? aa_sock_msg_perm+0xf1/0x1b0 [ 373.410759][T15307] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 373.410781][T15307] ? __pfx_netlink_sendmsg+0x10/0x10 [ 373.410799][T15307] ____sys_sendmsg+0xa68/0xad0 [ 373.410823][T15307] ? __might_fault+0xaf/0x130 [ 373.410855][T15307] ? __pfx_____sys_sendmsg+0x10/0x10 [ 373.410888][T15307] ? import_iovec+0x73/0xa0 [ 373.410918][T15307] ___sys_sendmsg+0x2a5/0x360 [ 373.410939][T15307] ? __lock_acquire+0x6b5/0x2cf0 [ 373.410969][T15307] ? __pfx____sys_sendmsg+0x10/0x10 [ 373.411030][T15307] ? __fget_files+0x2a/0x420 [ 373.411049][T15307] ? __fget_files+0x3a0/0x420 [ 373.411078][T15307] __x64_sys_sendmsg+0x1bd/0x2a0 [ 373.411105][T15307] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 373.411138][T15307] ? __pfx_ksys_write+0x10/0x10 [ 373.411176][T15307] do_syscall_64+0xe2/0xf80 [ 373.411194][T15307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.411212][T15307] ? trace_irq_disable+0x37/0x100 [ 373.411229][T15307] ? clear_bhb_loop+0x60/0xb0 [ 373.411251][T15307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 373.411269][T15307] RIP: 0033:0x7f902ed9aeb9 [ 373.411294][T15307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 373.411310][T15307] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 373.411330][T15307] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 373.411344][T15307] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 373.411360][T15307] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 373.411372][T15307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.411383][T15307] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 373.411415][T15307] [ 374.080814][T15321] ip6tnl0: Caught tx_queue_len zero misconfig [ 374.126357][T15321] veth0: entered promiscuous mode [ 374.131960][T15321] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2636'. [ 374.143429][T15321] veth0 (unregistering): left promiscuous mode [ 374.197332][T15335] xt_hashlimit: size too large, truncated to 1048576 [ 374.355832][T15346] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.2642'. [ 374.366517][T15346] netlink: ct family unspecified [ 374.523056][T15353] tipc: Enabling of bearer rejected, already enabled [ 374.528597][T15350] xt_cluster: node mask cannot exceed total number of nodes [ 374.532804][T15353] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2644'. [ 374.888964][T15377] netlink: 'syz.0.2653': attribute type 14 has an invalid length. [ 374.896954][T15377] netlink: 'syz.0.2653': attribute type 13 has an invalid length. [ 375.006765][T15390] xt_hashlimit: size too large, truncated to 1048576 [ 375.293128][T15404] tipc: New replicast peer: 255.255.255.255 [ 375.308982][T15404] tipc: Enabled bearer , priority 10 [ 375.427488][T15416] xt_CT: You must specify a L4 protocol and not use inversions on it [ 375.492130][T15424] FAULT_INJECTION: forcing a failure. [ 375.492130][T15424] name failslab, interval 1, probability 0, space 0, times 0 [ 375.541337][T15424] CPU: 1 UID: 0 PID: 15424 Comm: syz.3.2671 Not tainted syzkaller #0 PREEMPT(full) [ 375.541368][T15424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 375.541380][T15424] Call Trace: [ 375.541386][T15424] [ 375.541394][T15424] dump_stack_lvl+0xe8/0x150 [ 375.541421][T15424] should_fail_ex+0x412/0x560 [ 375.541448][T15424] should_failslab+0xa8/0x100 [ 375.541470][T15424] __kmalloc_cache_noprof+0x83/0x6e0 [ 375.541490][T15424] ? nfnetlink_rcv+0xfe1/0x27b0 [ 375.541522][T15424] nfnetlink_rcv+0xfe1/0x27b0 [ 375.541582][T15424] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 375.541622][T15424] ? ref_tracker_free+0x693/0x840 [ 375.541672][T15424] ? __netlink_deliver_tap+0x807/0x850 [ 375.541690][T15424] ? netlink_deliver_tap+0x2e/0x1b0 [ 375.541725][T15424] netlink_unicast+0x80f/0x9b0 [ 375.541760][T15424] ? __pfx_netlink_unicast+0x10/0x10 [ 375.541785][T15424] ? __alloc_skb+0x193/0x390 [ 375.541804][T15424] ? netlink_sendmsg+0x650/0xb40 [ 375.541820][T15424] ? skb_put+0x11b/0x210 [ 375.541844][T15424] netlink_sendmsg+0x813/0xb40 [ 375.541871][T15424] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.541891][T15424] ? aa_sock_msg_perm+0xf1/0x1b0 [ 375.541914][T15424] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 375.541935][T15424] ? __pfx_netlink_sendmsg+0x10/0x10 [ 375.541951][T15424] ____sys_sendmsg+0xa68/0xad0 [ 375.541972][T15424] ? __might_fault+0xaf/0x130 [ 375.542002][T15424] ? __pfx_____sys_sendmsg+0x10/0x10 [ 375.542033][T15424] ? import_iovec+0x73/0xa0 [ 375.542085][T15424] ___sys_sendmsg+0x2a5/0x360 [ 375.542107][T15424] ? __lock_acquire+0x6b5/0x2cf0 [ 375.542136][T15424] ? __pfx____sys_sendmsg+0x10/0x10 [ 375.542194][T15424] ? __fget_files+0x2a/0x420 [ 375.542212][T15424] ? __fget_files+0x3a0/0x420 [ 375.542243][T15424] __x64_sys_sendmsg+0x1bd/0x2a0 [ 375.542269][T15424] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 375.542301][T15424] ? __pfx_ksys_write+0x10/0x10 [ 375.542338][T15424] do_syscall_64+0xe2/0xf80 [ 375.542357][T15424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.542374][T15424] ? trace_irq_disable+0x37/0x100 [ 375.542391][T15424] ? clear_bhb_loop+0x60/0xb0 [ 375.542413][T15424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.542430][T15424] RIP: 0033:0x7f902ed9aeb9 [ 375.542447][T15424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.542463][T15424] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 375.542483][T15424] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 375.542497][T15424] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 375.542508][T15424] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 375.542519][T15424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 375.542530][T15424] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 375.542560][T15424] [ 375.971773][T15431] openvswitch: netlink: Actions may not be safe on all matching packets [ 376.039478][T15438] team_slave_1: Caught tx_queue_len zero misconfig [ 376.734139][T15468] tipc: Enabling of bearer rejected, already enabled [ 377.008209][T15476] x_tables: duplicate underflow at hook 3 [ 377.042925][T15481] xt_hashlimit: size too large, truncated to 1048576 [ 377.053669][T15483] netlink: 'syz.2.2687': attribute type 1 has an invalid length. [ 377.315593][T15495] x_tables: duplicate underflow at hook 3 [ 377.516746][T15503] syzkaller0: entered promiscuous mode [ 377.524585][T15503] syzkaller0: entered allmulticast mode [ 377.537079][T15503] tipc: Enabled bearer , priority 0 [ 377.558577][T15501] tipc: Resetting bearer [ 377.594518][T15501] tipc: Disabling bearer [ 377.639070][T15484] lec0: mtu less than device minimum [ 377.645564][T15484] lec:lec_atm_send: lec0: change_mtu to 0 failed [ 377.681812][T15479] lec:lec_atm_close: lec0: Shut down! [ 377.809373][T15520] tipc: Enabling of bearer rejected, already enabled [ 377.819545][T15520] __nla_validate_parse: 18 callbacks suppressed [ 377.819561][T15520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2698'. [ 377.835167][T15520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2698'. [ 377.879962][T15523] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2701'. [ 377.905623][T15526] xt_hashlimit: size too large, truncated to 1048576 [ 378.117033][T15540] xt_CT: You must specify a L4 protocol and not use inversions on it [ 378.147360][T15540] netlink: 'syz.2.2706': attribute type 8 has an invalid length. [ 378.253332][T15550] netlink: 'syz.0.2707': attribute type 9 has an invalid length. [ 378.293384][T15553] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2710'. [ 378.333887][T15554] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2709'. [ 378.361016][T15549] C speed is unknown, defaulting to 1000 [ 378.589591][T15570] tipc: Enabling of bearer rejected, already enabled [ 378.618479][T15570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2714'. [ 378.634044][T15570] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2714'. [ 378.651917][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.940364][T15585] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2720'. [ 378.953798][T15588] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2718'. [ 378.955097][T15589] syzkaller0: entered promiscuous mode [ 378.969058][T15589] syzkaller0: entered allmulticast mode [ 378.975149][T15588] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2718'. [ 379.209953][T15598] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 379.478866][T15611] FAULT_INJECTION: forcing a failure. [ 379.478866][T15611] name failslab, interval 1, probability 0, space 0, times 0 [ 379.523681][T15611] CPU: 0 UID: 0 PID: 15611 Comm: syz.3.2728 Not tainted syzkaller #0 PREEMPT(full) [ 379.523707][T15611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 379.523719][T15611] Call Trace: [ 379.523726][T15611] [ 379.523733][T15611] dump_stack_lvl+0xe8/0x150 [ 379.523762][T15611] should_fail_ex+0x412/0x560 [ 379.523793][T15611] should_failslab+0xa8/0x100 [ 379.523815][T15611] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 379.523843][T15611] ? __alloc_skb+0x193/0x390 [ 379.523863][T15611] ? __alloc_skb+0x1d7/0x390 [ 379.523880][T15611] ? __local_bh_enable_ip+0xd0/0x130 [ 379.523898][T15611] ? __alloc_skb+0x193/0x390 [ 379.523919][T15611] __alloc_skb+0x1d7/0x390 [ 379.523943][T15611] netlink_ack+0x146/0xa50 [ 379.523961][T15611] ? kasan_quarantine_put+0xbb/0x1f0 [ 379.523987][T15611] ? lockdep_hardirqs_on+0x7a/0x110 [ 379.524008][T15611] ? nfnetlink_rcv+0x260c/0x27b0 [ 379.524040][T15611] nfnetlink_rcv+0x2517/0x27b0 [ 379.524096][T15611] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 379.524135][T15611] ? ref_tracker_free+0x693/0x840 [ 379.524182][T15611] ? __netlink_deliver_tap+0x807/0x850 [ 379.524200][T15611] ? netlink_deliver_tap+0x2e/0x1b0 [ 379.524233][T15611] netlink_unicast+0x80f/0x9b0 [ 379.524265][T15611] ? __pfx_netlink_unicast+0x10/0x10 [ 379.524290][T15611] ? __alloc_skb+0x193/0x390 [ 379.524310][T15611] ? netlink_sendmsg+0x650/0xb40 [ 379.524326][T15611] ? skb_put+0x11b/0x210 [ 379.524350][T15611] netlink_sendmsg+0x813/0xb40 [ 379.524377][T15611] ? __pfx_netlink_sendmsg+0x10/0x10 [ 379.524399][T15611] ? aa_sock_msg_perm+0xf1/0x1b0 [ 379.524424][T15611] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 379.524445][T15611] ? __pfx_netlink_sendmsg+0x10/0x10 [ 379.524462][T15611] ____sys_sendmsg+0xa68/0xad0 [ 379.524486][T15611] ? __might_fault+0xaf/0x130 [ 379.524518][T15611] ? __pfx_____sys_sendmsg+0x10/0x10 [ 379.524555][T15611] ? import_iovec+0x73/0xa0 [ 379.524584][T15611] ___sys_sendmsg+0x2a5/0x360 [ 379.524611][T15611] ? __lock_acquire+0x6b5/0x2cf0 [ 379.524639][T15611] ? __pfx____sys_sendmsg+0x10/0x10 [ 379.524695][T15611] ? __fget_files+0x2a/0x420 [ 379.524714][T15611] ? __fget_files+0x3a0/0x420 [ 379.524743][T15611] __x64_sys_sendmsg+0x1bd/0x2a0 [ 379.524768][T15611] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 379.524799][T15611] ? __pfx_ksys_write+0x10/0x10 [ 379.524832][T15611] do_syscall_64+0xe2/0xf80 [ 379.524854][T15611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.524870][T15611] ? trace_irq_disable+0x37/0x100 [ 379.524887][T15611] ? clear_bhb_loop+0x60/0xb0 [ 379.524908][T15611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 379.524925][T15611] RIP: 0033:0x7f902ed9aeb9 [ 379.524941][T15611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.524955][T15611] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 379.524975][T15611] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 379.524988][T15611] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 379.524999][T15611] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 379.525010][T15611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 379.525021][T15611] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 379.525050][T15611] [ 380.070662][T15627] netlink: 'syz.2.2731': attribute type 5 has an invalid length. [ 380.186682][T15632] syzkaller0: entered promiscuous mode [ 380.198531][T15632] syzkaller0: entered allmulticast mode [ 380.528968][ T5917] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 380.794113][T15669] netlink: 'syz.3.2747': attribute type 15 has an invalid length. [ 380.809594][T15669] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 380.828943][T15673] netlink: 'syz.4.2748': attribute type 33 has an invalid length. [ 380.920685][T15678] syzkaller0: entered promiscuous mode [ 380.927619][T15678] syzkaller0: entered allmulticast mode [ 381.029493][ T5917] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 381.066255][T15687] pim6reg530: entered allmulticast mode [ 381.191461][T15697] mac80211_hwsim hwsim7 wlan1: Caught tx_queue_len zero misconfig [ 381.571210][T15703] tipc: Resetting bearer [ 382.212739][T15718] syz_tun: entered allmulticast mode [ 382.228677][T15731] syz_tun: left allmulticast mode [ 382.243760][ T2129] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.273882][ T2129] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.310145][ T2129] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.349801][ T2129] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.372849][ T2129] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.428491][ T2129] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.469882][T15738] bridge0: port 1(netdevsim0) entered blocking state [ 382.476876][T15738] bridge0: port 1(netdevsim0) entered disabled state [ 382.499442][T15738] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 382.519381][T15749] xt_TCPMSS: Only works on TCP SYN packets [ 382.539458][ T2129] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 382.564420][ T2129] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 382.605302][T15752] syzkaller0: entered promiscuous mode [ 382.611270][T15752] syzkaller0: entered allmulticast mode [ 382.633015][T15744] netlink: zone id is out of range [ 382.638573][T15744] netlink: del zone limit has 4 unknown bytes [ 382.826263][T15765] x_tables: duplicate entry at hook 1 [ 382.831011][T15769] Unsupported ieee802154 address type: 0 [ 382.877852][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5200 ms [ 382.885885][ C1] lec:lec_tx_timeout: lec0 [ 382.892062][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 382.899310][T15768] __nla_validate_parse: 14 callbacks suppressed [ 382.899327][T15768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2774'. [ 382.943794][T15776] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2777'. [ 382.958650][T15776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2777'. [ 382.968924][T15776] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2777'. [ 383.303440][T15799] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2785'. [ 383.361261][T15799] bond4: (slave gretap0): Device is not bonding slave [ 383.368570][T15799] bond4: option active_slave: invalid value (gretap0) [ 383.377326][T15799] bond4 (unregistering): Released all slaves [ 383.395992][T15808] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2784'. [ 383.502353][T15806] syzkaller0: entered promiscuous mode [ 383.512331][T15806] syzkaller0: entered allmulticast mode [ 383.674929][T15823] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 383.909026][T15838] dummy0: entered promiscuous mode [ 383.932745][T15838] dummy0: entered allmulticast mode [ 383.963700][T15841] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 384.212894][T15858] 8021q: VLANs not supported on ip_vti0 [ 384.289348][T15860] team0: Port device ip6gre1 added [ 384.302360][T15862] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2805'. [ 384.649869][T15876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2809'. [ 384.672381][ T1087] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.690116][ T1087] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.701688][T15876] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2809'. [ 384.712571][ T1087] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.727711][ T1087] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 384.822183][T15895] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2816'. [ 385.079232][T15913] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 385.106822][T15895] bond0 (unregistering): Released all slaves [ 385.429009][T15934] sctp: [Deprecated]: syz.3.2825 (pid 15934) Use of int in max_burst socket option deprecated. [ 385.429009][T15934] Use struct sctp_assoc_value instead [ 385.461697][T15932] C speed is unknown, defaulting to 1000 [ 386.618880][T15986] tipc: Enabling of bearer rejected, already enabled [ 387.437877][ T5845] Bluetooth: hci0: command 0x0406 tx timeout [ 387.438062][ T5153] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 387.917836][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5020 ms [ 387.925880][ C1] lec:lec_tx_timeout: lec0 [ 388.041333][T16079] __nla_validate_parse: 9 callbacks suppressed [ 388.041352][T16079] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2861'. [ 388.093956][T16079] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2861'. [ 388.105041][T16082] xt_hashlimit: size too large, truncated to 1048576 [ 388.435005][T16134] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2869'. [ 388.447997][T16134] openvswitch: netlink: Duplicate key (type 32). [ 388.519823][T16146] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2871'. [ 388.538829][T16146] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 388.973058][T16087] workqueue: Failed to create a rescuer kthread for wq "nfc32_nci_rx_wq": -EINTR [ 389.528107][ T5153] Bluetooth: hci0: command 0x0406 tx timeout [ 389.652771][T16237] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2882'. [ 389.727532][T16237] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2882'. [ 390.188704][T16252] netlink: 'syz.2.2887': attribute type 22 has an invalid length. [ 390.196560][T16252] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2887'. [ 390.329844][T16252] netlink: 'syz.2.2887': attribute type 22 has an invalid length. [ 390.340397][T16252] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2887'. [ 390.835282][T16271] netlink: 'syz.4.2897': attribute type 1 has an invalid length. [ 391.050321][T16279] dummy0: left promiscuous mode [ 391.056017][T16279] dummy0: left allmulticast mode [ 391.081311][T16279] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 391.111473][T16281] tipc: Enabling of bearer rejected, already enabled [ 391.122337][T16281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2900'. [ 391.131889][T16281] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2900'. [ 391.496396][T16315] FAULT_INJECTION: forcing a failure. [ 391.496396][T16315] name failslab, interval 1, probability 0, space 0, times 0 [ 391.537145][T16315] CPU: 0 UID: 0 PID: 16315 Comm: syz.3.2912 Not tainted syzkaller #0 PREEMPT(full) [ 391.537170][T16315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 391.537181][T16315] Call Trace: [ 391.537189][T16315] [ 391.537196][T16315] dump_stack_lvl+0xe8/0x150 [ 391.537222][T16315] should_fail_ex+0x412/0x560 [ 391.537248][T16315] should_failslab+0xa8/0x100 [ 391.537287][T16315] kmem_cache_alloc_node_noprof+0x8b/0x6f0 [ 391.537329][T16315] ? __alloc_skb+0x193/0x390 [ 391.537352][T16315] ? __alloc_skb+0x1d7/0x390 [ 391.537368][T16315] ? __local_bh_enable_ip+0xd0/0x130 [ 391.537386][T16315] ? __alloc_skb+0x193/0x390 [ 391.537405][T16315] __alloc_skb+0x1d7/0x390 [ 391.537428][T16315] netlink_sendmsg+0x5d4/0xb40 [ 391.537456][T16315] ? __pfx_netlink_sendmsg+0x10/0x10 [ 391.537479][T16315] ? aa_sock_msg_perm+0xf1/0x1b0 [ 391.537502][T16315] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 391.537525][T16315] sock_write_iter+0x503/0x550 [ 391.537555][T16315] ? __pfx_sock_write_iter+0x10/0x10 [ 391.537596][T16315] ? bpf_lsm_file_permission+0x9/0x20 [ 391.537617][T16315] ? security_file_permission+0x75/0x260 [ 391.537643][T16315] vfs_write+0x61d/0xb90 [ 391.537676][T16315] ? __pfx_vfs_write+0x10/0x10 [ 391.537711][T16315] ? __fget_files+0x2a/0x420 [ 391.537739][T16315] ksys_write+0x150/0x270 [ 391.537766][T16315] ? __pfx_ksys_write+0x10/0x10 [ 391.537802][T16315] do_syscall_64+0xe2/0xf80 [ 391.537826][T16315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.537847][T16315] ? trace_irq_disable+0x37/0x100 [ 391.537866][T16315] ? clear_bhb_loop+0x60/0xb0 [ 391.537888][T16315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.537906][T16315] RIP: 0033:0x7f902ed9aeb9 [ 391.537923][T16315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 391.537939][T16315] RSP: 002b:00007f902fc23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 391.537960][T16315] RAX: ffffffffffffffda RBX: 00007f902f015fa0 RCX: 00007f902ed9aeb9 [ 391.537973][T16315] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 391.537985][T16315] RBP: 00007f902fc23090 R08: 0000000000000000 R09: 0000000000000000 [ 391.537997][T16315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 391.538007][T16315] R13: 00007f902f016038 R14: 00007f902f015fa0 R15: 00007ffcbfa5e6c8 [ 391.538037][T16315] [ 391.961408][T16329] tipc: Enabling of bearer rejected, already enabled [ 392.110464][T16336] netlink: 'syz.0.2919': attribute type 3 has an invalid length. [ 392.581613][T16366] tipc: Enabling of bearer rejected, already enabled [ 392.699503][T16370] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 392.891057][T16381] netlink: 'syz.3.2936': attribute type 1 has an invalid length. [ 392.905361][T16384] FAULT_INJECTION: forcing a failure. [ 392.905361][T16384] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 392.918621][T16384] CPU: 0 UID: 0 PID: 16384 Comm: syz.2.2937 Not tainted syzkaller #0 PREEMPT(full) [ 392.918647][T16384] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 392.918658][T16384] Call Trace: [ 392.918665][T16384] [ 392.918682][T16384] dump_stack_lvl+0xe8/0x150 [ 392.918711][T16384] should_fail_ex+0x412/0x560 [ 392.918739][T16384] _copy_to_user+0x31/0xb0 [ 392.918769][T16384] simple_read_from_buffer+0xe1/0x170 [ 392.918793][T16384] proc_fail_nth_read+0x1bb/0x230 [ 392.918823][T16384] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 392.918851][T16384] ? rw_verify_area+0x2a6/0x4d0 [ 392.918875][T16384] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 392.918901][T16384] vfs_read+0x20c/0xa70 [ 392.918923][T16384] ? fdget_pos+0x246/0x320 [ 392.918947][T16384] ? __pfx___mutex_lock+0x10/0x10 [ 392.918968][T16384] ? __pfx_vfs_read+0x10/0x10 [ 392.918994][T16384] ? __fget_files+0x2a/0x420 [ 392.919018][T16384] ? __fget_files+0x3a0/0x420 [ 392.919037][T16384] ? __fget_files+0x2a/0x420 [ 392.919065][T16384] ksys_read+0x150/0x270 [ 392.919091][T16384] ? __pfx_ksys_read+0x10/0x10 [ 392.919127][T16384] do_syscall_64+0xe2/0xf80 [ 392.919146][T16384] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.919171][T16384] ? trace_irq_disable+0x37/0x100 [ 392.919187][T16384] ? clear_bhb_loop+0x60/0xb0 [ 392.919208][T16384] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 392.919224][T16384] RIP: 0033:0x7f4d2e95b78e [ 392.919241][T16384] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 392.919257][T16384] RSP: 002b:00007f4d2f7edfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 392.919277][T16384] RAX: ffffffffffffffda RBX: 00007f4d2f7ee6c0 RCX: 00007f4d2e95b78e [ 392.919291][T16384] RDX: 000000000000000f RSI: 00007f4d2f7ee0a0 RDI: 0000000000000006 [ 392.919302][T16384] RBP: 00007f4d2f7ee090 R08: 0000000000000000 R09: 0000000000000000 [ 392.919314][T16384] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 392.919325][T16384] R13: 00007f4d2ec16038 R14: 00007f4d2ec15fa0 R15: 00007ffd996d2458 [ 392.919356][T16384] [ 393.178118][T16379] __nla_validate_parse: 9 callbacks suppressed [ 393.178137][T16379] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2933'. [ 393.242335][T16390] xt_hashlimit: size too large, truncated to 1048576 [ 393.449839][T16406] unsupported nla_type 33542 [ 393.453783][T16404] tipc: Enabling of bearer rejected, already enabled [ 393.470781][T16404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2943'. [ 393.498740][T16404] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2943'. [ 393.527214][T16408] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2946'. [ 393.528622][T16410] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 393.625453][T16413] ipt_REJECT: TCP_RESET invalid for non-tcp [ 393.671054][T16417] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2948'. [ 393.845463][T16428] xt_bpf: check failed: parse error [ 393.944576][T16432] xt_hashlimit: size too large, truncated to 1048576 [ 394.380837][T16443] tipc: Enabling of bearer rejected, already enabled [ 394.400548][T16443] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2959'. [ 394.416667][T16443] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2959'. [ 394.492940][T16451] netlink: 'syz.1.2963': attribute type 2 has an invalid length. [ 394.505398][T16452] netlink: 6 bytes leftover after parsing attributes in process `syz.1.2963'. [ 394.609747][T16464] netlink: 11 bytes leftover after parsing attributes in process `syz.1.2968'. [ 394.644581][T16457] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2966'. [ 394.722562][T16470] xt_hashlimit: size too large, truncated to 1048576 [ 394.979762][T16488] netlink: 'syz.0.2975': attribute type 3 has an invalid length. [ 394.994300][T16488] netlink: 'syz.0.2975': attribute type 1 has an invalid length. [ 395.158767][T16501] netlink: 'syz.1.2980': attribute type 9 has an invalid length. [ 395.162591][T16499] tipc: Enabling of bearer rejected, already enabled [ 395.344707][T16515] FAULT_INJECTION: forcing a failure. [ 395.344707][T16515] name failslab, interval 1, probability 0, space 0, times 0 [ 395.383313][T16515] CPU: 0 UID: 0 PID: 16515 Comm: syz.2.2985 Not tainted syzkaller #0 PREEMPT(full) [ 395.383338][T16515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 395.383350][T16515] Call Trace: [ 395.383357][T16515] [ 395.383365][T16515] dump_stack_lvl+0xe8/0x150 [ 395.383392][T16515] should_fail_ex+0x412/0x560 [ 395.383416][T16515] should_failslab+0xa8/0x100 [ 395.383438][T16515] __kmalloc_cache_noprof+0x83/0x6e0 [ 395.383455][T16515] ? inet6_dump_fib+0x325/0xca0 [ 395.383479][T16515] inet6_dump_fib+0x325/0xca0 [ 395.383502][T16515] ? inet6_dump_fib+0x130/0xca0 [ 395.383524][T16515] ? __pfx_inet6_dump_fib+0x10/0x10 [ 395.383541][T16515] ? inet_dump_fib+0x133/0x900 [ 395.383580][T16515] ? __pfx_inet6_dump_fib+0x10/0x10 [ 395.383599][T16515] rtnl_dump_all+0x325/0x550 [ 395.383627][T16515] ? __pfx_rtnl_dump_all+0x10/0x10 [ 395.383656][T16515] rtnl_dumpit+0xa2/0x200 [ 395.383677][T16515] netlink_dump+0x722/0xe80 [ 395.383704][T16515] ? __pfx_netlink_dump+0x10/0x10 [ 395.383718][T16515] ? __netlink_lookup+0x7e4/0x8b0 [ 395.383750][T16515] ? netlink_lookup+0x30/0x200 [ 395.383764][T16515] ? netlink_lookup+0x30/0x200 [ 395.383776][T16515] ? netlink_lookup+0x30/0x200 [ 395.383794][T16515] __netlink_dump_start+0x5cb/0x7e0 [ 395.383817][T16515] rtnetlink_rcv_msg+0xa3a/0xbe0 [ 395.383837][T16515] ? __pfx_rtnl_dump_all+0x10/0x10 [ 395.383855][T16515] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 395.383872][T16515] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 395.383892][T16515] ? __pfx_rtnl_dumpit+0x10/0x10 [ 395.383910][T16515] ? __pfx_rtnl_dump_all+0x10/0x10 [ 395.383940][T16515] netlink_rcv_skb+0x232/0x4b0 [ 395.383958][T16515] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 395.383976][T16515] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 395.383999][T16515] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.384019][T16515] netlink_unicast+0x80f/0x9b0 [ 395.384046][T16515] ? __pfx_netlink_unicast+0x10/0x10 [ 395.384065][T16515] ? __alloc_skb+0x193/0x390 [ 395.384081][T16515] ? netlink_sendmsg+0x650/0xb40 [ 395.384095][T16515] ? skb_put+0x11b/0x210 [ 395.384114][T16515] netlink_sendmsg+0x813/0xb40 [ 395.384135][T16515] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.384153][T16515] ? aa_sock_msg_perm+0xf1/0x1b0 [ 395.384172][T16515] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 395.384190][T16515] sock_write_iter+0x503/0x550 [ 395.384212][T16515] ? __pfx_sock_write_iter+0x10/0x10 [ 395.384246][T16515] ? bpf_lsm_file_permission+0x9/0x20 [ 395.384264][T16515] ? security_file_permission+0x75/0x260 [ 395.384288][T16515] vfs_write+0x61d/0xb90 [ 395.384319][T16515] ? __pfx_vfs_write+0x10/0x10 [ 395.384346][T16515] ? __fget_files+0x2a/0x420 [ 395.384368][T16515] ksys_write+0x150/0x270 [ 395.384390][T16515] ? __pfx_ksys_write+0x10/0x10 [ 395.384418][T16515] do_syscall_64+0xe2/0xf80 [ 395.384433][T16515] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.384446][T16515] ? trace_irq_disable+0x37/0x100 [ 395.384459][T16515] ? clear_bhb_loop+0x60/0xb0 [ 395.384476][T16515] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.384489][T16515] RIP: 0033:0x7f4d2e99aeb9 [ 395.384504][T16515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 395.384516][T16515] RSP: 002b:00007f4d2f7ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 395.384533][T16515] RAX: ffffffffffffffda RBX: 00007f4d2ec15fa0 RCX: 00007f4d2e99aeb9 [ 395.384544][T16515] RDX: 0000000000000024 RSI: 0000200000000000 RDI: 0000000000000003 [ 395.384552][T16515] RBP: 00007f4d2f7ee090 R08: 0000000000000000 R09: 0000000000000000 [ 395.384560][T16515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 395.384568][T16515] R13: 00007f4d2ec16038 R14: 00007f4d2ec15fa0 R15: 00007ffd996d2458 [ 395.384592][T16515] [ 396.075190][T16542] IPVS: length: 14 != 8 [ 396.213987][T16552] netlink: 'syz.3.2993': attribute type 6 has an invalid length. [ 396.241142][T16555] netlink: 'syz.2.2994': attribute type 10 has an invalid length. [ 396.241371][T16552] netlink: 'syz.3.2993': attribute type 6 has an invalid length. [ 396.253299][T16555] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 396.283644][T16555] 8021q: VLANs not supported on ip6gre0 [ 396.852988][T16602] netlink: 'syz.1.3010': attribute type 1 has an invalid length. [ 396.874579][T16599] bridge_slave_0: default FDB implementation only supports local addresses [ 396.884116][T16598] bridge_slave_0: default FDB implementation only supports local addresses [ 396.936142][T16602] 8021q: adding VLAN 0 to HW filter on device bond6 [ 396.946850][T16602] netlink: 'syz.1.3010': attribute type 2 has an invalid length. [ 396.969826][T16602] [ 396.972297][T16602] ====================================================== [ 396.979356][T16602] WARNING: possible circular locking dependency detected [ 396.986490][T16602] syzkaller #0 Not tainted [ 396.991006][T16602] ------------------------------------------------------ [ 396.998032][T16602] syz.1.3010/16602 is trying to acquire lock: [ 397.004101][T16602] ffffffff8fb26e98 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 397.013404][T16602] [ 397.013404][T16602] but task is already holding lock: [ 397.020773][T16602] ffff88802e9ad770 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 397.030165][T16602] [ 397.030165][T16602] which lock already depends on the new lock. [ 397.030165][T16602] [ 397.040656][T16602] [ 397.040656][T16602] the existing dependency chain (in reverse order) is: [ 397.049658][T16602] [ 397.049658][T16602] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 397.057648][T16602] _raw_spin_lock_bh+0x36/0x50 [ 397.062939][T16602] nr_rt_device_down+0x153/0x860 [ 397.068401][T16602] nr_device_event+0x137/0x150 [ 397.073724][T16602] notifier_call_chain+0x19d/0x3a0 [ 397.079455][T16602] netif_close_many+0x2ae/0x420 [ 397.084827][T16602] netif_close+0x160/0x220 [ 397.089753][T16602] dev_close+0x10a/0x220 [ 397.094507][T16602] bpq_device_event+0x377/0x6a0 [ 397.099868][T16602] notifier_call_chain+0x19d/0x3a0 [ 397.105508][T16602] netif_close_many+0x2ae/0x420 [ 397.110952][T16602] netif_close+0x160/0x220 [ 397.115877][T16602] dev_close+0x10a/0x220 [ 397.120647][T16602] bond_setup_by_slave+0x5f/0x3d0 [ 397.126202][T16602] bond_enslave+0x847/0x3c40 [ 397.131312][T16602] bond_do_ioctl+0x6ec/0x8d0 [ 397.136423][T16602] dev_ifsioc+0x961/0x1280 [ 397.141358][T16602] dev_ioctl+0x7b4/0x1150 [ 397.146197][T16602] sock_do_ioctl+0x23e/0x320 [ 397.151314][T16602] sock_ioctl+0x5c6/0x7f0 [ 397.156173][T16602] __se_sys_ioctl+0xfc/0x170 [ 397.161330][T16602] do_syscall_64+0xe2/0xf80 [ 397.166374][T16602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.172805][T16602] [ 397.172805][T16602] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 397.180619][T16602] _raw_spin_lock_bh+0x36/0x50 [ 397.185916][T16602] nr_rt_device_down+0xbe/0x860 [ 397.191295][T16602] nr_device_event+0x137/0x150 [ 397.196584][T16602] notifier_call_chain+0x19d/0x3a0 [ 397.202231][T16602] netif_close_many+0x2ae/0x420 [ 397.207595][T16602] netif_close+0x160/0x220 [ 397.212528][T16602] dev_close+0x10a/0x220 [ 397.217305][T16602] bpq_device_event+0x377/0x6a0 [ 397.222675][T16602] notifier_call_chain+0x19d/0x3a0 [ 397.228302][T16602] netif_close_many+0x2ae/0x420 [ 397.233696][T16602] netif_close+0x160/0x220 [ 397.238642][T16602] dev_close+0x10a/0x220 [ 397.243394][T16602] bond_setup_by_slave+0x5f/0x3d0 [ 397.248946][T16602] bond_enslave+0x847/0x3c40 [ 397.254048][T16602] bond_do_ioctl+0x6ec/0x8d0 [ 397.259166][T16602] dev_ifsioc+0x961/0x1280 [ 397.264089][T16602] dev_ioctl+0x7b4/0x1150 [ 397.268928][T16602] sock_do_ioctl+0x23e/0x320 [ 397.274030][T16602] sock_ioctl+0x5c6/0x7f0 [ 397.278872][T16602] __se_sys_ioctl+0xfc/0x170 [ 397.283985][T16602] do_syscall_64+0xe2/0xf80 [ 397.289003][T16602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.295438][T16602] [ 397.295438][T16602] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 397.303336][T16602] __lock_acquire+0x15a5/0x2cf0 [ 397.308699][T16602] lock_acquire+0x106/0x330 [ 397.313707][T16602] _raw_spin_lock_bh+0x36/0x50 [ 397.318980][T16602] nr_remove_neigh+0x25/0xe0 [ 397.324079][T16602] nr_add_node+0x1e41/0x2630 [ 397.329177][T16602] nr_rt_ioctl+0xe59/0xf90 [ 397.334103][T16602] sock_do_ioctl+0x101/0x320 [ 397.339202][T16602] sock_ioctl+0x5c6/0x7f0 [ 397.344057][T16602] __se_sys_ioctl+0xfc/0x170 [ 397.349155][T16602] do_syscall_64+0xe2/0xf80 [ 397.354160][T16602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.360561][T16602] [ 397.360561][T16602] other info that might help us debug this: [ 397.360561][T16602] [ 397.370951][T16602] Chain exists of: [ 397.370951][T16602] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 397.370951][T16602] [ 397.384755][T16602] Possible unsafe locking scenario: [ 397.384755][T16602] [ 397.392194][T16602] CPU0 CPU1 [ 397.397544][T16602] ---- ---- [ 397.402894][T16602] lock(&nr_node->node_lock); [ 397.407648][T16602] lock(nr_node_list_lock); [ 397.414740][T16602] lock(&nr_node->node_lock); [ 397.422005][T16602] lock(nr_neigh_list_lock); [ 397.426664][T16602] [ 397.426664][T16602] *** DEADLOCK *** [ 397.426664][T16602] [ 397.434800][T16602] 1 lock held by syz.1.3010/16602: [ 397.439887][T16602] #0: ffff88802e9ad770 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 397.449771][T16602] [ 397.449771][T16602] stack backtrace: [ 397.455733][T16602] CPU: 0 UID: 0 PID: 16602 Comm: syz.1.3010 Not tainted syzkaller #0 PREEMPT(full) [ 397.455748][T16602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 397.455755][T16602] Call Trace: [ 397.455761][T16602] [ 397.455767][T16602] dump_stack_lvl+0xe8/0x150 [ 397.455784][T16602] print_circular_bug+0x2e1/0x300 [ 397.455814][T16602] check_noncircular+0x12e/0x150 [ 397.455826][T16602] __lock_acquire+0x15a5/0x2cf0 [ 397.455845][T16602] ? nr_remove_neigh+0x25/0xe0 [ 397.455859][T16602] lock_acquire+0x106/0x330 [ 397.455872][T16602] ? nr_remove_neigh+0x25/0xe0 [ 397.455886][T16602] ? do_raw_spin_lock+0x12b/0x2f0 [ 397.455899][T16602] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 397.455910][T16602] ? nr_remove_neigh+0x25/0xe0 [ 397.455923][T16602] _raw_spin_lock_bh+0x36/0x50 [ 397.455938][T16602] ? nr_remove_neigh+0x25/0xe0 [ 397.455951][T16602] nr_remove_neigh+0x25/0xe0 [ 397.455965][T16602] nr_add_node+0x1e41/0x2630 [ 397.455980][T16602] ? nr_call_to_digi+0x126/0x1b0 [ 397.455993][T16602] nr_rt_ioctl+0xe59/0xf90 [ 397.456008][T16602] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 397.456023][T16602] ? apparmor_capable+0x137/0x1a0 [ 397.456040][T16602] ? capable+0x88/0xe0 [ 397.456049][T16602] ? nr_ioctl+0x1b1/0x3b0 [ 397.456060][T16602] sock_do_ioctl+0x101/0x320 [ 397.456076][T16602] ? __pfx_sock_do_ioctl+0x10/0x10 [ 397.456090][T16602] ? do_futex+0x395/0x420 [ 397.456108][T16602] sock_ioctl+0x5c6/0x7f0 [ 397.456122][T16602] ? __pfx_sock_ioctl+0x10/0x10 [ 397.456136][T16602] ? __fget_files+0x2a/0x420 [ 397.456147][T16602] ? __fget_files+0x3a0/0x420 [ 397.456164][T16602] ? __fget_files+0x2a/0x420 [ 397.456183][T16602] ? bpf_lsm_file_ioctl+0x9/0x20 [ 397.456202][T16602] ? __pfx_sock_ioctl+0x10/0x10 [ 397.456222][T16602] __se_sys_ioctl+0xfc/0x170 [ 397.456246][T16602] do_syscall_64+0xe2/0xf80 [ 397.456265][T16602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.456282][T16602] ? trace_irq_disable+0x37/0x100 [ 397.456296][T16602] ? clear_bhb_loop+0x60/0xb0 [ 397.456307][T16602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 397.456317][T16602] RIP: 0033:0x7fcb33b9aeb9 [ 397.456328][T16602] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 397.456337][T16602] RSP: 002b:00007fcb3499f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 397.456348][T16602] RAX: ffffffffffffffda RBX: 00007fcb33e15fa0 RCX: 00007fcb33b9aeb9 [ 397.456356][T16602] RDX: 0000200000000280 RSI: 000000000000890b RDI: 0000000000000007 [ 397.456363][T16602] RBP: 00007fcb33c08c1f R08: 0000000000000000 R09: 0000000000000000 [ 397.456369][T16602] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 397.456375][T16602] R13: 00007fcb33e16038 R14: 00007fcb33e15fa0 R15: 00007ffcf147a3f8 [ 397.456386][T16602] [ 398.407953][ T5845] Bluetooth: hci1: command 0x0406 tx timeout