last executing test programs: 23m37.837672816s ago: executing program 2 (id=5992): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000440)={0xfffffb11, {{0x2, 0x4e21, @loopback}}}, 0x88) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='blkio.throttle.io_serviced\x00', 0x275a, 0x0) write$cgroup_int(r2, &(0x7f0000000000), 0xffffff6a) sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff004) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r3, 0x0, 0x0) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) unshare(0x400) bpf$PROG_LOAD(0x23, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001c0001000000000004086aa42d"], 0x30}}, 0x0) setsockopt$inet_group_source_req(r1, 0x0, 0x2f, &(0x7f0000000500)={0x2, {{0x2, 0x4e21, @local}}, {{0x2, 0x4e20, @private=0xa010100}}}, 0x108) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r4, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) 23m37.186889936s ago: executing program 2 (id=5999): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0xb20, 0x1c0, 0x43, 0xa0, 0x0, 0x98, 0xa88, 0x178, 0x178, 0xa88, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00'}, 0x12a, 0x1a0, 0x1c0, 0x0, {0x0, 0x7a010000}, [@common=@inet=@recent0={{0xf8}, {0x41, 0x0, 0x8, 0x0, 'syz0\x00'}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x3, {0x100000001}}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x888, 0x8c8, 0x0, {}, [@common=@unspec=@connbytes={{0x38}, {[{0xb}]}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x9}, {0x3}, {0x1, 0x1}, {0x0, 0x3}, {0x4, 0x2}, {0xb1d}, {0x3}, {0x8}, {0x2, 0x3}, {0x3}, {0x103}], [{0xe8f3, 0x5}, {0x1d, 0x6}, {0x1, 0x8}, {0x0, 0x4}, {0x4, 0xc3e}, {0x1, 0x100}, {0x6, 0x7}, {0x3, 0x3}, {0xf2, 0x3}, {0x3ff, 0x8}, {0x10, 0x3}], 0x6, 0x6}, {[{0x80, 0x3}, {0x2}, {0x6, 0x1}, {0x355cbac3, 0x2}, {0x0, 0x2}, {0x0, 0x2}, {0x7}, {0xe7, 0x2}, {0x3, 0x3}, {0x5598e8fe, 0x2}, {0x6, 0x1}], [{0x9, 0x9097}, {0x7, 0x9}, {0x7, 0xa}, {0x6, 0x8}, {0x20080, 0x5}, {0x13, 0xc0000000}, {0x40, 0xb}, {0x9, 0x6}, {0x4, 0x2}, {0x6, 0x7fffffff}, {0x7fffffff, 0x400}], 0x7}, {[{0x84, 0x2}, {}, {0x0, 0x2}, {0xffffffff, 0x1}, {}, {0x5, 0x1}, {0x5, 0x2}, {0x8, 0x3}, {0x2, 0x3}, {0x8, 0x1}, {0x7, 0x1}], [{0x9, 0x5}, {0x80, 0x32}, {0x0, 0xfffffff7}, {0xff, 0x1}, {0x7, 0xfffffff6}, {0xdb9, 0xff4}, {0x6, 0x3ff}, {0x3, 0x6}, {0x5, 0x10}, {0x9, 0x6}, {0x10000, 0x10002}], 0x3, 0x2a}, {[{0x3, 0x2}, {0xa, 0x1}, {0x6, 0x1}, {0x10, 0x3}, {0x2, 0x2}, {0x2, 0x2}, {0x3, 0x1}, {0x2, 0x3}, {0x3, 0x1}, {0x2, 0x2}, {0x477d, 0x1}], [{0x0, 0xffffffff}, {0x200, 0x6}, {0x4be1, 0x4044}, {0x1}, {0x5, 0xc}, {0x3, 0x4}, {0x2, 0x4}, {0x800, 0x8000}, {0x8, 0x800}, {0x3, 0x2}, {0xe, 0x8000}], 0x4, 0xb}, {[{0x7, 0x1}, {0xd, 0x3}, {0x5}, {0x61}, {0x9}, {}, {0x2}, {0x1}, {0x40000000, 0x2}, {0x9, 0x3}, {0x5, 0x3}], [{0x58d, 0x3ff}, {0x0, 0x7f}, {0x6}, {0xfc9b, 0x80000001}, {0x101, 0x7}, {0x7, 0x1}, {0x7, 0x8001}, {0x2, 0x1}, {0x2, 0x2}, {0x9, 0x4cf}, {0x7, 0x10000}], 0x1}, {[{0x2}, {0x9}, {0x8, 0x1}, {0x2, 0x3}, {0x71, 0x3}, {0x0, 0x2}, {0xe, 0x2}, {0x6, 0x2}, {0x5}, {0x3000000, 0x3}, {0x6}], [{0x9, 0x3}, {0x5, 0x7fffffff}, {0xffff, 0x4}, {0x0, 0x7}, {0x8, 0xb502}, {0x1ff, 0x86}, {0x6, 0xffffffff}, {0x3, 0x4}, {0x5, 0x6}, {0xf, 0xf93}, {0x5, 0x4}], 0x3, 0x3}, {[{0x7, 0x1}, {0x3, 0x1}, {0x45d7}, {0xfff, 0x3}, {0xc4f, 0x3}, {0x0, 0x2}, {0x400, 0x1}, {0x2, 0x1}, {0x4, 0x2}, {0xfffffffd}, {0x2}], [{0x3, 0x6}, {0xed, 0xd}, {0x80, 0xb81d}, {0x2ca, 0x80000000}, {0x8, 0xff}, {0x7, 0x45a8}, {0x8, 0x6}, {0x4, 0x1}, {0x2, 0x6}, {0xfc, 0x6}, {0xd, 0x138c}], 0x6}, {[{0x4, 0x1}, {0x800}, {0x9, 0x2}, {0xf0000000, 0x2}, {0x6, 0x3}, {0x3, 0x2}, {0x8, 0x2}, {}, {0x9}, {0x400, 0x2}, {0x8, 0x3}], [{0x7, 0xfffffffd}, {0x2}, {0x2, 0x2}, {0x8f, 0x6}, {0x7, 0x5}, {0x8, 0x7}, {0xb, 0x82c6}, {0xb1b}, {0xbd5c, 0xffff}, {0x1, 0x9b8d}, {0xec, 0x5}], 0x0, 0x6}, {[{0x8}, {0x0, 0x1}, {0xac000000}, {0x6, 0x2}, {0x2d8, 0x3}, {0x7e3ea4bc}, {0x8, 0x1324f499ce9a99e8}, {0x4f, 0x3}, {0x4, 0x2}, {0xfffffff7}, {0x3, 0x2}], [{0x5, 0x42}, {0x76a74689, 0xfffff156}, {0x1}, {0x8000, 0x7}, {0x400, 0xdd}, {0xfff, 0x8}, {0x76b, 0xfffffffe}, {0xa6d00, 0xfffffff7}, {0x10001, 0xfc8d}, {0x0, 0x10001}, {0x4, 0x3}], 0x1, 0x9}, {[{0x8, 0x1}, {0x3, 0x3}, {0x18, 0x3}, {0x3ff, 0x3}, {0x7fffffff}, {0x8}, {0x1}, {0x8, 0x3}, {0xf1b6}, {0x80, 0x3}, {0x4, 0x2}], [{0x2, 0x4}, {0x3, 0xf}, {0x9, 0x6}, {0x7f, 0x8}, {0x7, 0x273e1899}, {0x4, 0x1}, {0x6, 0x3}, {0x1, 0xb7}, {0x8, 0x3}, {0x3, 0x1}, {0x7ff, 0x63}], 0xb, 0x3}, {[{0x1, 0x2}, {0x6, 0x3}, {0xffff, 0x1}, {0x1}, {0x4, 0x3}, {0x4, 0x3}, {0xaa7}, {0x100, 0x3}, {0x2}, {0xfffffff7, 0xb90af65875a5dc08}, {0x4, 0x3}], [{0x3}, {0x8001, 0x7}, {0x10000, 0x7524}, {0x73d, 0x4}, {0x0, 0x280000}, {0x3, 0x3af}, {0x5, 0x2}, {0x101, 0xbf}, {0x10000, 0x6}, {0x3, 0x800}], 0x8, 0x5}], 0x3}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0xb80) 23m36.769389649s ago: executing program 2 (id=6003): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180000002500010324bd5502ffdbdf25010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x4004088}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000480)=""/56, 0x38}, {&(0x7f0000000280)=""/28, 0x1c}, {&(0x7f0000000600)=""/244, 0xf4}, {&(0x7f0000000700)=""/207, 0xcf}, {&(0x7f0000000800)=""/222, 0xde}, {&(0x7f0000000540)=""/105, 0x69}, {&(0x7f0000000940)=""/135, 0x87}, {&(0x7f0000000b80)=""/184, 0xb8}, {&(0x7f0000001bc0)=""/4096, 0x1000}], 0x9}, 0x22120) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002fc0)=ANY=[@ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xfe, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a81bff88f7ffff4000630677fbac14142c88a8a0a688a89f4b4d2f87e56dca6aab84fe13f2325f1a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000, 0x43, 0xffffffffffffff11, &(0x7f0000000000), &(0x7f0000000540)="9c18a537674b5d9e9185cd0add6d6d4c9e63ece1b58d7b42c6c27a5f1671fdf94432fc1baaef86573fc9fbb426f9284a6bd47174eb6fb9f893c18421d26d649d633a0f459969df8d3284737c5586cd696884192ce10db91e21fd978337408b7bd1cbb6789b51d63c8e68dab5da01c8e19d572950cfe2142e244990624270eaa2a2ded01d820cec011a6b05192b91cd193b1995bc296c249e1ef1570000000000000f75eec7040de10b5d8c536e5b5ce39ab84e658eb8f02fe112a5136cd3ac5c06848a40ec335a", 0x0, 0x0, 0x800006}, 0x3b) socket$nl_netfilter(0x10, 0x3, 0xc) 23m36.611189007s ago: executing program 2 (id=6005): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r1, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)='\fJ', 0x2}], 0x1, 0x0, 0x0, 0x2804c044}, 0x0) r2 = socket(0x10, 0x803, 0x0) bind$netlink(r2, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r2, 0x0, &(0x7f00000002c0)) shutdown(r1, 0x1) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r4, 0x8344, 0xfffd}, 0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000000)={r4, 0x70, "bd4523f36f1478512d06ac770e2ce008c052855c34e4e91e0857e1c5986cd98d81c6e64fb2ee42335f6b9fb64bc8d7ecf6589c10df41f7a14c8a8f1ba6ba012fedd7b2b272329394fa2f1303595394ded6c0f9a4046fce634c359b805ea3315a0834c2ff4d29c5947ea197c2d9465257"}, &(0x7f0000000080)=0x78) 23m36.396936623s ago: executing program 2 (id=6008): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c0000002000010000000000000000000220000000000000000000000500190002000000080009000000000008000b0005000000080017004e214e22080001"], 0x5c}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x40881}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="380000002000010027bd70000009000002"], 0x38}, 0x1, 0x0, 0x0, 0x24048844}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB='\\\x00\x00\x00!'], 0x5c}}, 0x0) 23m33.000752149s ago: executing program 2 (id=6033): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r6, 0x0, 0x53, 0x0, &(0x7f0000000080)) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="1c0000002e00010026bd4e00fbdbdf250400000008000c00"], 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x48, r1, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x5}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x3}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}], @chandef_params]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x20001004) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) 23m17.786494188s ago: executing program 32 (id=6033): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r6, 0x0, 0x53, 0x0, &(0x7f0000000080)) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=ANY=[@ANYBLOB="1c0000002e00010026bd4e00fbdbdf250400000008000c00"], 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r8, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r7, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x48, r1, 0x200, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x5}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x3}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x5}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}], @chandef_params]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x20001004) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) 3.176731023s ago: executing program 4 (id=17502): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000002000000000000000000000085000000cf000000180100002020752500000000002020207b1af8ff00000000bfa101000000000007010000f8ff1cffb702000008000000b70300000400000085000000b400000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) 3.02938418s ago: executing program 4 (id=17504): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f0000000600010000000000080005ff", @ANYRES32=r0, @ANYBLOB='\b\x00', @ANYBLOB="0a0001000000"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 2.645401907s ago: executing program 4 (id=17509): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007b080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000c200000095"], 0x0, 0x2}, 0x94) 2.482512357s ago: executing program 4 (id=17512): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f80)={0x24, 0x2c, 0x107, 0x0, 0x25dfdbff, {0x2, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x6}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x2}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000180)={r3, 0x3}, &(0x7f0000000200)=0x8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "7f09000000000000000000002300"}}}}}}}, 0x0) recvfrom$l2tp6(r6, 0x0, 0xffffffffffffff51, 0x0, 0x0, 0x0) 2.19742317s ago: executing program 5 (id=17516): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000011c00000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a312000000038000000030a01040000000000000000010000010900010073797a30000000000c000240000000000000000109000300030000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) 2.11279165s ago: executing program 5 (id=17518): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000305000000000020000000000000", @ANYRES32=0x0, @ANYBLOB="15e3000000000000140012800c0001006d616376746170000400028008000500", @ANYRES32=r1], 0x48}}, 0x0) 1.96087489s ago: executing program 3 (id=17519): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f0000000600010000000000080005fe", @ANYRES32=r0, @ANYBLOB='\b\x00', @ANYBLOB="0a0001000000"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 1.960642628s ago: executing program 5 (id=17520): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000007112bc000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2a, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000140)=0x0) sendmsg$NFC_CMD_DEP_LINK_UP(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x4c, r0, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NFC_ATTR_COMM_MODE={0x5}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_COMM_MODE={0x5}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_COMM_MODE={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) 1.865135728s ago: executing program 3 (id=17522): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071116b00000000008510000002000000850000000500002895010000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) 1.773118047s ago: executing program 0 (id=17523): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x19}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x2}, 0x3c) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_int(r5, 0x6, 0x25, 0x0, 0x0) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd49032800030020000000600000000104730081e949b93897bc3b0000070000007d01ff020000000000000000000000000001"], 0xfdef) 1.771449692s ago: executing program 5 (id=17524): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x7}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000400c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000500)={'tunl0\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x700, 0x8, 0x4, 0x5f1, {{0x11, 0x4, 0x3, 0x9, 0x44, 0x68, 0x0, 0x80, 0x4, 0x0, @private=0xa010102, @remote, {[@timestamp_prespec={0x44, 0xc, 0x2c, 0x3, 0x5, [{@remote}]}, @rr={0x7, 0x23, 0x37, [@loopback, @multicast2, @empty, @private=0xa010100, @local, @rand_addr=0x64010100, @remote, @remote]}]}}}}}) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000006c0)={&(0x7f0000000540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0xa, [@var={0x5, 0x0, 0x0, 0xe, 0x3, 0x2}, @struct={0x5, 0x7, 0x0, 0x4, 0x0, 0x10000, [{0xd, 0x0, 0x6}, {0xd, 0x1, 0x8}, {0x7, 0x1, 0x84db}, {0x5, 0x3, 0x2}, {0x4, 0x0, 0x6}, {0xb, 0x1, 0x1}, {0x8, 0x101, 0x1ff}]}]}, {0x0, [0x61, 0x30, 0x5f, 0x0, 0x5f, 0x0, 0x0, 0x2e]}}, &(0x7f0000000600)=""/164, 0x92, 0xa4, 0x1, 0x6}, 0x28) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000840)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0xf, &(0x7f0000000380)=@raw=[@printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10001}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x2}, @call], &(0x7f0000000400)='GPL\x00', 0x3625bfc9, 0x1a, &(0x7f0000000440)=""/26, 0x40f00, 0x10, '\x00', r5, 0x0, r6, 0x8, &(0x7f0000000700)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000740)={0x2, 0xe, 0xc, 0x3}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000880)=[r7, r8], &(0x7f00000008c0)=[{0x5, 0x3, 0xc, 0x6}], 0x10, 0x7ff}, 0x94) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001880)={0x114, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @nested={0x4c, 0x64, 0x0, 0x1, [@nested={0x45, 0xf, 0x0, 0x1, [@typed={0xc, 0x63, 0x0, 0x0, @u64=0x92}, @generic="9d22bafd4ac33962ab17d0d990f22e0ce4779bac24155d82f05498da6c9fa05cee888ef71b4755c9931b0200f5", @typed={0x8, 0x94, 0x0, 0x0, @fd=r9}]}]}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9"]}]}, 0x114}], 0x1}, 0x0) recvmsg$unix(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x12043) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELCHAIN={0x88, 0x5, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xbc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffff2e5a}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}]}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2ea0}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea080006000700000008000400", @ANYRES32=r0, @ANYBLOB], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) 1.675150178s ago: executing program 5 (id=17525): r0 = socket$inet_sctp(0x2, 0x5, 0x84) close(r0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x35, &(0x7f0000000000)=0x6, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e24, @private=0xa010100}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2000000, 0x810, r1, 0x929cc000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20800, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_emit_ethernet(0x24c, &(0x7f0000000600)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd68cc68dc021606ffff020000000000000000000000000001fe8000000000000000000000000000aa871300000000000004010800010005020004074800000001100403000900000000000000ef0d000000000000000000000000000009000000000000000300000000000000ffff0000000000000100000000000000fbffffffffffffff01010001030000000738000000020c057f000500000000000000030000000000000029c40000000000000900000000000000050000000000000000000000005c010001010000000000000000890c0406ee500800ff02000000000000000000000000000100000000000000000000000000000001fc000000000000000000000000000000fc000000000000000000000000000001ff010000000000000000000000000001fc0200000000000000000000000000010606020500000000fc000000000000000000000000000001fe8000000000000000000000000000bbff02000000000000000000000000000108000011650000004e234e20", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="1010007f90780002fe06e2d4c349ef0827eda83c4df989b163aee7a1c406d116bc247f1312d3992ac7c577c7b11a517c5acea77a47040200cfaf275795a46a4d6a98b37c3448138b5f3f30b6f61950dba05c1b87807441e07deaa09bea064c7b14cb0fa714806b5098807f4a760170f9252ee9595b65f0ec5c60647723fe1d5d87b16cec7067113727770a0bf08fb6a97a1cdafcd37f99fd5226bead84a8f161c7aa763284f2e3ebe02d22c38b8a6462dfabf05c3fb63ab83cf2"], 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x70, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0xf, 0xf}, {}, {0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x40, 0x2, [@TCA_CGROUP_EMATCHES={0x3c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x2c, 0x1, 0x0, 0x0, {{0x800, 0x7, 0x1}, {{0xfff2, 0x0, 0x1}, {0x3, 0x1, 0x1}}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xe85, 0x1, 0xc}, {0x4, 0x80000000, 0x3, 0x1, 0xf, 0x1}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.662611812s ago: executing program 3 (id=17526): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x19}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x2}, 0x3c) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd49032800030020000000600000000104730081e949b93897bc3b0000070000007d01ff020000000000000000000000000001"], 0xfdef) 1.596727952s ago: executing program 0 (id=17527): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000140)=0x5, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x10, 0x4, &(0x7f00000005c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@ldst={0x1, 0x2, 0x4, 0x0, 0x1, 0x38}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.485365874s ago: executing program 4 (id=17528): r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b1a, &(0x7f0000000540)={'wlan0\x00'}) syz_emit_ethernet(0x330, &(0x7f0000000140)={@multicast, @random="bad4f9431624", @void, {@ipv6={0x86dd, @gre_packet={0x7, 0x6, "e91315", 0x2fa, 0x2f, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1b}}, @loopback, {[@dstopts={0x91, 0x2, '\x00', [@pad1, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, @srh={0x1d, 0x2, 0x4, 0x1, 0x5, 0x10, 0x7ff, [@rand_addr=' \x01\x00']}], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x880b, 0xd0, 0x0, [0x8000, 0xf0a2], "7079f91ee6b1b052c35cb2248d67d9f2eb7d5e7fe0c2633ec8cce4d84d3aedc7df0614457885b533cc204f2abba79dc3009a63f8705cb4c0058a48a3d4cec1f1b90fe7d5f08347515e50402478614705d83b41b41443a1c04afbba52678357a5aa8a6c5b6b47c6c81be48681ab241c75159189d3afe1d9e9f1e78646719bf7deef6c388a41f1bb13d18c3c0060b1772bc07dc84a2feccbec91f94a94f415376848e5fc5cacdf2e4ce9f954325dca33cbf2e63152fd63d7dbed6e0751cc05c3c8739d269fa67a561084f16a0dc3adad98"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x800, [], "60000000000000000150e6f90d88701ae025ca81d43ba4726b3feec143bfa4e4d17f4aa3dae1c6ee6e85970beb800700000000000000ff01000000000000a38b6297bc7c77f3ec9a13444dbab115b260ce0043fe1e81a031c68e5b8c8c48e290a7d9a7b8033983a6e69a2ed577d0ffbb9e26ac84fdda2b308dd010d4a5e9c1ae75308dfc861484031f3df307c0b71094ff41bf21d593c35fda47c12f1da34e9b7adf403d95e2ff788955151d5b926a43ef67c1b476eec3981b5cc47095257a42fa2169b41f38244bc5c44b3a21a3fe3ed6ce10cb1d717aa3eaeba095236d211fa79664640e8301ebba8c855206a9c6970c823b54dfb8a424955a8f59139f08f50c8f497175576eef8a32f45f8168b9a3a69baaee76f1f49fc57481c5f02364b066951ff19bec4a1b7e82f47aa9399ad10b898561b3ce00fc95f1cb5b72e62de0fd41a5ffffffff4a46199011f6c733c938a231655dd29f5744169dc54e29895388b60df0407adfe5585b713e725189ee17b2850b25a68c06fc267f9d1cbb45dd7cc623f67b0995d90211e7c8de00"/424}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0x2]}, {0x8, 0x88be, 0x0, {{0x4, 0x1, 0x6, 0x0, 0x1, 0x2, 0x3, 0x2}}}, {0x8, 0x22eb, 0x0, {{0x6, 0x2, 0x7, 0x2, 0x1, 0x2, 0x7, 0x9}, 0x2, {0x7, 0x8, 0x1, 0x2, 0x0, 0x1, 0x3, 0x1, 0x1}}}, {0x8, 0x6558, 0x1}}}}}}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002300)={&(0x7f00000022c0)={0x2, 0x12, 0x6, 0x5, 0x2, 0x0, 0x70bd25, 0x25dfdbfb}, 0x10}}, 0x8010) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@link_local, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x18, 0xfffe, 0x0, 0xa0, 0x2f, 0x0, @loopback, @multicast1}, {0x2001, 0x880b, 0x8}}}}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) pwrite64(r6, 0x0, 0xffffffffffffff4d, 0x7fffffffffffffff) write$cgroup_type(r6, &(0x7f0000000040), 0x9) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)={0x2c, r4, 0x11, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_KEY={0x10, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x27, 0x1, 0x3}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffffffe}, [@alu={0x4, 0x0, 0xd, 0xa, 0x0, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x1, 0x7d, &(0x7f00000001c0)=""/125, 0x40f00, 0x4}, 0x94) sendmsg$nl_route_sched(r1, 0x0, 0x4000010) 1.484737794s ago: executing program 1 (id=17529): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000300000001000000000000010000000000000000000000000000000105000000100000000000000000000003000000000100000010"], 0x0, 0x53}, 0x20) 1.453500565s ago: executing program 3 (id=17530): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000280)={r2, r0, 0x9, 0x0, 0x0, 0x9, 0x8b, 0x6, 0x5505, 0xa35, 0x2, 0x1, 'syz0\x00'}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES8=r2], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702000002ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x7c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x32}}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_PROTO={0x14, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e24}, @CTA_PROTONAT_PORT_MAX={0x6}]}]}]}, 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200737997310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_netfilter(0x10, 0x3, 0xc) 1.453229058s ago: executing program 0 (id=17531): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x10, 0x10, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {0x6, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {0x5}, {0x7, 0x0, 0x0, 0x0}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x0, 0x18}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0x5b}}]}, &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.296984609s ago: executing program 1 (id=17532): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0e000000040000000800000001"], 0x50) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) (async) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1806000000000300000000000000c29c18120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r1}, &(0x7f0000000280), &(0x7f00000002c0)=r3}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xe, 0x0, &(0x7f0000000000)="43227504000000b32415f73227b2", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xe, 0x0, &(0x7f0000000000)="43227504000000b32415f73227b2", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000700)={'bond0\x00'}) 1.296243704s ago: executing program 3 (id=17533): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000011c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x8, [@func={0x6, 0x0, 0x0, 0xc, 0x3}, @ptr={0x0, 0x0, 0x0, 0x2, 0x1}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x8, 0x3}, {0x10, 0x4}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x5f]}}, 0x0, 0x54}, 0x28) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x49, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x2a, 0x29, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0xffff}, {0xffff, 0xffff}, {0x2, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r8, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) shutdown(r8, 0x2) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000900), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r9, 0x8933, &(0x7f00000007c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r9, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000200)={0x48, r10, 0x11, 0x70bd26, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x28, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x14, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x1}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}]}, 0x48}, 0x1, 0x0, 0x0, 0x8080}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r7, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000980)={0x330, 0x0, 0x4, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x7, 0x8}}}}, [@NL80211_ATTR_IE={0x39, 0x2a, [@prep={0x83, 0x1f, {{}, 0x7f, 0x4, @device_b, 0x8000, @void, 0x8, 0xfffffff7, @broadcast}}, @link_id={0x65, 0x12, {@random="df9210669bc7", @device_b}}]}, @NL80211_ATTR_IE={0x2c, 0x2a, [@mesh_id={0x72, 0x6}, @chsw_timing={0x68, 0x4, {0x1ff, 0x91}}, @rann={0x7e, 0x15, {{0x1, 0x2a}, 0xd, 0x2, @broadcast, 0xb, 0x1ff, 0xd30b}}, @challenge={0x10, 0x1, 0xab}]}, @fils_params=[@NL80211_ATTR_FILS_ERP_RRK={0x26, 0xfc, "d0fb51d520ca91b5406251d2e18671dd65b5ac061b154894f94bdac385cbf9cfb47b"}, @NL80211_ATTR_FILS_ERP_REALM={0xda, 0xfa, "9d28fe1a18a473c70d0135c82c0e36c10eb928b0b1ee53c23c6f4629974abba8bb00db602e7f580298f5b30834502a149e2800e78e719c86510ae74bb094d1144d1f58431a9bdad6a1033fd37e257d2e8601645fa8900ca39e087c02e587fdd2025baad8f9e5be65f7b86bc54d248fa0c84b5099b3cb5672cc107b5c647f4822f47b8a0d3f44d49124ce31775a800470fc3eadddc05c9d5336f69ac142c0362cb8a10dccb7c5d235f4781873826df40c5b018f389ee379a06bf3055769a8b6c17b128f08facaeaddb10ddfa4dd97da2c47318a354b96"}], @NL80211_ATTR_IE={0x27, 0x2a, [@tim={0x5, 0x21, {0x3, 0x6c, 0x9, "242a3a0a8153483ec85b0935326cd17e849994f6eea0d96af0b0f8a2f1a7"}}]}, @fils_params=[@NL80211_ATTR_FILS_ERP_REALM={0xc5, 0xfa, "74d62eb296868adbdc2b32e19debd85f022d300fd401e383afb754be2515d23309069f0494219dc47b0a6dfda8d9d986449577d1c62b392e96a2df47fbffe0cddc99d818b886f22aa4181588795850f8162e4e99fceba77d65e918480464e42d3bb1e0c4f1409a4eed559ae6a1d67741b33f63dfa82e582699d60d7d4dba63b5ea0433a7f9fa952cb219b0e6f8c6407c424ce5dd7303ce455875f0040167777a2f732f1213ffab21dad2af4c3b2086445d25cce0cede0c137b1e6841b4fa6f83fe"}, @NL80211_ATTR_FILS_ERP_USERNAME={0x8, 0xf9, "e3f9d681"}], @NL80211_ATTR_IE={0xa3, 0x2a, [@ibss={0x6, 0x2, 0x3}, @random={0x7, 0x24, "a9cfdf1285c2e3428b7bead8d47098ab25975954441300d6364d441764ef459ec3965ed6"}, @mesh_chsw={0x76, 0x6, {0x22, 0xe, 0x3e, 0x6}}, @chsw_timing={0x68, 0x4, {0xcfed, 0xfffc}}, @preq={0x82, 0x62, {{0x0, 0x0, 0x1, 0x0, 0x1}, 0xb, 0x0, 0xab, @device_b, 0x81, @value=@device_b, 0x81, 0x8, 0x6, [{{0x1}, @device_b, 0x10001}, {{0x0, 0x0, 0x1}, @device_b}, {{}, @device_b, 0x81}, {{0x1, 0x0, 0x1}, @broadcast, 0xb9ab}, {{0x1}, @device_b, 0x1}, {{0x0, 0x0, 0x1}, @device_a, 0x1}]}}, @erp={0x2a, 0x1}]}]}, 0x330}, 0x1, 0x0, 0x0, 0xc1}, 0x40810) 1.274730338s ago: executing program 0 (id=17534): r0 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) ioctl$XFS_IOC_ERROR_INJECTION(r0, 0x40085874, &(0x7f0000000380)={0xffffffffffffffff, 0x6}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r2 = socket(0x1, 0x5, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000000)=0x11, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x6, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c0000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x0, 0x10, 0x10, &(0x7f00000002c0)="0000000212000000", &(0x7f0000000300)=""/8, 0xd00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x12, 0x4, 0x4, 0x12, 0x0, r1}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r6, &(0x7f0000000940), &(0x7f0000000a40)=@tcp6=r5}, 0x20) shutdown(r5, 0x0) select(0x40, &(0x7f0000000340)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x2e787ec3}, 0x0, 0x0, 0x0) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000002600), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000005c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010029bd7000fbdbdf25010000000c000200d640000000000000100007800c00018008000100", @ANYRES16=r7, @ANYBLOB="2103c30d9b6e62c5670b5f7f5ac215e1ac96ffa9cd76192d95b56645a9cc06a4e4de84c8f13350373347ea97b9b5d81d9a2ed1515d89bb073fd42e2e6bad2eb9ad4628f96e4170f632969c3921d6bfd9dec7b60d4153dfc22a6fd35d034d2dd9e2febf81091e0a0368f8706d76aa799134cc3a1e342853897e04143181c20ca738d991bc985ea7aa0798885b34417073cd83d26d4e1d51cf2ffdaf63c5b1d6c47dc7bd7bbc7f90971c0777366b711f55d8ca6d20c80eef23897da8e11d1cd9c5f2f3a228ed31c0f6e843427bbcec34f1c358794ebde8e3670244379d42474082a8f8de1cb59dfd8044a330c966ce2ce73ef56b33e147a8bd35e55fce3e24d4b8adaba59944a5313c085fcf95e7cc82fcebc93e871abda3e84c80e0b26e78f3baa79c51306ecdd26892ba7370adeb10c7a3a84a3c9501ccbe627891"], 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0xc000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010020bd70100600010007000000080009000200000008000b"], 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000004c0)={&(0x7f00000003c0), 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x60, r8, 0x400, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x58}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4c000}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r11, 0xc004743e, &(0x7f0000000000)=0x4) ioctl$PPPIOCGNPMODE(r11, 0xc008744c, &(0x7f0000000100)={0x57, 0x5}) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="34000000400007012bbd7000fedbdf25027c00001800c2800800aa007f00000104000d8008005b0002000000080009800400ff80"], 0x34}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.bfq.io_service_bytes\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r1, 0x0) pwritev(r1, &(0x7f0000000580)=[{&(0x7f00000000c0)="5734aa", 0x3}, {&(0x7f0000002e80)="e73304d6c6dcb9744d407b414f2b6f76909b21dd865ea678a0b6e1bc3311ed7ccaf9a5b01722ca693ce9d5dd630425d56391ed1af3a8e47a54e259c90940205b2da811c747d4318bceeb535392029281942968add30693b58946511caa182594be83d3d0568b225a04a1a1b25a8735369687b305dd26f45a4b8dd64937aac6cd175b99201e4d8c266b3e2adef12e29b7ed407b4c6ca1700f965bed896e2d831c01488c4335dec898ec6c41cfc6d15ccba7b59eb8a36701390be0b65ceddb49711d19114bc1ef8459370ec3ba9cf9bf3e2bee935dd054571225b8022936bb4bb846c81d03254cdb3a6b8167f3ff185679f59f1ef189d051c757dd23c3555e00507619613ef771f2adfebfd1172806e2e5b83a98f9d34949a16e242dafdbca65a139478371a8523119d4895e33372f2d79fd29c77abcbfca643f183edf033a913cde13e003cb0f49c9c1840650395918bc91f883f2f047b134eb4d8d2dc433c2b290843ad664392a79f98c9168013f5ad0816710131a86f6da803e26687f2d97e511", 0x181}], 0x2, 0x0, 0x7) 1.088727877s ago: executing program 1 (id=17535): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x7}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x2000400c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000500)={'tunl0\x00', &(0x7f0000000480)={'tunl0\x00', 0x0, 0x700, 0x8, 0x4, 0x5f1, {{0x13, 0x4, 0x3, 0x9, 0x4c, 0x68, 0x0, 0x80, 0x4, 0x0, @private=0xa010102, @remote, {[@timestamp_prespec={0x44, 0x14, 0x2c, 0x3, 0x5, [{@rand_addr=0x64010102, 0x1}, {@remote}]}, @rr={0x7, 0x23, 0x37, [@loopback, @multicast2, @empty, @private=0xa010100, @local, @rand_addr=0x64010100, @remote, @remote]}]}}}}}) r6 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000840)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0xf, &(0x7f0000000380)=@raw=[@printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10001}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x2}, @call], &(0x7f0000000400)='GPL\x00', 0x3625bfc9, 0x1a, &(0x7f0000000440)=""/26, 0x40f00, 0x10, '\x00', r5, 0x0, r6, 0x8, &(0x7f0000000700)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000000740)={0x2, 0xe, 0xc, 0x3}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000880)=[r7, r8], &(0x7f00000008c0)=[{0x5, 0x3, 0xc, 0x6}], 0x10, 0x7ff}, 0x94) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001880)={0x114, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, "", [@nested={0x102, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @nested={0x4c, 0x64, 0x0, 0x1, [@nested={0x45, 0xf, 0x0, 0x1, [@typed={0xc, 0x63, 0x0, 0x0, @u64=0x92}, @generic="9d22bafd4ac33962ab17d0d990f22e0ce4779bac24155d82f05498da6c9fa05cee888ef71b4755c9931b0200f5", @typed={0x8, 0x94, 0x0, 0x0, @fd=r9}]}]}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9"]}]}, 0x114}], 0x1}, 0x0) recvmsg$unix(r3, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x12043) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWSET={0x1c, 0x9, 0xa, 0x5, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELCHAIN={0x88, 0x5, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xbc}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x5}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_COUNTERS={0x34, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffff2e5a}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x7ff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}]}]}, @NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2ea0}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x104}, 0x1, 0x0, 0x0, 0x1}, 0x1) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="500100001a000100000000000200000002001c1f0000c808ffffffea080006000700000008000400", @ANYRES32=r0, @ANYBLOB], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) 920.208545ms ago: executing program 1 (id=17536): socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000c40)={{}, 0x0, &(0x7f0000000c00)='%ps \x00'}, 0x20) bpf$MAP_CREATE(0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x4, &(0x7f0000020440)=ANY=[@ANYBLOB="18000000004000000000000009000000850000000f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) socket(0x40000000015, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000940)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00006558180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYBLOB="0a000100000070"], 0x64}, 0x1, 0x0, 0x0, 0x8811}, 0x0) 742.891166ms ago: executing program 4 (id=17537): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newqdisc={0x150, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x2, {0x0, 0x0, 0x0, r1, {0x0, 0xfff8}, {0xffff, 0xffff}, {0x16, 0xa}}, [@qdisc_kind_options=@q_red={{0x8}, {0x124, 0x2, [@TCA_RED_STAB={0x104, 0x2, "09000020000000008f29d158039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c76000067af25166c2f0f85f36aa8867406119c010400002e31dea98204000000d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b5142ddf36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459ac3ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1008000"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0x4008007, 0x81, 0xc, 0x2, 0x12, 0x5}}, @TCA_RED_MAX_P={0x8, 0x3, 0x80}]}}]}, 0x150}, 0x1, 0x0, 0x0, 0x4040004}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000ffdbdf250c0000080800060028c581be"], 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x8000) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r2) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_POWER_SAVE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)={0x1c, r7, 0x1, 0x400, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}}, 0x0) r8 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r2, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000425bd7000fcdbdf2d310000000000018e430000000c00990001010a6e27a000000000650408ff66f9c66534f01212522ebe00007500005b0c009900090000c09182440008000300803667841b5a97fc8f1a4a1cce27d124a2e01f58be040410eb8dc549bc5a5bfa944827bb4d234ac3d401dc216dbc240b1418c3db08bb09ab76f224e4ec9280ffcbceae3c8c0ce7f453a0c0917eaf239eb8c67cc830d2c016ae95b7b692970e872cae716bb8caec582c7c18ce8cbc67bf1e936ffef2", @ANYRES32=r6, @ANYBLOB="0800db00", @ANYRES32=r8, @ANYRESHEX=r4, @ANYRES32=0x0, @ANYBLOB="0c009900040000003800000008000300", @ANYRES32=r9, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) r10 = socket(0x1, 0x2, 0x0) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0f000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200"/28], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r11, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r10}, 0x20) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r10, 0x5452, &(0x7f0000000000)={'syztnl1\x00', 0x0}) recvmsg(r10, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000440)=""/103, 0x67}], 0x1}, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r8, 0x9362, 0x0) sendmmsg$unix(r10, &(0x7f00000008c0)=[{{&(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000801}}], 0x2, 0x20040804) 533.314934ms ago: executing program 3 (id=17538): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet_sctp(0x2, 0x1, 0x84) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000f80)={0x24, 0x2c, 0x107, 0x0, 0x25dfdbff, {0x2, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x6}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x2}]}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000180)={r3, 0x3}, &(0x7f0000000200)=0x8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r4, 0x89f0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "7f09000000000000000000002300"}}}}}}}, 0x0) recvfrom$l2tp6(r6, 0x0, 0xffffffffffffff51, 0x0, 0x0, 0x0) 532.922315ms ago: executing program 5 (id=17539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @empty}, 0x10) r2 = socket$inet(0x2, 0x1, 0x0) socket$inet6(0xa, 0x800, 0x7) setsockopt$sock_int(r2, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r2, &(0x7f0000e15000)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r1, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) close(r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r4, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r4, 0x84, 0x8, &(0x7f0000000100), &(0x7f0000000440)=0x4) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x32, 0xffffffffffffffff, 0x739ef000) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r5, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r5, &(0x7f0000000300)="cd", 0x1, 0x8804, &(0x7f0000000100)={0xa, 0x4e23, 0x80, @loopback, 0xfffffffe}, 0x1c) r6 = socket$inet_sctp(0x2, 0x0, 0x84) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r7, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x1c, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x7fff, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r7, 0x84, 0x18, &(0x7f0000000340)={0x0, 0x6}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r6, 0x84, 0x1a, &(0x7f0000000080)={0x0, 0x4c, "14e61a35f451fd207a9a6c1c64e6dae60fce0637b5cfccea9b82be851230166443d41b1c55070a5010f5c438f1a935f6136c640c7bdc056ba496e55a3ec4282bd1e1a16792c361e4c4e04914"}, &(0x7f0000000140)=0x54) socket$packet(0x11, 0xa, 0x300) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) 401.794977ms ago: executing program 0 (id=17540): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000000c0), &(0x7f0000000100)=0x8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$MRT_ADD_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd2, &(0x7f0000000040)={@dev={0xac, 0x14, 0x14, 0x19}, @empty, 0x2, "4f6fb4d1af0f724e6118ecfbac0200843af29708e2355d0e7ea0c543011a00", 0xfffffffc, 0x4, 0x81, 0x2}, 0x3c) socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd49032800030020000000600000000104730081e949b93897bc3b0000070000007d01ff020000000000000000000000000001"], 0xfdef) 366.96491ms ago: executing program 1 (id=17541): syz_init_net_socket$ax25(0x3, 0x5, 0xc4) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000130000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000600)="c9f7b98600000020000000000000", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.632657ms ago: executing program 1 (id=17542): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000002f00)={0x0, 0x0, &(0x7f0000002ec0)={&(0x7f0000002e80)={0x18, 0x1402, 0x1, 0x70bd2c, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000810}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x4c, 0x0, &(0x7f0000000340)=0x52) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020100000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011001f"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x6, 0x7, 0x1, 0x0, "1d3a"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x7c}}, 0x4040) unshare(0x6a040000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x40106183, &(0x7f0000000000)) 0s ago: executing program 0 (id=17543): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000038000000380000000300000001000000000000010000000000000000000000000000000105000000100000000000000000000003000000000100000011"], 0x0, 0x53}, 0x20) kernel console output (not intermixed with test programs): 780.593047][T23573] netlink: 260 bytes leftover after parsing attributes in process `syz.5.15682'. [ 1780.733294][T11970] veth1_vlan: left allmulticast mode [ 1780.738883][T11970] veth1_macvtap: left promiscuous mode [ 1780.772309][T11970] veth0_macvtap: left promiscuous mode [ 1780.778023][T11970] veth1_vlan: left promiscuous mode [ 1780.792486][T11970] veth0_vlan: left promiscuous mode [ 1781.000022][T23584] netlink: 344 bytes leftover after parsing attributes in process `syz.5.15687'. [ 1781.253500][T23592] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15691'. [ 1781.281957][T23592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15691'. [ 1781.314384][T23593] netlink: 36 bytes leftover after parsing attributes in process `syz.0.15690'. [ 1781.555414][T23601] x_tables: duplicate underflow at hook 3 [ 1781.688386][T11970] team0 (unregistering): Port device team_slave_1 removed [ 1781.710435][T11970] team0 (unregistering): Port device team_slave_0 removed [ 1784.719011][T23618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15700'. [ 1784.871854][T23618] macvtap2: entered promiscuous mode [ 1784.890977][T23618] macvtap2: entered allmulticast mode [ 1784.922767][T23618] veth1_vlan: entered allmulticast mode [ 1784.954451][T23628] x_tables: duplicate underflow at hook 3 [ 1784.970353][T23392] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1785.051134][T23392] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1785.094336][T23392] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1785.121659][T23392] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1785.349842][T23392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1785.404869][T23392] 8021q: adding VLAN 0 to HW filter on device team0 [ 1785.457958][ T7709] bridge0: port 1(bridge_slave_0) entered blocking state [ 1785.465225][ T7709] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1785.513983][ T7709] bridge0: port 2(bridge_slave_1) entered blocking state [ 1785.521220][ T7709] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1785.966342][T23653] netlink: 36 bytes leftover after parsing attributes in process `syz.0.15707'. [ 1786.142513][T23392] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1786.149883][T23659] syzkaller0: entered promiscuous mode [ 1786.203279][T23659] syzkaller0: entered allmulticast mode [ 1786.247485][T23665] macsec1: entered promiscuous mode [ 1786.349629][T23673] netlink: 16 bytes leftover after parsing attributes in process `syz.0.15711'. [ 1786.445084][T23392] veth0_vlan: entered promiscuous mode [ 1786.476262][T23392] veth1_vlan: entered promiscuous mode [ 1786.580799][T23392] veth0_macvtap: entered promiscuous mode [ 1786.601335][T23392] veth1_macvtap: entered promiscuous mode [ 1786.638398][T23392] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1786.659698][T23392] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1786.672474][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1786.680353][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1786.748271][T11970] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1786.765525][T11970] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1786.812109][T11970] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1786.848218][T11970] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1786.864436][T23687] x_tables: duplicate underflow at hook 3 [ 1787.156294][T23696] netlink: 124 bytes leftover after parsing attributes in process `syz.4.15719'. [ 1787.230886][T23696] nbd: nbd4 already in use [ 1787.258479][T11972] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1787.272787][T11972] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1787.395415][T11970] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1787.421198][T11970] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1787.788648][T23717] netlink: 148 bytes leftover after parsing attributes in process `syz.1.15725'. [ 1787.876557][T23717] netlink: 20 bytes leftover after parsing attributes in process `syz.1.15725'. [ 1787.894457][T23721] syzkaller0: entered promiscuous mode [ 1787.900783][T23721] syzkaller0: entered allmulticast mode [ 1787.915348][T23717] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1787.936702][T23723] syzkaller0: entered promiscuous mode [ 1787.952300][T23723] syzkaller0: entered allmulticast mode [ 1788.227715][T23733] openvswitch: netlink: IPv4 tun info is not correct [ 1788.234699][T23734] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15731'. [ 1788.482063][T23734] macvtap2: entered promiscuous mode [ 1788.501006][T23734] macvtap2: entered allmulticast mode [ 1788.556536][T23742] netlink: 36 bytes leftover after parsing attributes in process `syz.4.15735'. [ 1788.736543][T23745] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15736'. [ 1788.806266][T23750] netlink: 4188 bytes leftover after parsing attributes in process `syz.4.15738'. [ 1789.717262][T23747] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1789.772434][T23751] netlink: 40 bytes leftover after parsing attributes in process `syz.1.15737'. [ 1789.971526][T23747] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1790.218728][T23747] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1790.405815][T23777] syzkaller0: entered promiscuous mode [ 1790.411354][T23777] syzkaller0: entered allmulticast mode [ 1790.554541][T23747] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1790.753263][T23790] vlan3: entered allmulticast mode [ 1790.760283][T23790] team0: entered allmulticast mode [ 1790.766116][T23790] team_slave_0: entered allmulticast mode [ 1790.780531][T23790] team_slave_1: entered allmulticast mode [ 1791.734836][T23811] netlink: 'syz.4.15756': attribute type 33 has an invalid length. [ 1791.752332][T23811] netlink: 152 bytes leftover after parsing attributes in process `syz.4.15756'. [ 1791.793006][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1791.918385][T23813] netlink: 14 bytes leftover after parsing attributes in process `syz.4.15756'. [ 1793.869905][ T4090] Bluetooth: hci4: command 0x0406 tx timeout [ 1794.317754][T23798] tunl0: Caught tx_queue_len zero misconfig [ 1794.455250][T23797] ip6_vti0 speed is unknown, defaulting to 1000 [ 1794.546848][ T7709] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1794.632747][T28023] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1794.669988][T11963] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1794.721291][T11970] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1794.990177][T23831] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15764'. [ 1795.306444][T23797] lo speed is unknown, defaulting to 1000 [ 1795.857049][T23797] wg1 speed is unknown, defaulting to 1000 [ 1796.394195][T23859] sit1: entered promiscuous mode [ 1796.424095][T23858] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15774'. [ 1796.455613][T23858] netem: incorrect gi model size [ 1796.491310][T23858] netem: change failed [ 1796.834807][T23878] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15781'. [ 1796.895870][T23880] geneve1: Caught tx_queue_len zero misconfig [ 1796.992685][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5200 ms [ 1797.000775][ C0] lec:lec_tx_timeout: lec0 [ 1797.163166][T23889] netlink: 16 bytes leftover after parsing attributes in process `syz.4.15786'. [ 1798.513415][T23932] netem: incorrect gi model size [ 1798.536703][T23932] netem: change failed [ 1798.628824][T23938] syzkaller1: entered promiscuous mode [ 1798.642874][T23938] syzkaller1: entered allmulticast mode [ 1798.973575][T23947] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15797'. [ 1799.234696][T23958] netlink: 20 bytes leftover after parsing attributes in process `syz.4.15802'. [ 1799.736974][T23974] xt_TCPMSS: Only works on TCP SYN packets [ 1799.736977][T23979] xt_TCPMSS: Only works on TCP SYN packets [ 1799.746633][T23978] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15811'. [ 1799.882994][T23987] netlink: 'syz.4.15813': attribute type 1 has an invalid length. [ 1800.112843][ T25] block nbd0: Possible stuck request ffff8880268e0000: control (read@0,1024B). Runtime 990 seconds [ 1800.124180][ T25] block nbd0: Possible stuck request ffff8880268e0200: control (read@1024,1024B). Runtime 990 seconds [ 1800.136379][ T25] block nbd0: Possible stuck request ffff8880268e0400: control (read@2048,1024B). Runtime 990 seconds [ 1800.148377][ T25] block nbd0: Possible stuck request ffff8880268e0600: control (read@3072,1024B). Runtime 990 seconds [ 1800.549774][T23987] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1800.877966][T24009] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15822'. [ 1800.920213][T24011] netlink: 148 bytes leftover after parsing attributes in process `syz.1.15823'. [ 1800.963227][T24009] gtp0: entered promiscuous mode [ 1800.968237][T24009] gtp0: entered allmulticast mode [ 1801.008058][T24011] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15823'. [ 1801.055048][T24011] openvswitch: netlink: EtherType 0 is less than min 600 [ 1801.089885][T24015] ip6_vti0 speed is unknown, defaulting to 1000 [ 1801.128095][T24025] netlink: 36 bytes leftover after parsing attributes in process `syz.3.15826'. [ 1801.343586][T24030] x_tables: duplicate underflow at hook 3 [ 1801.372863][T24031] netlink: 12 bytes leftover after parsing attributes in process `syz.0.15828'. [ 1801.486247][T24031] macvtap3: entered promiscuous mode [ 1801.627869][T24040] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15831'. [ 1801.773916][T24043] netlink: 'syz.4.15832': attribute type 33 has an invalid length. [ 1801.842688][T24043] netlink: 152 bytes leftover after parsing attributes in process `syz.4.15832'. [ 1802.072315][T24015] lo speed is unknown, defaulting to 1000 [ 1802.452932][T24058] ip6_vti0 speed is unknown, defaulting to 1000 [ 1802.463924][T24062] netlink: 148 bytes leftover after parsing attributes in process `syz.0.15840'. [ 1802.526927][T24062] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15840'. [ 1802.564051][T24062] openvswitch: netlink: EtherType 0 is less than min 600 [ 1802.605139][T24067] netem: incorrect gi model size [ 1802.622404][T24067] netem: change failed [ 1802.709213][T24067] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1802.773291][T24053] ip6_vti0 speed is unknown, defaulting to 1000 [ 1803.281599][T24081] FAULT_INJECTION: forcing a failure. [ 1803.281599][T24081] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1803.319947][T24081] CPU: 1 UID: 0 PID: 24081 Comm: syz.0.15847 Not tainted syzkaller #0 PREEMPT(full) [ 1803.319990][T24081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1803.320003][T24081] Call Trace: [ 1803.320012][T24081] [ 1803.320020][T24081] dump_stack_lvl+0xe8/0x150 [ 1803.320053][T24081] should_fail_ex+0x412/0x560 [ 1803.320083][T24081] _copy_from_user+0x2d/0xb0 [ 1803.320111][T24081] bpf_test_init+0xd8/0x150 [ 1803.320138][T24081] bpf_prog_test_run_xdp+0x529/0x1160 [ 1803.320177][T24081] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1803.320205][T24081] ? __fget_files+0x2a/0x420 [ 1803.320237][T24081] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1803.320261][T24081] bpf_prog_test_run+0x2c7/0x340 [ 1803.320286][T24081] __sys_bpf+0x643/0x950 [ 1803.320317][T24081] ? __pfx___sys_bpf+0x10/0x10 [ 1803.320361][T24081] ? ksys_write+0x242/0x270 [ 1803.320384][T24081] ? __pfx_ksys_write+0x10/0x10 [ 1803.320416][T24081] __x64_sys_bpf+0x7c/0x90 [ 1803.320442][T24081] do_syscall_64+0x14d/0xf80 [ 1803.320479][T24081] ? trace_irq_disable+0x3b/0x150 [ 1803.320506][T24081] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1803.320526][T24081] ? clear_bhb_loop+0x40/0x90 [ 1803.320551][T24081] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1803.320570][T24081] RIP: 0033:0x7fc18019c629 [ 1803.320590][T24081] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1803.320606][T24081] RSP: 002b:00007fc17e3ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1803.320628][T24081] RAX: ffffffffffffffda RBX: 00007fc180415fa0 RCX: 00007fc18019c629 [ 1803.320642][T24081] RDX: 0000000000000050 RSI: 00002000000008c0 RDI: 000000000000000a [ 1803.320654][T24081] RBP: 00007fc17e3ee090 R08: 0000000000000000 R09: 0000000000000000 [ 1803.320667][T24081] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1803.320678][T24081] R13: 00007fc180416038 R14: 00007fc180415fa0 R15: 00007fff803ddae8 [ 1803.320711][T24081] [ 1803.900985][T24088] veth1: entered promiscuous mode [ 1803.908510][T24088] veth1: entered allmulticast mode [ 1803.917673][T24088] netlink: 'syz.3.15850': attribute type 2 has an invalid length. [ 1804.191489][T24058] lo speed is unknown, defaulting to 1000 [ 1804.210572][T24015] wg1 speed is unknown, defaulting to 1000 [ 1804.321736][T24099] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1804.331590][T24097] syzkaller0: entered promiscuous mode [ 1804.339627][T24097] syzkaller0: entered allmulticast mode [ 1804.359087][T24099] tipc: MTU too low for tipc bearer [ 1804.427464][T24097] netlink: 'syz.0.15853': attribute type 13 has an invalid length. [ 1804.691375][T24100] tipc: Enabled bearer , priority 0 [ 1804.704200][T24053] lo speed is unknown, defaulting to 1000 [ 1804.726664][T24096] tipc: Resetting bearer [ 1804.875529][T24107] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15857'. [ 1804.947886][T24096] tipc: Disabling bearer [ 1804.984243][T24058] wg1 speed is unknown, defaulting to 1000 [ 1805.010549][T24107] openvswitch: netlink: EtherType 0 is less than min 600 [ 1805.477619][T24053] wg1 speed is unknown, defaulting to 1000 [ 1805.489764][T24105] siw: device registration error -23 [ 1806.067838][T24124] __nla_validate_parse: 1 callbacks suppressed [ 1806.067858][T24124] netlink: 116 bytes leftover after parsing attributes in process `syz.0.15859'. [ 1806.311573][T24125] veth2: entered allmulticast mode [ 1806.768679][T24141] netlink: 'syz.0.15866': attribute type 2 has an invalid length. [ 1806.974065][T24141] : entered promiscuous mode [ 1807.046907][T24150] netlink: 148 bytes leftover after parsing attributes in process `syz.4.15868'. [ 1807.142607][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 1807.159570][T24155] netlink: 8 bytes leftover after parsing attributes in process `syz.4.15868'. [ 1807.193521][T24155] openvswitch: netlink: EtherType 0 is less than min 600 [ 1807.839803][T22488] lec:lec_start_xmit: lec0:No lecd attached [ 1808.130590][T24164] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15870'. [ 1808.317767][T24166] lo: Caught tx_queue_len zero misconfig [ 1808.334647][T24166] netem: incorrect gi model size [ 1808.339642][T24166] netem: change failed [ 1808.395806][T24167] bridge0: port 2(bridge_slave_1) entered disabled state [ 1808.462027][T24167] bridge_slave_1: left allmulticast mode [ 1808.473760][T24167] bridge_slave_1: left promiscuous mode [ 1808.493063][T24167] bridge0: port 2(bridge_slave_1) entered disabled state [ 1808.545804][T24167] bridge_slave_1: entered promiscuous mode [ 1808.565791][T24167] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1808.759191][T24171] syzkaller1: entered promiscuous mode [ 1808.782377][T24171] syzkaller1: entered allmulticast mode [ 1809.087692][T24186] tipc: Enabled bearer , priority 0 [ 1809.096426][T24186] syzkaller0: entered promiscuous mode [ 1809.101943][T24186] syzkaller0: entered allmulticast mode [ 1809.171209][T24188] netlink: 148 bytes leftover after parsing attributes in process `syz.0.15879'. [ 1809.224803][T24188] netlink: 8 bytes leftover after parsing attributes in process `syz.0.15879'. [ 1809.250641][T24193] No such timeout policy "syz0" [ 1809.256256][T24188] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1809.391771][T24194] geneve0: Caught tx_queue_len zero misconfig [ 1809.453465][T24193] tipc: Resetting bearer [ 1809.802366][T24200] FAULT_INJECTION: forcing a failure. [ 1809.802366][T24200] name failslab, interval 1, probability 0, space 0, times 0 [ 1809.848523][T24200] CPU: 1 UID: 0 PID: 24200 Comm: syz.1.15884 Not tainted syzkaller #0 PREEMPT(full) [ 1809.848553][T24200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1809.848567][T24200] Call Trace: [ 1809.848575][T24200] [ 1809.848585][T24200] dump_stack_lvl+0xe8/0x150 [ 1809.848619][T24200] should_fail_ex+0x412/0x560 [ 1809.848649][T24200] should_failslab+0xa8/0x100 [ 1809.848676][T24200] __kmalloc_cache_node_noprof+0x8a/0x6b0 [ 1809.848699][T24200] ? trace_kmalloc+0x2a/0x110 [ 1809.848734][T24200] ? page_pool_create_percpu+0x76/0xb80 [ 1809.848773][T24200] page_pool_create_percpu+0x76/0xb80 [ 1809.848817][T24200] ? __kvmalloc_node_noprof+0x393/0x8a0 [ 1809.848845][T24200] bpf_test_run_xdp_live+0x23d/0x1cf0 [ 1809.848879][T24200] ? bpf_dispatcher_change_prog+0xae0/0xd70 [ 1809.848922][T24200] ? __pfx_wait_rcu_exp_gp+0x10/0x10 [ 1809.848956][T24200] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1809.848983][T24200] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 1809.849032][T24200] ? 0xffffffffa02019dc [ 1809.849051][T24200] ? 0xffffffffa0206a8c [ 1809.849069][T24200] ? 0xffffffffa0206ad0 [ 1809.849085][T24200] ? 0xffffffffa020b190 [ 1809.849131][T24200] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 1809.849169][T24200] ? _copy_from_user+0x94/0xb0 [ 1809.849199][T24200] ? bpf_test_init+0x113/0x150 [ 1809.849221][T24200] ? xdp_convert_md_to_buff+0x5b/0x330 [ 1809.849249][T24200] bpf_prog_test_run_xdp+0x81c/0x1160 [ 1809.849293][T24200] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1809.849324][T24200] ? __fget_files+0x2a/0x420 [ 1809.849359][T24200] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1809.849386][T24200] bpf_prog_test_run+0x2c7/0x340 [ 1809.849412][T24200] __sys_bpf+0x643/0x950 [ 1809.849446][T24200] ? __pfx___sys_bpf+0x10/0x10 [ 1809.849495][T24200] ? ksys_write+0x242/0x270 [ 1809.849519][T24200] ? __pfx_ksys_write+0x10/0x10 [ 1809.849549][T24200] __x64_sys_bpf+0x7c/0x90 [ 1809.849579][T24200] do_syscall_64+0x14d/0xf80 [ 1809.849609][T24200] ? trace_irq_disable+0x3b/0x150 [ 1809.849640][T24200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1809.849662][T24200] ? clear_bhb_loop+0x40/0x90 [ 1809.849688][T24200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1809.849709][T24200] RIP: 0033:0x7f7bb559c629 [ 1809.849729][T24200] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1809.849748][T24200] RSP: 002b:00007f7bb637d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1809.849771][T24200] RAX: ffffffffffffffda RBX: 00007f7bb5815fa0 RCX: 00007f7bb559c629 [ 1809.849795][T24200] RDX: 0000000000000050 RSI: 00002000000008c0 RDI: 000000000000000a [ 1809.849808][T24200] RBP: 00007f7bb637d090 R08: 0000000000000000 R09: 0000000000000000 [ 1809.849822][T24200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1809.849835][T24200] R13: 00007f7bb5816038 R14: 00007f7bb5815fa0 R15: 00007ffc88f77638 [ 1809.849871][T24200] [ 1810.543582][T24185] tipc: Resetting bearer [ 1810.667773][T24215] netlink: 12 bytes leftover after parsing attributes in process `syz.4.15889'. [ 1810.725993][T24185] tipc: Disabling bearer [ 1810.758657][T24063] tipc: Node number set to 2912366870 [ 1810.844645][T24220] syzkaller1: entered promiscuous mode [ 1810.850186][T24220] syzkaller1: entered allmulticast mode [ 1810.969762][T24226] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15893'. [ 1811.102617][T24234] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15893'. [ 1811.120685][T24234] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1812.094952][T24252] netlink: 36 bytes leftover after parsing attributes in process `syz.1.15901'. [ 1812.470039][T24270] netlink: 148 bytes leftover after parsing attributes in process `syz.3.15908'. [ 1812.589676][T24274] netlink: 8 bytes leftover after parsing attributes in process `syz.3.15908'. [ 1812.610033][T24274] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1812.982323][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5140 ms [ 1812.990454][ C0] lec:lec_tx_timeout: lec0 [ 1813.050321][T24296] netlink: 36 bytes leftover after parsing attributes in process `syz.4.15915'. [ 1813.083940][T24298] netlink: 120 bytes leftover after parsing attributes in process `syz.1.15914'. [ 1813.319880][T24312] netlink: 4 bytes leftover after parsing attributes in process `syz.0.15919'. [ 1813.415497][T24315] netlink: 24 bytes leftover after parsing attributes in process `syz.4.15920'. [ 1813.643402][T24313] netlink: 116 bytes leftover after parsing attributes in process `syz.5.15918'. [ 1813.728475][T24312] veth3: entered promiscuous mode [ 1813.773785][T24298] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15914'. [ 1813.840024][T24327] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1814.543309][T24322] ip6_vti0 speed is unknown, defaulting to 1000 [ 1814.804928][T24351] netem: incorrect gi model size [ 1814.843400][T24351] netem: change failed [ 1815.274001][ T4090] block nbd14: Receive control failed (result -32) [ 1815.414058][T24322] lo speed is unknown, defaulting to 1000 [ 1815.929307][T24322] wg1 speed is unknown, defaulting to 1000 [ 1816.193039][T24376] macvtap4: entered promiscuous mode [ 1816.209132][T24376] macvtap4: entered allmulticast mode [ 1816.315954][T24380] __nla_validate_parse: 4 callbacks suppressed [ 1816.315976][T24380] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.15942'. [ 1816.612313][T24394] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15948'. [ 1816.739830][T24394] vlan0: entered promiscuous mode [ 1816.776165][T24394] dummy0: entered promiscuous mode [ 1816.870862][T24404] netlink: 12 bytes leftover after parsing attributes in process `syz.1.15951'. [ 1816.932864][T24404] netlink: 8 bytes leftover after parsing attributes in process `syz.1.15951'. [ 1817.605511][T24425] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.15956'. [ 1818.133405][T24432] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15960'. [ 1818.507124][T24446] netlink: 'syz.1.15965': attribute type 13 has an invalid length. [ 1818.694707][T24458] tipc: Started in network mode [ 1818.709971][T24458] tipc: Node identity 5ab2ef5fbb01, cluster identity 4711 [ 1818.733978][T24458] tipc: Enabled bearer , priority 0 [ 1818.755718][T24452] syzkaller0: entered promiscuous mode [ 1818.762287][T24452] syzkaller0: entered allmulticast mode [ 1818.856993][T24445] tipc: Resetting bearer [ 1818.896774][T24465] Bluetooth: MGMT ver 1.23 [ 1818.980957][T24468] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.15970'. [ 1818.998636][T24445] tipc: Disabling bearer [ 1819.008986][T24470] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15969'. [ 1819.208287][T24479] netlink: 12 bytes leftover after parsing attributes in process `syz.5.15972'. [ 1819.277788][T24483] netlink: 116 bytes leftover after parsing attributes in process `syz.3.15971'. [ 1819.337580][T24479] macvtap3: entered promiscuous mode [ 1819.343066][T24479] macvtap3: entered allmulticast mode [ 1819.393416][T24486] netlink: 'syz.4.15974': attribute type 12 has an invalid length. [ 1819.462934][T20926] Bluetooth: hci0: command 0x0406 tx timeout [ 1820.043744][T24513] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1821.356116][T24564] ip6_vti0 speed is unknown, defaulting to 1000 [ 1821.396352][T24569] __nla_validate_parse: 7 callbacks suppressed [ 1821.396372][T24569] netlink: 48 bytes leftover after parsing attributes in process `syz.0.16006'. [ 1821.917057][T24564] lo speed is unknown, defaulting to 1000 [ 1822.875404][T24585] IPVS: Scheduler module ip_vs_ not found [ 1822.908298][T24599] IPVS: length: 24 != 36888 [ 1823.037148][T24591] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.126759][T24564] wg1 speed is unknown, defaulting to 1000 [ 1823.335438][T24612] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16019'. [ 1823.355378][T24591] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.398648][T24612] vlan2: entered promiscuous mode [ 1823.404510][T24612] bond0: entered promiscuous mode [ 1823.421152][T24612] bond_slave_0: entered promiscuous mode [ 1823.433098][T24612] bond_slave_1: entered promiscuous mode [ 1823.572673][T24621] sctp: [Deprecated]: syz.5.16020 (pid 24621) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1823.572673][T24621] Use struct sctp_sack_info instead [ 1823.590589][T24591] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1823.851387][T24591] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1824.139001][T24626] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16023'. [ 1824.419810][T11969] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1824.555915][T11969] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1824.582670][T11969] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1824.632384][T11969] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1825.351997][T24648] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16032'. [ 1825.413081][T24652] netlink: 40 bytes leftover after parsing attributes in process `syz.3.16034'. [ 1825.788421][T24665] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1826.086352][T24676] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16043'. [ 1826.179824][T24678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16044'. [ 1826.230031][T24678] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16044'. [ 1828.153075][T24711] bridge0: port 1(bridge_slave_0) entered disabled state [ 1828.971304][T24711] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1829.037585][T24711] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1829.973673][T24735] netlink: 20 bytes leftover after parsing attributes in process `syz.5.16059'. [ 1829.992801][T24711] veth1_vlan: left allmulticast mode [ 1830.102482][T11972] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1830.124276][T11972] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1830.181692][T11972] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1830.222535][T11972] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1830.391903][T24738] syzkaller1: entered promiscuous mode [ 1830.417873][T24738] syzkaller1: entered allmulticast mode [ 1830.428653][T24743] x_tables: duplicate underflow at hook 3 [ 1830.538282][ T25] block nbd0: Possible stuck request ffff8880268e0000: control (read@0,1024B). Runtime 1020 seconds [ 1830.549373][ T25] block nbd0: Possible stuck request ffff8880268e0200: control (read@1024,1024B). Runtime 1020 seconds [ 1830.560631][ T25] block nbd0: Possible stuck request ffff8880268e0400: control (read@2048,1024B). Runtime 1020 seconds [ 1830.571925][ T25] block nbd0: Possible stuck request ffff8880268e0600: control (read@3072,1024B). Runtime 1020 seconds [ 1831.065779][T24767] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16072'. [ 1831.243747][T24773] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16073'. [ 1831.437883][T24777] netlink: 228 bytes leftover after parsing attributes in process `syz.5.16074'. [ 1831.481234][T24777] netlink: 228 bytes leftover after parsing attributes in process `syz.5.16074'. [ 1831.563871][T24776] delete_channel: no stack [ 1832.310102][T24789] netlink: 24 bytes leftover after parsing attributes in process `syz.5.16075'. [ 1832.532072][T24773] bridge0: port 2(bridge_slave_1) entered disabled state [ 1832.539962][T24773] bridge0: port 1(bridge_slave_0) entered disabled state [ 1833.277709][T24773] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1833.336793][T24773] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1834.023973][T24788] sch_fq: defrate 4294967293 ignored. [ 1834.047553][T24792] team_slave_1: Caught tx_queue_len zero misconfig [ 1834.068865][T11966] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.113069][T11966] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.173548][T11966] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.181977][T11966] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1834.255098][T24808] x_tables: duplicate underflow at hook 3 [ 1834.255686][T24804] netem: incorrect gi model size [ 1834.270898][T24804] netem: change failed [ 1834.310138][T24810] netlink: 12 bytes leftover after parsing attributes in process `syz.5.16085'. [ 1834.858359][T24837] netlink: 'syz.5.16093': attribute type 2 has an invalid length. [ 1834.913649][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1834.939759][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1834.981271][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.016326][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.033517][T24843] netlink: 20 bytes leftover after parsing attributes in process `syz.5.16093'. [ 1835.043548][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.060959][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.101689][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.110151][T24843] netlink: 'syz.5.16093': attribute type 4 has an invalid length. [ 1835.263083][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.302819][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.330876][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.414502][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1835.451040][T24828] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16089'. [ 1836.366729][T24828] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1836.433959][T24828] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1836.923296][T24839] bond0: (slave bridge_slave_1): Releasing backup interface [ 1836.959149][T24839] bridge_slave_1: left promiscuous mode [ 1837.019311][ T1148] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1837.062345][ T1148] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1837.097050][ T1148] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1837.105901][ T1148] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1837.490002][T24883] x_tables: duplicate underflow at hook 3 [ 1837.748169][T24900] netlink: 'syz.5.16111': attribute type 1 has an invalid length. [ 1837.961069][T24905] macvlan2: entered promiscuous mode [ 1837.998235][T24905] macvlan2: entered allmulticast mode [ 1838.039635][T24905] bond1: entered promiscuous mode [ 1838.072787][T24905] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1838.126930][T24905] bond1: left promiscuous mode [ 1838.204405][T24908] vlan3: entered promiscuous mode [ 1838.221076][T24908] dummy0: entered promiscuous mode [ 1839.120695][T24953] x_tables: duplicate underflow at hook 3 [ 1840.061658][T24988] openvswitch: netlink: IPv4 tun info is not correct [ 1840.087132][T24987] __nla_validate_parse: 125 callbacks suppressed [ 1840.087150][T24987] netlink: 12 bytes leftover after parsing attributes in process `syz.5.16138'. [ 1840.233869][T24994] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.254796][T24994] bridge_slave_0: left allmulticast mode [ 1840.260518][T24994] bridge_slave_0: left promiscuous mode [ 1840.293878][T24994] bridge0: port 1(bridge_slave_0) entered disabled state [ 1840.400175][T24995] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.425586][T24995] netlink: 336 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.444707][T24995] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.458233][T24995] netlink: 336 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.491880][T24995] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16141'. [ 1840.561300][T25004] netlink: 344 bytes leftover after parsing attributes in process `syz.1.16144'. [ 1840.722793][T25009] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.16145'. [ 1840.939516][T25019] x_tables: duplicate underflow at hook 3 [ 1841.684389][T25012] bridge0: port 1(bridge_slave_0) entered disabled state [ 1841.884574][T25041] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16155'. [ 1842.447899][T25012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1842.515488][T25012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1843.340856][ T9374] netdevsim netdevsim0 ÿÿÿÿÿÿ: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.370849][ T9374] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.407080][ T9374] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.474480][ T7706] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.756018][T25060] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1843.874726][T25065] x_tables: duplicate underflow at hook 3 [ 1844.800106][T25112] openvswitch: netlink: IPv4 tun info is not correct [ 1844.965872][T25116] ip6_vti0 speed is unknown, defaulting to 1000 [ 1845.577133][T25116] lo speed is unknown, defaulting to 1000 [ 1845.586155][T25148] x_tables: duplicate underflow at hook 3 [ 1845.921403][T25161] syzkaller1: entered promiscuous mode [ 1845.932856][T25161] syzkaller1: entered allmulticast mode [ 1846.076429][T25116] wg1 speed is unknown, defaulting to 1000 [ 1846.275016][T25172] __nla_validate_parse: 4 callbacks suppressed [ 1846.275043][T25172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1846.339285][T25172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1846.362383][T25172] netlink: 336 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1846.389210][T25172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1846.487157][T25172] netlink: 336 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1846.523682][T25172] netlink: 4 bytes leftover after parsing attributes in process `syz.4.16200'. [ 1847.105425][T25198] netlink: 4 bytes leftover after parsing attributes in process `syz.5.16209'. [ 1847.135429][T25200] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16210'. [ 1847.848118][T25225] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16217'. [ 1847.894508][T25225] vlan3: entered promiscuous mode [ 1848.204338][T25234] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16221'. [ 1848.452778][T25243] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1848.484788][T25242] tipc: Enabled bearer , priority 14 [ 1848.491127][T25239] ip6_vti0 speed is unknown, defaulting to 1000 [ 1848.503069][T25246] 0ªX¹¦À: renamed from caif0 [ 1849.020922][T25246] tipc: Disabling bearer [ 1849.230540][T25246] 0ªX¹¦À: entered allmulticast mode [ 1849.256550][T25246] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1849.599100][T25272] tipc: Enabling of bearer rejected, failed to enable media [ 1850.192036][ T4090] Bluetooth: hci3: command 0x0406 tx timeout [ 1851.418931][T25289] __nla_validate_parse: 5 callbacks suppressed [ 1851.418953][T25289] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16237'. [ 1851.435084][T25289] netlink: 'syz.1.16237': attribute type 1 has an invalid length. [ 1852.627342][T25277] vlan3: entered promiscuous mode [ 1852.632851][T25239] lo speed is unknown, defaulting to 1000 [ 1852.809993][T25302] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.16242'. [ 1852.905192][T25306] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16245'. [ 1852.971244][T25308] openvswitch: netlink: IPv4 tun info is not correct [ 1853.077198][T25312] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1853.234452][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1853.345543][T25239] wg1 speed is unknown, defaulting to 1000 [ 1853.511165][T25329] tipc: Enabled bearer , priority 0 [ 1853.519058][T25329] syzkaller0: entered promiscuous mode [ 1853.525086][T25329] syzkaller0: entered allmulticast mode [ 1853.761983][T25325] tipc: Resetting bearer [ 1853.831305][T25325] tipc: Disabling bearer [ 1853.899637][T25335] ip6_vti0 speed is unknown, defaulting to 1000 [ 1854.697919][T25364] Bluetooth: MGMT ver 1.23 [ 1854.851365][T25356] ip6_vti0 speed is unknown, defaulting to 1000 [ 1854.877808][T25335] lo speed is unknown, defaulting to 1000 [ 1855.443939][T25384] x_tables: duplicate underflow at hook 3 [ 1855.561089][T25356] lo speed is unknown, defaulting to 1000 [ 1855.614567][T25335] wg1 speed is unknown, defaulting to 1000 [ 1855.937388][T25396] netlink: 348 bytes leftover after parsing attributes in process `syz.5.16276'. [ 1856.200710][T25399] ip6_vti0 speed is unknown, defaulting to 1000 [ 1856.211228][T25356] wg1 speed is unknown, defaulting to 1000 [ 1856.859011][T25399] lo speed is unknown, defaulting to 1000 [ 1857.191085][T25410] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16280'. [ 1857.227239][T25412] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16281'. [ 1857.262614][T25410] vlan0: entered promiscuous mode [ 1857.278218][T25410] gretap0: entered promiscuous mode [ 1857.680638][T25399] wg1 speed is unknown, defaulting to 1000 [ 1857.908968][T25427] netlink: 348 bytes leftover after parsing attributes in process `syz.4.16287'. [ 1857.973082][T25425] syzkaller0: entered promiscuous mode [ 1857.978620][T25425] syzkaller0: entered allmulticast mode [ 1858.084381][T25424] netlink: 'syz.3.16286': attribute type 13 has an invalid length. [ 1858.163653][T25425] tipc: Started in network mode [ 1858.168619][T25425] tipc: Node identity 1ed95e8d090a, cluster identity 4711 [ 1858.196591][T25425] tipc: Enabled bearer , priority 0 [ 1858.285862][T25423] tipc: Resetting bearer [ 1858.354704][T25423] tipc: Disabling bearer [ 1858.733893][T25442] netlink: 36 bytes leftover after parsing attributes in process `syz.4.16294'. [ 1858.992228][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5760 ms [ 1859.000330][ C0] lec:lec_tx_timeout: lec0 [ 1859.145330][T25451] netlink: 348 bytes leftover after parsing attributes in process `syz.1.16298'. [ 1859.393949][T25464] ip6_vti0 speed is unknown, defaulting to 1000 [ 1859.446255][T25469] tipc: New replicast peer: 255.255.255.255 [ 1859.463098][T25469] tipc: Enabled bearer , priority 10 [ 1859.609882][T25481] netlink: 64 bytes leftover after parsing attributes in process `syz.5.16307'. [ 1859.715568][T25483] netlink: 148 bytes leftover after parsing attributes in process `syz.4.16308'. [ 1859.811200][T25488] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16308'. [ 1859.820502][T25488] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1860.270715][T25506] netlink: 20 bytes leftover after parsing attributes in process `syz.4.16313'. [ 1860.392395][T25511] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16315'. [ 1860.423619][ T4090] Bluetooth: hci5: command 0x0405 tx timeout [ 1860.582824][ T4412] tipc: Node number set to 2309348600 [ 1860.837509][T25464] lo speed is unknown, defaulting to 1000 [ 1860.915744][ T25] block nbd0: Possible stuck request ffff8880268e0000: control (read@0,1024B). Runtime 1050 seconds [ 1860.930949][ T25] block nbd0: Possible stuck request ffff8880268e0200: control (read@1024,1024B). Runtime 1050 seconds [ 1860.942760][ T25] block nbd0: Possible stuck request ffff8880268e0400: control (read@2048,1024B). Runtime 1050 seconds [ 1860.954979][ T25] block nbd0: Possible stuck request ffff8880268e0600: control (read@3072,1024B). Runtime 1050 seconds [ 1861.205214][T25464] wg1 speed is unknown, defaulting to 1000 [ 1861.719077][T25537] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1861.867780][T25539] syzkaller1: entered promiscuous mode [ 1861.879734][T25539] syzkaller1: entered allmulticast mode [ 1862.195952][T25551] __nla_validate_parse: 6 callbacks suppressed [ 1862.195972][T25551] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16329'. [ 1862.218080][T25550] syzkaller0: entered promiscuous mode [ 1862.223974][T25550] syzkaller0: entered allmulticast mode [ 1862.826494][T25569] netlink: 'syz.1.16335': attribute type 30 has an invalid length. [ 1862.852619][T25569] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16335'. [ 1862.897795][T25572] netlink: 4188 bytes leftover after parsing attributes in process `syz.0.16336'. [ 1863.060226][T25569] bond1: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 1863.146932][T25569] bond1 (unregistering): Released all slaves [ 1864.170255][T25591] ip6_vti0 speed is unknown, defaulting to 1000 [ 1864.398506][T25627] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16348'. [ 1864.449642][T25628] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16346'. [ 1864.906646][T25591] lo speed is unknown, defaulting to 1000 [ 1864.954433][T25632] ip6_vti0 speed is unknown, defaulting to 1000 [ 1865.046631][T25646] syzkaller1: entered promiscuous mode [ 1865.072410][T25646] syzkaller1: entered allmulticast mode [ 1865.093593][T25651] openvswitch: netlink: IPv4 tun info is not correct [ 1865.515476][T25591] wg1 speed is unknown, defaulting to 1000 [ 1865.875268][T25632] lo speed is unknown, defaulting to 1000 [ 1865.926502][T25664] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16360'. [ 1866.720785][T25694] syzkaller1: entered promiscuous mode [ 1866.736210][T25694] syzkaller1: entered allmulticast mode [ 1866.780378][T25698] netlink: 36 bytes leftover after parsing attributes in process `syz.3.16367'. [ 1866.827708][T25691] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 1866.851956][T25691] bond2 (unregistering): Released all slaves [ 1866.898645][T25702] netlink: 20 bytes leftover after parsing attributes in process `syz.4.16369'. [ 1867.175526][T25705] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16370'. [ 1867.229791][T25705] vlan0: entered promiscuous mode [ 1867.282905][T25632] wg1 speed is unknown, defaulting to 1000 [ 1867.413335][T25713] openvswitch: netlink: IPv4 tun info is not correct [ 1867.540886][T25721] xt_hashlimit: size too large, truncated to 1048576 [ 1867.600288][T25726] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16376'. [ 1867.707435][T25720] ipvlan1: entered promiscuous mode [ 1867.712919][T25720] ipvlan1: entered allmulticast mode [ 1867.718239][T25720] veth0_vlan: entered allmulticast mode [ 1868.044002][T25729] netlink: 132 bytes leftover after parsing attributes in process `syz.3.16376'. [ 1868.063037][T25729] veth0: Caught tx_queue_len zero misconfig [ 1868.436395][T25742] netlink: 20 bytes leftover after parsing attributes in process `syz.1.16379'. [ 1868.533807][T25742] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1868.912939][T25753] netlink: 36 bytes leftover after parsing attributes in process `syz.1.16381'. [ 1869.028184][T25748] ip6_vti0 speed is unknown, defaulting to 1000 [ 1869.591763][T25765] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16383'. [ 1869.628708][T25765] vlan0: entered promiscuous mode [ 1869.644688][T25765] bond0: entered promiscuous mode [ 1869.655064][T25765] bond_slave_0: entered promiscuous mode [ 1869.703312][T25765] bond_slave_1: entered promiscuous mode [ 1869.709279][T25765] bridge_slave_1: entered promiscuous mode [ 1869.846890][T25748] lo speed is unknown, defaulting to 1000 [ 1869.870415][T25769] tipc: Enabled bearer , priority 0 [ 1870.088569][T25769] syzkaller0: entered promiscuous mode [ 1870.113309][T25769] syzkaller0: entered allmulticast mode [ 1870.134142][T25775] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1500) ! [ 1870.164711][T25780] openvswitch: netlink: IPv4 tun info is not correct [ 1872.720213][T22488] lec:lec_start_xmit: lec0:No lecd attached [ 1873.309727][T25748] wg1 speed is unknown, defaulting to 1000 [ 1873.325410][T24724] tipc: Node number set to 3786665823 [ 1873.368452][T25768] tipc: Resetting bearer [ 1873.713365][T25768] tipc: Disabling bearer [ 1873.777679][T25816] tunl0: Caught tx_queue_len zero misconfig [ 1874.024772][T25835] FAULT_INJECTION: forcing a failure. [ 1874.024772][T25835] name failslab, interval 1, probability 0, space 0, times 0 [ 1874.037589][T25835] CPU: 0 UID: 0 PID: 25835 Comm: syz.1.16399 Not tainted syzkaller #0 PREEMPT(full) [ 1874.037617][T25835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1874.037630][T25835] Call Trace: [ 1874.037640][T25835] [ 1874.037650][T25835] dump_stack_lvl+0xe8/0x150 [ 1874.037685][T25835] should_fail_ex+0x412/0x560 [ 1874.037716][T25835] should_failslab+0xa8/0x100 [ 1874.037741][T25835] ? skb_clone+0x212/0x3a0 [ 1874.037773][T25835] kmem_cache_alloc_noprof+0x87/0x650 [ 1874.037806][T25835] ? __bpf_redirect+0xcb4/0x12a0 [ 1874.037836][T25835] skb_clone+0x212/0x3a0 [ 1874.037870][T25835] bpf_clone_redirect+0x16a/0x4b0 [ 1874.037905][T25835] ? bpf_test_run+0x1d1/0x830 [ 1874.037929][T25835] bpf_prog_1939c40fbf65037b+0x5f/0x68 [ 1874.037952][T25835] ? __lock_acquire+0x6b5/0x2cf0 [ 1874.038004][T25835] ? ktime_get+0x45/0x200 [ 1874.038028][T25835] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 1874.038050][T25835] ? lockdep_hardirqs_on+0x7a/0x110 [ 1874.038080][T25835] ? ktime_get+0x45/0x200 [ 1874.038098][T25835] ? seqcount_lockdep_reader_access+0xea/0x100 [ 1874.038120][T25835] ? bpf_test_run+0x1d1/0x830 [ 1874.038153][T25835] ? bpf_test_timer_continue+0x10c/0x320 [ 1874.038184][T25835] bpf_test_run+0x354/0x830 [ 1874.038231][T25835] ? __pfx_bpf_test_run+0x10/0x10 [ 1874.038265][T25835] ? trace_kmem_cache_alloc+0x29/0xf0 [ 1874.038306][T25835] ? slab_build_skb+0x52/0x410 [ 1874.038333][T25835] ? __kasan_krealloc+0xeb/0x110 [ 1874.038355][T25835] ? eth_type_trans+0x35e/0x6d0 [ 1874.038390][T25835] ? convert___skb_to_skb+0x3d/0x5b0 [ 1874.038417][T25835] bpf_prog_test_run_skb+0xd22/0x1c90 [ 1874.038453][T25835] ? __fget_files+0x2a/0x420 [ 1874.038480][T25835] ? __fget_files+0x3a0/0x420 [ 1874.038506][T25835] ? __fget_files+0x2a/0x420 [ 1874.038539][T25835] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1874.038564][T25835] bpf_prog_test_run+0x2c7/0x340 [ 1874.038590][T25835] __sys_bpf+0x643/0x950 [ 1874.038623][T25835] ? __pfx___sys_bpf+0x10/0x10 [ 1874.038671][T25835] ? ksys_write+0x242/0x270 [ 1874.038695][T25835] ? __pfx_ksys_write+0x10/0x10 [ 1874.038726][T25835] __x64_sys_bpf+0x7c/0x90 [ 1874.038773][T25835] do_syscall_64+0x14d/0xf80 [ 1874.038804][T25835] ? trace_irq_disable+0x3b/0x150 [ 1874.038833][T25835] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1874.038856][T25835] ? clear_bhb_loop+0x40/0x90 [ 1874.038883][T25835] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1874.038904][T25835] RIP: 0033:0x7f7bb559c629 [ 1874.038924][T25835] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1874.038942][T25835] RSP: 002b:00007f7bb637d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1874.038965][T25835] RAX: ffffffffffffffda RBX: 00007f7bb5815fa0 RCX: 00007f7bb559c629 [ 1874.038980][T25835] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 1874.038993][T25835] RBP: 00007f7bb637d090 R08: 0000000000000000 R09: 0000000000000000 [ 1874.039006][T25835] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1874.039019][T25835] R13: 00007f7bb5816038 R14: 00007f7bb5815fa0 R15: 00007ffc88f77638 [ 1874.039055][T25835] [ 1874.457697][T25841] netlink: 876 bytes leftover after parsing attributes in process `syz.3.16400'. [ 1874.495194][T25841] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16400'. [ 1874.620871][T25847] netlink: 20 bytes leftover after parsing attributes in process `syz.0.16403'. [ 1874.939377][T25855] netlink: 16 bytes leftover after parsing attributes in process `syz.4.16407'. [ 1874.955608][T25854] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16406'. [ 1875.260631][T25864] sock: sock_timestamping_bind_phc: sock not bind to device [ 1875.288259][T25864] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16411'. [ 1875.359028][T25864] ip6gretap0: entered promiscuous mode [ 1875.376404][T25864] ip6gretap0: left promiscuous mode [ 1875.425790][T25873] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16414'. [ 1875.516269][T25873] vlan3: entered promiscuous mode [ 1875.521354][T25873] gretap0: entered promiscuous mode [ 1875.655715][T25868] ip6_vti0 speed is unknown, defaulting to 1000 [ 1876.008925][T25868] lo speed is unknown, defaulting to 1000 [ 1876.213371][T25886] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.16418'. [ 1876.345087][T25888] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16419'. [ 1876.614344][T25868] wg1 speed is unknown, defaulting to 1000 [ 1876.882567][T25903] netlink: 40 bytes leftover after parsing attributes in process `syz.1.16425'. [ 1877.716636][T25933] rdma_rxe: rxe_newlink: failed to add lo [ 1877.942902][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5220 ms [ 1877.951081][ C0] lec:lec_tx_timeout: lec0 [ 1878.110809][T25953] openvswitch: netlink: Message has 8 unknown bytes. [ 1878.202041][T25954] netlink: 'syz.1.16441': attribute type 1 has an invalid length. [ 1878.331076][T25959] IPVS: length: 127 != 8 [ 1878.421536][T25959] erspan1: entered allmulticast mode [ 1878.695428][T25950] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1878.707822][T25950] bond_slave_0: left promiscuous mode [ 1878.774813][T25950] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1878.797218][T25950] bond_slave_1: left promiscuous mode [ 1878.842010][T25950] bond0 (unregistering): Released all slaves [ 1879.084860][T25978] x_tables: duplicate underflow at hook 3 [ 1879.105733][T25980] openvswitch: netlink: Flow actions attr not present in new flow. [ 1879.370801][T24724] IPVS: starting estimator thread 0... [ 1879.465163][T25992] IPVS: using max 26 ests per chain, 62400 per kthread [ 1879.484543][T25995] __nla_validate_parse: 9 callbacks suppressed [ 1879.484574][T25995] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16454'. [ 1879.515762][T25995] netlink: 16 bytes leftover after parsing attributes in process `syz.4.16454'. [ 1879.552672][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.563720][T25998] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16455'. [ 1879.581103][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.597805][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.623583][T26002] netlink: 348 bytes leftover after parsing attributes in process `syz.1.16457'. [ 1879.645559][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.654903][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.664716][T25999] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16456'. [ 1879.684777][T25998] vlan2: entered promiscuous mode [ 1880.270001][T26034] netlink: 'syz.0.16470': attribute type 64 has an invalid length. [ 1880.391991][T26039] openvswitch: netlink: Tunnel attr 333 out of range max 16 [ 1880.918928][T26053] x_tables: duplicate underflow at hook 3 [ 1881.371996][T26071] batadv_slave_1: entered promiscuous mode [ 1881.403454][T26065] syzkaller0: entered promiscuous mode [ 1881.412847][T26065] syzkaller0: entered allmulticast mode [ 1882.180980][T26070] batadv_slave_1: left promiscuous mode [ 1882.700558][T26133] delete_channel: no stack [ 1882.985261][T26150] netlink: 'syz.0.16505': attribute type 9 has an invalid length. [ 1883.008523][T26150] netlink: 'syz.0.16505': attribute type 11 has an invalid length. [ 1883.027059][T26150] netlink: 'syz.0.16505': attribute type 12 has an invalid length. [ 1883.186759][T26159] netlink: 'syz.3.16506': attribute type 31 has an invalid length. [ 1883.197140][T26159] netlink: 'syz.3.16506': attribute type 31 has an invalid length. [ 1883.425448][T26161] bond0 (unregistering): Released all slaves [ 1883.516564][T26172] x_tables: duplicate underflow at hook 1 [ 1883.854437][T26183] netlink: 'syz.0.16516': attribute type 13 has an invalid length. [ 1884.051881][T26193] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1884.074644][T26193] syzkaller1: linktype set to 825 [ 1884.527375][T26206] __nla_validate_parse: 99 callbacks suppressed [ 1884.527397][T26206] netlink: 344 bytes leftover after parsing attributes in process `syz.0.16524'. [ 1884.999439][T26224] netlink: 'syz.4.16530': attribute type 1 has an invalid length. [ 1885.008420][T26224] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1885.028825][T26219] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 3 [ 1885.030072][T26225] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 3 [ 1885.323468][T26244] netlink: 12 bytes leftover after parsing attributes in process `syz.5.16535'. [ 1885.377915][T26244] vlan3: entered promiscuous mode [ 1885.501402][T26257] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16539'. [ 1885.801403][T26272] netlink: 24 bytes leftover after parsing attributes in process `syz.5.16545'. [ 1886.037049][T26282] : entered promiscuous mode [ 1886.100316][T26285] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16547'. [ 1886.176018][T26287] FAULT_INJECTION: forcing a failure. [ 1886.176018][T26287] name failslab, interval 1, probability 0, space 0, times 0 [ 1886.188744][T26287] CPU: 0 UID: 0 PID: 26287 Comm: syz.5.16549 Not tainted syzkaller #0 PREEMPT(full) [ 1886.188790][T26287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1886.188804][T26287] Call Trace: [ 1886.188812][T26287] [ 1886.188821][T26287] dump_stack_lvl+0xe8/0x150 [ 1886.188864][T26287] should_fail_ex+0x412/0x560 [ 1886.188895][T26287] should_failslab+0xa8/0x100 [ 1886.188920][T26287] ? skb_clone+0x212/0x3a0 [ 1886.188951][T26287] kmem_cache_alloc_noprof+0x87/0x650 [ 1886.188984][T26287] ? __bpf_redirect+0xcb4/0x12a0 [ 1886.189014][T26287] skb_clone+0x212/0x3a0 [ 1886.189048][T26287] bpf_clone_redirect+0x16a/0x4b0 [ 1886.189084][T26287] ? bpf_test_run+0x1d1/0x830 [ 1886.189110][T26287] bpf_prog_1939c40fbf65037b+0x5f/0x68 [ 1886.189133][T26287] ? __lock_acquire+0x6b5/0x2cf0 [ 1886.189173][T26287] ? __pfx___schedule+0x10/0x10 [ 1886.189217][T26287] ? preempt_schedule_thunk+0x16/0x30 [ 1886.189242][T26287] ? preempt_schedule_common+0x82/0xd0 [ 1886.189270][T26287] ? bpf_test_run+0x1d1/0x830 [ 1886.189298][T26287] ? bpf_test_timer_continue+0x10c/0x320 [ 1886.189327][T26287] bpf_test_run+0x354/0x830 [ 1886.189376][T26287] ? __pfx_bpf_test_run+0x10/0x10 [ 1886.189411][T26287] ? trace_kmem_cache_alloc+0x29/0xf0 [ 1886.189441][T26287] ? slab_build_skb+0x52/0x410 [ 1886.189469][T26287] ? __kasan_krealloc+0xeb/0x110 [ 1886.189493][T26287] ? eth_type_trans+0x35e/0x6d0 [ 1886.189530][T26287] ? convert___skb_to_skb+0x3d/0x5b0 [ 1886.189557][T26287] bpf_prog_test_run_skb+0xd22/0x1c90 [ 1886.189596][T26287] ? __fget_files+0x2a/0x420 [ 1886.189623][T26287] ? __fget_files+0x3a0/0x420 [ 1886.189651][T26287] ? __fget_files+0x2a/0x420 [ 1886.189685][T26287] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 1886.189711][T26287] bpf_prog_test_run+0x2c7/0x340 [ 1886.189736][T26287] __sys_bpf+0x643/0x950 [ 1886.189770][T26287] ? __pfx___sys_bpf+0x10/0x10 [ 1886.189819][T26287] ? ksys_write+0x242/0x270 [ 1886.189851][T26287] ? __pfx_ksys_write+0x10/0x10 [ 1886.189881][T26287] __x64_sys_bpf+0x7c/0x90 [ 1886.189911][T26287] do_syscall_64+0x14d/0xf80 [ 1886.189941][T26287] ? trace_irq_disable+0x3b/0x150 [ 1886.189971][T26287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1886.190004][T26287] ? clear_bhb_loop+0x40/0x90 [ 1886.190030][T26287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1886.190049][T26287] RIP: 0033:0x7f110ed9c629 [ 1886.190068][T26287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1886.190084][T26287] RSP: 002b:00007f110fbd8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1886.190106][T26287] RAX: ffffffffffffffda RBX: 00007f110f015fa0 RCX: 00007f110ed9c629 [ 1886.190120][T26287] RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a [ 1886.190132][T26287] RBP: 00007f110fbd8090 R08: 0000000000000000 R09: 0000000000000000 [ 1886.190145][T26287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1886.190155][T26287] R13: 00007f110f016038 R14: 00007f110f015fa0 R15: 00007ffcd811e508 [ 1886.190187][T26287] [ 1886.718360][T26293] netlink: 44 bytes leftover after parsing attributes in process `syz.3.16552'. [ 1886.738644][T26293] dummy0: Caught tx_queue_len zero misconfig [ 1886.745729][T26293] netlink: 13 bytes leftover after parsing attributes in process `syz.3.16552'. [ 1887.005969][T26300] netlink: 'syz.1.16555': attribute type 2 has an invalid length. [ 1887.103637][T26300] !©9: entered promiscuous mode [ 1887.123219][T26300] netlink: 'syz.1.16555': attribute type 2 has an invalid length. [ 1887.131176][T26300] !©9: left promiscuous mode [ 1887.390440][ T30] audit: type=1804 audit(1771541110.613:14): pid=26318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.16560" name="/newroot/177/cgroup.controllers" dev="tmpfs" ino=919 res=1 errno=0 [ 1887.403848][T26320] netlink: 344 bytes leftover after parsing attributes in process `syz.4.16561'. [ 1887.464306][ T30] audit: type=1800 audit(1771541110.613:15): pid=26318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.16560" name="cgroup.controllers" dev="tmpfs" ino=919 res=0 errno=0 [ 1887.504366][T26322] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16562'. [ 1887.721411][T26338] netlink: 14 bytes leftover after parsing attributes in process `syz.1.16566'. [ 1887.757323][T26338] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1887.773353][T26338] bond_slave_0: left promiscuous mode [ 1887.781225][T26338] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1887.835087][T26338] bond_slave_1: left promiscuous mode [ 1887.841247][T26338] bond0 (unregistering): Released all slaves [ 1888.165152][T26353] policy can only be matched on NF_INET_PRE_ROUTING [ 1888.165175][T26353] unable to load match [ 1888.213354][T26353] syzkaller1: entered promiscuous mode [ 1888.218889][T26353] syzkaller1: entered allmulticast mode [ 1888.753815][T26374] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1888.827685][T26369] ip6_vti0 speed is unknown, defaulting to 1000 [ 1889.159681][T26382] netlink: 'syz.5.16578': attribute type 3 has an invalid length. [ 1889.192040][T26382] netlink: 'syz.5.16578': attribute type 3 has an invalid length. [ 1889.593291][T26395] __nla_validate_parse: 7 callbacks suppressed [ 1889.593313][T26395] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16584'. [ 1889.690604][T26398] netlink: 4188 bytes leftover after parsing attributes in process `syz.0.16585'. [ 1889.716084][T26401] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16586'. [ 1889.748417][T26401] ip6gre2: entered promiscuous mode [ 1889.782527][T26401] ip6gre2: entered allmulticast mode [ 1889.795681][T26369] lo speed is unknown, defaulting to 1000 [ 1889.816117][T26401] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1889.992969][T26405] netlink: 344 bytes leftover after parsing attributes in process `syz.0.16588'. [ 1890.113234][T26407] netlink: 148 bytes leftover after parsing attributes in process `syz.5.16589'. [ 1890.140609][T26407] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16589'. [ 1890.149802][T26407] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1890.233309][T26407] netlink: 36 bytes leftover after parsing attributes in process `syz.5.16589'. [ 1890.396334][ T1148] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1890.433372][ T1148] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1890.441139][ T4412] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1890.468400][T26369] wg1 speed is unknown, defaulting to 1000 [ 1890.512735][T26422] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16595'. [ 1890.605601][T26425] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.16597'. [ 1890.746870][T26432] netlink: 6032 bytes leftover after parsing attributes in process `syz.4.16599'. [ 1890.924034][T26440] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1890.988349][ T25] block nbd0: Connection timed out, retrying (0/1 alive) [ 1890.996905][ T25] block nbd0: Connection timed out, retrying (0/1 alive) [ 1891.004901][ T25] block nbd0: Connection timed out, retrying (0/1 alive) [ 1891.013366][ T8543] block nbd0: Dead connection, failed to find a fallback [ 1891.024727][ T25] block nbd0: Connection timed out, retrying (0/1 alive) [ 1891.050695][T26444] netlink: 'syz.0.16602': attribute type 4 has an invalid length. [ 1891.155036][T20926] Bluetooth: hci2: command 0x0406 tx timeout [ 1891.332932][T24724] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1891.431803][ T4412] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1891.739565][T26464] syzkaller0: entered promiscuous mode [ 1891.746972][T26464] syzkaller0: entered allmulticast mode [ 1892.251048][T26487] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1893.084505][T26516] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1893.883736][T26516] hsr_slave_1 (unregistering): left promiscuous mode [ 1894.182655][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1894.371829][T26534] xt_bpf: check failed: parse error [ 1894.387838][T26537] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1894.516379][T26543] netlink: 'syz.1.16638': attribute type 1 has an invalid length. [ 1894.774686][T26547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1894.884063][T26549] bond0: (slave ip6gretap1): making interface the new active one [ 1894.906967][T26549] bond0: (slave ip6gretap1): Enslaving as an active interface with an up link [ 1895.621370][T26581] __nla_validate_parse: 17 callbacks suppressed [ 1895.621392][T26581] netlink: 16 bytes leftover after parsing attributes in process `syz.3.16651'. [ 1896.235104][T26601] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16656'. [ 1896.249000][T26601] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16656'. [ 1896.340673][T26601] geneve2: entered promiscuous mode [ 1896.376476][T26601] geneve2: entered allmulticast mode [ 1896.380981][T26612] netlink: 20 bytes leftover after parsing attributes in process `syz.4.16658'. [ 1896.420574][ T1148] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.442814][ T9374] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.490125][T26612] geneve2: entered promiscuous mode [ 1896.527107][ T9374] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.574016][ T9374] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.594451][ T9374] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.633701][ T9374] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.641962][ T9374] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1896.703394][ T9374] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1897.244431][T26649] netlink: 'syz.3.16672': attribute type 11 has an invalid length. [ 1897.286483][T26657] openvswitch: netlink: IPv4 tun info is not correct [ 1897.539407][T26660] ip6_vti0 speed is unknown, defaulting to 1000 [ 1897.799490][T26678] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1898.000988][T26660] lo speed is unknown, defaulting to 1000 [ 1898.511442][T26692] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16683'. [ 1898.835000][T26695] lo: Caught tx_queue_len zero misconfig [ 1898.892367][T26697] ip6_vti0 speed is unknown, defaulting to 1000 [ 1898.970341][T26660] wg1 speed is unknown, defaulting to 1000 [ 1899.161239][T26697] lo speed is unknown, defaulting to 1000 [ 1899.284377][ T4090] block nbd15: Receive control failed (result -32) [ 1899.629444][T26707] ip6_vti0 speed is unknown, defaulting to 1000 [ 1899.879536][T26713] syzkaller0: entered promiscuous mode [ 1899.893835][T26713] syzkaller0: entered allmulticast mode [ 1899.922861][T26715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16689'. [ 1899.961780][T26707] lo speed is unknown, defaulting to 1000 [ 1899.967062][T26713] netlink: 'syz.3.16690': attribute type 13 has an invalid length. [ 1900.054983][T26715] netlink: 'syz.4.16689': attribute type 5 has an invalid length. [ 1900.065273][T26715] netlink: 3581 bytes leftover after parsing attributes in process `syz.4.16689'. [ 1900.305175][T26697] wg1 speed is unknown, defaulting to 1000 [ 1900.313011][T26707] wg1 speed is unknown, defaulting to 1000 [ 1900.374906][T26724] netlink: 40 bytes leftover after parsing attributes in process `syz.4.16691'. [ 1900.429263][T26720] can: request_module (can-proto-5) failed. [ 1900.902800][T26738] IPVS: set_ctl: invalid protocol: 0 10.1.1.2:20001 [ 1901.176531][T26745] netlink: 4188 bytes leftover after parsing attributes in process `syz.4.16698'. [ 1901.799862][T26763] vlan4: entered promiscuous mode [ 1901.805594][T26763] hsr0: entered promiscuous mode [ 1901.862458][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1901.907642][ T30] audit: type=1800 audit(1771541125.123:16): pid=26767 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.16704" name=6163655F7072696E746B23360A6D61726B5F707265636973653A206672616D65313A206C6173745F6964782031372066697273745F696478203137207375627365715F696478202D31200A6D61726B5F707265636973653A206672616D65313A20706172656E7420737461746520726567733D723220737461636B3D3A20206672616D65313A2052313D66702D382052323D5038205231303D6670302066702D383D3078323032303230303032353738323032300A6D61726B5F70726563697365 dev="tmpfs" ino=1243 res=0 errno=0 [ 1902.024183][T26771] netlink: 'syz.3.16705': attribute type 2 has an invalid length. [ 1902.041927][T26771] netlink: 224 bytes leftover after parsing attributes in process `syz.3.16705'. [ 1902.420648][T26783] netlink: 16 bytes leftover after parsing attributes in process `syz.0.16708'. [ 1902.714277][T26793] netlink: 148 bytes leftover after parsing attributes in process `syz.0.16712'. [ 1902.722360][T26792] netlink: 68 bytes leftover after parsing attributes in process `syz.5.16711'. [ 1902.737076][T26793] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16712'. [ 1902.750725][T26793] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1902.784174][T26792] netlink: 'syz.5.16711': attribute type 62 has an invalid length. [ 1902.850244][T26793] FAULT_INJECTION: forcing a failure. [ 1902.850244][T26793] name failslab, interval 1, probability 0, space 0, times 0 [ 1902.891673][T26793] CPU: 1 UID: 0 PID: 26793 Comm: syz.0.16712 Not tainted syzkaller #0 PREEMPT(full) [ 1902.891704][T26793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1902.891718][T26793] Call Trace: [ 1902.891727][T26793] [ 1902.891736][T26793] dump_stack_lvl+0xe8/0x150 [ 1902.891773][T26793] should_fail_ex+0x412/0x560 [ 1902.891805][T26793] should_failslab+0xa8/0x100 [ 1902.891831][T26793] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1902.891867][T26793] ? __alloc_skb+0x186/0x7d0 [ 1902.891894][T26793] ? __alloc_skb+0x1d0/0x7d0 [ 1902.891918][T26793] ? __local_bh_enable_ip+0xd0/0x130 [ 1902.891952][T26793] __alloc_skb+0x1d0/0x7d0 [ 1902.891986][T26793] netlink_sendmsg+0x5d4/0xb40 [ 1902.892028][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1902.892059][T26793] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1902.892086][T26793] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1902.892111][T26793] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1902.892133][T26793] ____sys_sendmsg+0xa68/0xad0 [ 1902.892172][T26793] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1902.892211][T26793] ? import_iovec+0x73/0xa0 [ 1902.892244][T26793] ___sys_sendmsg+0x2a5/0x360 [ 1902.892282][T26793] ? __pfx____sys_sendmsg+0x10/0x10 [ 1902.892348][T26793] ? __fget_files+0x2a/0x420 [ 1902.892387][T26793] ? __fget_files+0x3a0/0x420 [ 1902.892427][T26793] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1902.892461][T26793] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1902.892502][T26793] ? __pfx_ksys_write+0x10/0x10 [ 1902.892537][T26793] do_syscall_64+0x14d/0xf80 [ 1902.892567][T26793] ? trace_irq_disable+0x3b/0x150 [ 1902.892596][T26793] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.892617][T26793] ? clear_bhb_loop+0x40/0x90 [ 1902.892643][T26793] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.892664][T26793] RIP: 0033:0x7fc18019c629 [ 1902.892685][T26793] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1902.892704][T26793] RSP: 002b:00007fc17e3ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1902.892728][T26793] RAX: ffffffffffffffda RBX: 00007fc180415fa0 RCX: 00007fc18019c629 [ 1902.892743][T26793] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000f [ 1902.892757][T26793] RBP: 00007fc17e3ee090 R08: 0000000000000000 R09: 0000000000000000 [ 1902.892771][T26793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1902.892784][T26793] R13: 00007fc180416038 R14: 00007fc180415fa0 R15: 00007fff803ddae8 [ 1902.892818][T26793] [ 1903.273572][T26805] netlink: 'syz.3.16714': attribute type 16 has an invalid length. [ 1903.281533][T26805] netlink: 'syz.3.16714': attribute type 17 has an invalid length. [ 1903.407889][T26809] netlink: 20 bytes leftover after parsing attributes in process `syz.5.16717'. [ 1903.510991][T26805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1903.531328][T26805] 8021q: adding VLAN 0 to HW filter on device team0 [ 1903.577114][T26805] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1903.619629][T26808] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1903.691471][T26814] syzkaller1: entered promiscuous mode [ 1903.703773][T26814] syzkaller1: entered allmulticast mode [ 1903.735292][T26808] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1903.960068][T26828] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20003 [ 1903.976295][T26808] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1903.991970][T26828] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20003 [ 1904.030655][T26828] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20003 [ 1904.080774][T26828] IPVS: set_ctl: invalid protocol: 58 172.20.20.187:20003 [ 1904.147190][T26808] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1904.437970][ T9374] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1904.462578][ T9374] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1904.580161][T11966] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1904.597128][T11966] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1904.610635][T26839] netlink: 148 bytes leftover after parsing attributes in process `syz.5.16727'. [ 1904.701944][T26839] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16727'. [ 1904.732840][T26839] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1904.886401][T26845] netlink: 24 bytes leftover after parsing attributes in process `syz.0.16730'. [ 1905.295561][T26854] bond0: (slave bridge_slave_1): Releasing backup interface [ 1905.323203][T26854] bridge_slave_1: left promiscuous mode [ 1905.358938][T26854] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 1905.731685][T26870] netlink: 'syz.5.16740': attribute type 1 has an invalid length. [ 1905.884528][T26870] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1905.996383][T26884] IPVS: sed: FWM 3 0x00000003 - no destination available [ 1906.006017][T21534] IPVS: starting estimator thread 0... [ 1906.040223][T26878] bond2: entered allmulticast mode [ 1906.051925][T26882] netlink: 'syz.1.16745': attribute type 4 has an invalid length. [ 1906.092366][T26885] IPVS: using max 25 ests per chain, 60000 per kthread [ 1906.324495][T26902] __nla_validate_parse: 1 callbacks suppressed [ 1906.324517][T26902] netlink: 7 bytes leftover after parsing attributes in process `syz.3.16751'. [ 1906.493669][T26910] netlink: 'syz.1.16754': attribute type 6 has an invalid length. [ 1906.531444][T26910] netlink: 'syz.1.16754': attribute type 6 has an invalid length. [ 1906.570352][T26914] bond3: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 1906.760079][T26922] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16758'. [ 1906.810890][T26929] netlink: 60 bytes leftover after parsing attributes in process `syz.5.16761'. [ 1906.951399][T26936] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.16763'. [ 1906.987482][T26939] netlink: 'syz.4.16762': attribute type 1 has an invalid length. [ 1907.034276][T26937] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16760'. [ 1907.142894][T26946] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16760'. [ 1907.164597][T26946] netlink: 24 bytes leftover after parsing attributes in process `syz.1.16760'. [ 1907.188703][T26940] bond4: entered allmulticast mode [ 1907.197653][T26950] netlink: 'syz.3.16765': attribute type 28 has an invalid length. [ 1907.545635][T26947] ip6_vti0 speed is unknown, defaulting to 1000 [ 1908.029610][T26977] netlink: 36 bytes leftover after parsing attributes in process `syz.5.16774'. [ 1908.067990][T26947] lo speed is unknown, defaulting to 1000 [ 1908.121577][T26981] netlink: 4188 bytes leftover after parsing attributes in process `syz.4.16775'. [ 1908.394650][T26989] netlink: 404 bytes leftover after parsing attributes in process `syz.5.16779'. [ 1908.724327][T26947] wg1 speed is unknown, defaulting to 1000 [ 1910.293017][T27039] ip6tnl0: Caught tx_queue_len zero misconfig [ 1910.913978][T27063] FAULT_INJECTION: forcing a failure. [ 1910.913978][T27063] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1910.942725][T27063] CPU: 1 UID: 0 PID: 27063 Comm: syz.1.16800 Not tainted syzkaller #0 PREEMPT(full) [ 1910.942756][T27063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1910.942769][T27063] Call Trace: [ 1910.942777][T27063] [ 1910.942787][T27063] dump_stack_lvl+0xe8/0x150 [ 1910.942820][T27063] should_fail_ex+0x412/0x560 [ 1910.942849][T27063] _copy_from_user+0x2d/0xb0 [ 1910.942880][T27063] ___sys_sendmsg+0x1c6/0x360 [ 1910.942918][T27063] ? __pfx____sys_sendmsg+0x10/0x10 [ 1910.942986][T27063] ? __fget_files+0x2a/0x420 [ 1910.943013][T27063] ? __fget_files+0x3a0/0x420 [ 1910.943052][T27063] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1910.943085][T27063] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1910.943132][T27063] ? __pfx_ksys_write+0x10/0x10 [ 1910.943167][T27063] do_syscall_64+0x14d/0xf80 [ 1910.943198][T27063] ? trace_irq_disable+0x3b/0x150 [ 1910.943226][T27063] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1910.943248][T27063] ? clear_bhb_loop+0x40/0x90 [ 1910.943272][T27063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1910.943303][T27063] RIP: 0033:0x7f7bb559c629 [ 1910.943323][T27063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1910.943342][T27063] RSP: 002b:00007f7bb637d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1910.943366][T27063] RAX: ffffffffffffffda RBX: 00007f7bb5815fa0 RCX: 00007f7bb559c629 [ 1910.943382][T27063] RDX: 0000000004040080 RSI: 0000200000000000 RDI: 0000000000000003 [ 1910.943396][T27063] RBP: 00007f7bb637d090 R08: 0000000000000000 R09: 0000000000000000 [ 1910.943409][T27063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1910.943422][T27063] R13: 00007f7bb5816038 R14: 00007f7bb5815fa0 R15: 00007ffc88f77638 [ 1910.943458][T27063] [ 1911.435947][T27068] __nla_validate_parse: 19 callbacks suppressed [ 1911.435968][T27068] netlink: 8 bytes leftover after parsing attributes in process `syz.1.16803'. [ 1911.458730][T27069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16802'. [ 1911.487616][T27070] netlink: 4 bytes leftover after parsing attributes in process `syz.1.16803'. [ 1911.506091][T27072] netlink: 148 bytes leftover after parsing attributes in process `syz.4.16804'. [ 1911.629954][T27072] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16804'. [ 1911.662439][T27072] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1911.706604][T27068] macsec2: entered allmulticast mode [ 1911.742670][T27068] macsec0: entered allmulticast mode [ 1911.758795][T27081] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16806'. [ 1911.805971][T27083] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16807'. [ 1912.083805][T27102] sctp: [Deprecated]: syz.4.16809 (pid 27102) Use of int in max_burst socket option. [ 1912.083805][T27102] Use struct sctp_assoc_value instead [ 1912.351547][T27112] netlink: 180 bytes leftover after parsing attributes in process `syz.3.16813'. [ 1912.438775][T27116] netlink: 24 bytes leftover after parsing attributes in process `syz.0.16815'. [ 1912.503908][T20926] Bluetooth: hci2: command 0x0406 tx timeout [ 1912.694674][T27128] netlink: 12 bytes leftover after parsing attributes in process `syz.5.16820'. [ 1912.959048][T27134] syzkaller0: entered promiscuous mode [ 1912.971476][T27134] syzkaller0: entered allmulticast mode [ 1913.096287][T27140] netlink: 'syz.4.16822': attribute type 1 has an invalid length. [ 1914.235964][T27164] netlink: 'syz.3.16828': attribute type 13 has an invalid length. [ 1914.679290][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1916.849626][T27183] syzkaller0: entered promiscuous mode [ 1916.856111][T27183] syzkaller0: entered allmulticast mode [ 1916.876726][T27191] __nla_validate_parse: 3 callbacks suppressed [ 1916.876758][T27191] netlink: 16 bytes leftover after parsing attributes in process `syz.1.16833'. [ 1917.014108][T27195] netlink: 176 bytes leftover after parsing attributes in process `syz.0.16836'. [ 1917.102642][T27201] netlink: 180 bytes leftover after parsing attributes in process `syz.5.16838'. [ 1917.395288][T27217] netlink: 'syz.0.16843': attribute type 1 has an invalid length. [ 1917.415144][T27217] netlink: 'syz.0.16843': attribute type 2 has an invalid length. [ 1917.440529][T27216] netlink: 'syz.0.16843': attribute type 1 has an invalid length. [ 1917.458203][T27219] netlink: 12 bytes leftover after parsing attributes in process `syz.4.16844'. [ 1917.473420][T27216] netlink: 'syz.0.16843': attribute type 2 has an invalid length. [ 1917.503551][T27217] netlink: 'syz.0.16843': attribute type 1 has an invalid length. [ 1917.532800][T27218] netlink: 'syz.0.16843': attribute type 1 has an invalid length. [ 1917.609818][T27216] netlink: 28 bytes leftover after parsing attributes in process `syz.0.16843'. [ 1917.815848][T27233] ip6_vti0 speed is unknown, defaulting to 1000 [ 1917.899241][T27241] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16850'. [ 1917.948777][T27241] vlan2: entered promiscuous mode [ 1917.954173][T27241] gretap0: entered promiscuous mode [ 1918.406733][T27258] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1918.446331][T27258] IPVS: set_ctl: invalid protocol: 38974 0.0.0.0:0 [ 1918.676808][T27233] lo speed is unknown, defaulting to 1000 [ 1919.000025][T27280] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16858'. [ 1919.124503][T27285] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16861'. [ 1919.134159][T27284] syzkaller1: entered promiscuous mode [ 1919.134185][T27284] syzkaller1: entered allmulticast mode [ 1919.410613][T27233] wg1 speed is unknown, defaulting to 1000 [ 1919.419907][T27290] netlink: 148 bytes leftover after parsing attributes in process `syz.3.16864'. [ 1919.642052][T27303] netlink: 4 bytes leftover after parsing attributes in process `syz.3.16864'. [ 1919.680543][T27303] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1919.942378][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5260 ms [ 1919.950493][ C0] lec:lec_tx_timeout: lec0 [ 1920.500773][T27312] netlink: 'syz.0.16870': attribute type 4 has an invalid length. [ 1920.900466][T27242] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1921.083375][T27330] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1921.470101][T27351] bridge_slave_1: left allmulticast mode [ 1921.476591][T27351] bridge_slave_1: left promiscuous mode [ 1921.483454][T27351] bridge0: port 2(bridge_slave_1) entered disabled state [ 1921.529917][T27345] ip6_vti0 speed is unknown, defaulting to 1000 [ 1921.909073][T27368] __nla_validate_parse: 3 callbacks suppressed [ 1921.909095][T27368] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16889'. [ 1922.200796][T27376] x_tables: duplicate entry at hook 2 [ 1922.279082][T27386] netlink: 148 bytes leftover after parsing attributes in process `syz.5.16894'. [ 1922.353941][T27386] netlink: 8 bytes leftover after parsing attributes in process `syz.5.16894'. [ 1922.384977][T27386] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1922.567052][T27397] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16898'. [ 1922.623068][T27397] vlan0: entered promiscuous mode [ 1922.813865][T27412] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.16904'. [ 1922.871117][T27417] netlink: 344 bytes leftover after parsing attributes in process `syz.1.16905'. [ 1922.914713][T27350] syzkaller0: entered promiscuous mode [ 1922.923435][T27350] syzkaller0: entered allmulticast mode [ 1922.984998][T27345] lo speed is unknown, defaulting to 1000 [ 1923.131313][T27427] netlink: 12 bytes leftover after parsing attributes in process `syz.3.16906'. [ 1923.162558][T27426] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1923.199809][T27426] IPVS: sh: FWM 3 0x00000003 - no destination available [ 1923.345275][T27433] netlink: 12 bytes leftover after parsing attributes in process `syz.1.16910'. [ 1923.384735][T27434] netlink: 12 bytes leftover after parsing attributes in process `syz.0.16909'. [ 1923.506295][T27434] vlan2: entered promiscuous mode [ 1923.556393][T27433] vlan2: entered promiscuous mode [ 1923.613768][T27442] netlink: 20 bytes leftover after parsing attributes in process `syz.3.16914'. [ 1923.924149][T27345] wg1 speed is unknown, defaulting to 1000 [ 1924.049134][T27453] vlan2: entered promiscuous mode [ 1924.187559][T27455] batman_adv: batadv0: Adding interface: dummy0 [ 1924.194173][T27455] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1924.240550][T27455] batman_adv: batadv0: Interface activated: dummy0 [ 1924.280296][T27458] batadv0: mtu less than device minimum [ 1924.305563][T27458] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.318170][T27458] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.330218][T27458] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.342276][T27458] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 1924.470695][T27463] xt_hashlimit: size too large, truncated to 1048576 [ 1924.700628][T27472] vlan3: entered promiscuous mode [ 1925.186013][T27484] FAULT_INJECTION: forcing a failure. [ 1925.186013][T27484] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1925.264659][T27484] CPU: 0 UID: 0 PID: 27484 Comm: syz.3.16931 Not tainted syzkaller #0 PREEMPT(full) [ 1925.264690][T27484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1925.264705][T27484] Call Trace: [ 1925.264715][T27484] [ 1925.264725][T27484] dump_stack_lvl+0xe8/0x150 [ 1925.264761][T27484] should_fail_ex+0x412/0x560 [ 1925.264792][T27484] _copy_to_user+0x31/0xb0 [ 1925.264826][T27484] do_ip_vs_get_ctl+0x8b8/0xd90 [ 1925.264856][T27484] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1925.264893][T27484] ? __pfx_do_ip_vs_get_ctl+0x10/0x10 [ 1925.264936][T27484] ? nf_getsockopt+0x224/0x290 [ 1925.264972][T27484] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1925.265004][T27484] ? kstrtoull+0x12f/0x1d0 [ 1925.265028][T27484] ? __pfx___mutex_lock+0x10/0x10 [ 1925.265061][T27484] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1925.265124][T27484] nf_getsockopt+0x26e/0x290 [ 1925.265163][T27484] ip_getsockopt+0x19e/0x230 [ 1925.265191][T27484] ? __pfx_ip_getsockopt+0x10/0x10 [ 1925.265210][T27484] ? aa_sk_perm+0x82d/0x960 [ 1925.265244][T27484] ipv6_getsockopt+0x182/0x2b0 [ 1925.265280][T27484] ? __pfx_ipv6_getsockopt+0x10/0x10 [ 1925.265316][T27484] ? sctp_getsockopt+0x9b/0xb90 [ 1925.265344][T27484] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 1925.265371][T27484] do_sock_getsockopt+0x2d3/0x3f0 [ 1925.265404][T27484] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1925.265435][T27484] ? __fget_files+0x3a0/0x420 [ 1925.265464][T27484] ? __fget_files+0x2a/0x420 [ 1925.265502][T27484] __x64_sys_getsockopt+0x1a4/0x240 [ 1925.265543][T27484] do_syscall_64+0x14d/0xf80 [ 1925.265574][T27484] ? trace_irq_disable+0x3b/0x150 [ 1925.265604][T27484] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1925.265627][T27484] ? clear_bhb_loop+0x40/0x90 [ 1925.265653][T27484] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1925.265674][T27484] RIP: 0033:0x7f384399c629 [ 1925.265695][T27484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1925.265715][T27484] RSP: 002b:00007f3844775028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 1925.265739][T27484] RAX: ffffffffffffffda RBX: 00007f3843c15fa0 RCX: 00007f384399c629 [ 1925.265755][T27484] RDX: 0000000000000481 RSI: 0000000000000000 RDI: 0000000000000003 [ 1925.265769][T27484] RBP: 00007f3844775090 R08: 0000200000000100 R09: 0000000000000000 [ 1925.265783][T27484] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1925.265798][T27484] R13: 00007f3843c16038 R14: 00007f3843c15fa0 R15: 00007fff19eee8d8 [ 1925.265835][T27484] [ 1926.108543][T27502] vlan3: entered promiscuous mode [ 1926.667248][T27514] net_ratelimit: 15 callbacks suppressed [ 1926.667268][T27514] IPVS: sed: FWM 3 0x00000003 - no destination available [ 1926.701865][T27533] openvswitch: netlink: IP tunnel TTL not specified. [ 1926.896153][T27537] vlan3: entered promiscuous mode [ 1927.033448][T27549] ip6tnl0: Caught tx_queue_len zero misconfig [ 1927.092625][T27549] __nla_validate_parse: 13 callbacks suppressed [ 1927.092647][T27549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16954'. [ 1927.154403][T27549] netlink: 168 bytes leftover after parsing attributes in process `syz.3.16954'. [ 1927.195114][T27557] netlink: 32 bytes leftover after parsing attributes in process `syz.1.16957'. [ 1927.221601][T27549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16954'. [ 1927.254573][T27559] netlink: 12 bytes leftover after parsing attributes in process `syz.5.16956'. [ 1927.275330][T27560] netlink: 308 bytes leftover after parsing attributes in process `syz.0.16958'. [ 1927.394570][T27563] bond0: Caught tx_queue_len zero misconfig [ 1927.617476][T27563] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1927.670162][T27573] netlink: 566 bytes leftover after parsing attributes in process `syz.3.16963'. [ 1927.674120][T27563] netlink: 312 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1927.713137][T27563] netlink: 8 bytes leftover after parsing attributes in process `syz.4.16959'. [ 1928.167404][T27586] syzkaller1: entered promiscuous mode [ 1928.215407][T27586] syzkaller1: entered allmulticast mode [ 1928.438113][T27597] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1928.851423][T27613] netlink: 'syz.5.16971': attribute type 11 has an invalid length. [ 1929.165695][T27628] x_tables: unsorted underflow at hook 3 [ 1929.533532][T27644] ip6tnl0: Caught tx_queue_len zero misconfig [ 1929.557018][T27644] netlink: 'syz.0.16985': attribute type 10 has an invalid length. [ 1930.634906][T27669] bond1: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 1930.673165][T27672] netlink: 'syz.4.16993': attribute type 1 has an invalid length. [ 1930.708572][T27669] bond1 (unregistering): Released all slaves [ 1931.593902][T27701] ip6_vti0 speed is unknown, defaulting to 1000 [ 1931.730791][T27706] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1931.778776][T27708] gretap2: entered promiscuous mode [ 1932.340414][T27722] __nla_validate_parse: 9 callbacks suppressed [ 1932.340436][T27722] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17010'. [ 1932.624986][T27731] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17013'. [ 1932.899680][T27701] lo speed is unknown, defaulting to 1000 [ 1933.088779][T27746] netlink: 32 bytes leftover after parsing attributes in process `syz.1.17019'. [ 1933.123999][T27746] netlink: 32 bytes leftover after parsing attributes in process `syz.1.17019'. [ 1933.462956][T27757] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17022'. [ 1933.474248][T27756] netlink: 36 bytes leftover after parsing attributes in process `syz.5.17021'. [ 1933.814217][T27768] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.17025'. [ 1933.978143][T27701] wg1 speed is unknown, defaulting to 1000 [ 1934.146691][T27779] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17031'. [ 1934.162453][T27780] netlink: 'syz.4.17030': attribute type 21 has an invalid length. [ 1934.288531][T27786] netlink: 20 bytes leftover after parsing attributes in process `syz.5.17033'. [ 1934.534411][T27782] syzkaller0: entered promiscuous mode [ 1934.539972][T27782] syzkaller0: entered allmulticast mode [ 1934.838468][T27787] ip6_vti0 speed is unknown, defaulting to 1000 [ 1935.035948][T27812] xt_bpf: check failed: parse error [ 1935.213774][T27824] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17043'. [ 1937.635424][T22488] lec:lec_start_xmit: lec0:No lecd attached [ 1938.139226][T27824] vlan4: entered promiscuous mode [ 1938.177610][T27829] vlan2: entered promiscuous mode [ 1938.189921][T27787] lo speed is unknown, defaulting to 1000 [ 1938.375708][T27832] __nla_validate_parse: 1 callbacks suppressed [ 1938.375731][T27832] netlink: 20 bytes leftover after parsing attributes in process `syz.5.17047'. [ 1938.778815][T27854] netlink: 4188 bytes leftover after parsing attributes in process `syz.5.17055'. [ 1938.981831][T27857] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17056'. [ 1939.183461][T27787] wg1 speed is unknown, defaulting to 1000 [ 1939.202129][T27869] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17060'. [ 1939.243204][T27858] ip6_vti0 speed is unknown, defaulting to 1000 [ 1939.268859][T27872] xt_policy: output policy not valid in PREROUTING and INPUT [ 1939.387525][T27866] tipc: Enabled bearer , priority 0 [ 1939.711888][T27874] syzkaller0: entered promiscuous mode [ 1939.726139][T27874] syzkaller0: entered allmulticast mode [ 1939.746190][T27874] tipc: Resetting bearer [ 1939.993641][T27860] tipc: Resetting bearer [ 1940.022632][T27883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17063'. [ 1940.056993][T27883] netlink: 168 bytes leftover after parsing attributes in process `syz.4.17063'. [ 1940.084606][T27885] netlink: 292 bytes leftover after parsing attributes in process `syz.4.17063'. [ 1940.102943][T27883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17063'. [ 1942.992387][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5340 ms [ 1943.000721][ C0] lec:lec_tx_timeout: lec0 [ 1943.201932][T27860] tipc: Disabling bearer [ 1943.297351][T27858] lo speed is unknown, defaulting to 1000 [ 1943.602787][T27897] : renamed from bond_slave_0 [ 1943.802854][T27907] netlink: 'syz.0.17069': attribute type 6 has an invalid length. [ 1943.864532][T27858] wg1 speed is unknown, defaulting to 1000 [ 1944.090615][T27912] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17073'. [ 1944.591633][T27926] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17076'. [ 1944.615330][T27926] netlink: 168 bytes leftover after parsing attributes in process `syz.4.17076'. [ 1944.672781][T27926] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17076'. [ 1944.710381][T27921] netlink: 292 bytes leftover after parsing attributes in process `syz.4.17076'. [ 1945.253336][T27942] netlink: 'syz.5.17082': attribute type 1 has an invalid length. [ 1945.262409][T27942] netlink: 'syz.5.17082': attribute type 2 has an invalid length. [ 1945.523128][T27950] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17085'. [ 1945.606332][T27954] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17087'. [ 1945.622422][T27950] vlan2: entered promiscuous mode [ 1945.785272][T27961] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17090'. [ 1945.820295][T27961] netlink: 168 bytes leftover after parsing attributes in process `syz.5.17090'. [ 1945.855628][T27961] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17090'. [ 1946.026291][T27969] : entered promiscuous mode [ 1946.464629][ T9374] erspan0 (unregistering): left promiscuous mode [ 1946.736832][ T9374] bond1 (unregistering): (slave bridge1): Releasing active interface [ 1946.762566][ T9374] bond1 (unregistering): (slave bridge1): the permanent HWaddr of slave - a2:73:02:b6:13:73 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1946.859323][ T9374] bond1 (unregistering): (slave bridge2): Releasing active interface [ 1947.128134][ T9374] bond1 (unregistering): Released all slaves [ 1947.149564][ T9374] bond2 (unregistering): Released all slaves [ 1947.181717][ T9374] bond3 (unregistering): Released all slaves [ 1947.205254][ T9374] bond0 (unregistering): Released all slaves [ 1947.248256][ T9374] bond4 (unregistering): Released all slaves [ 1947.356166][T28005] vlan2: entered promiscuous mode [ 1947.542858][ T9374] tipc: Left network mode [ 1947.602518][T28012] ip6tnl0: Caught tx_queue_len zero misconfig [ 1947.644165][T28007] ip6_vti0 speed is unknown, defaulting to 1000 [ 1948.000137][T28029] netlink: 'syz.4.17111': attribute type 10 has an invalid length. [ 1948.564581][T28045] netlink: 'syz.5.17117': attribute type 3 has an invalid length. [ 1948.611859][T28007] lo speed is unknown, defaulting to 1000 [ 1949.407129][T28080] __nla_validate_parse: 14 callbacks suppressed [ 1949.407155][T28080] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17129'. [ 1949.477632][T28007] wg1 speed is unknown, defaulting to 1000 [ 1949.577861][T28083] netlink: 'syz.0.17130': attribute type 3 has an invalid length. [ 1949.590363][T28085] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17131'. [ 1949.609779][T28083] netlink: 666 bytes leftover after parsing attributes in process `syz.0.17130'. [ 1949.643916][T28085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.17131'. [ 1949.710924][T28085] netlink: 'syz.3.17131': attribute type 12 has an invalid length. [ 1949.885883][T11963] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1949.933923][T11963] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1950.085436][T11963] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1950.108351][T11963] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1950.307632][T28109] netlink: 4188 bytes leftover after parsing attributes in process `syz.0.17137'. [ 1950.425821][T28114] netlink: 24 bytes leftover after parsing attributes in process `syz.3.17139'. [ 1950.521244][T28114] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17139'. [ 1950.729623][T28116] syzkaller0: entered promiscuous mode [ 1950.758124][T28127] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17141'. [ 1950.769214][T28116] syzkaller0: entered allmulticast mode [ 1950.821480][T28129] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17141'. [ 1950.896145][ T9374] hsr_slave_0: left promiscuous mode [ 1950.918723][ T9374] hsr_slave_1: left promiscuous mode [ 1950.942897][ T9374] veth1_vlan: left allmulticast mode [ 1951.291771][T28132] netlink: 12 bytes leftover after parsing attributes in process `syz.5.17142'. [ 1952.125665][T28132] vlan3: entered promiscuous mode [ 1955.722835][T28150] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1955.734143][T28124] ip6_vti0 speed is unknown, defaulting to 1000 [ 1955.908715][T28159] __nla_validate_parse: 1 callbacks suppressed [ 1955.908743][T28159] netlink: 4188 bytes leftover after parsing attributes in process `syz.4.17151'. [ 1956.405026][T28175] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17159'. [ 1956.495675][T28175] macvtap1: entered promiscuous mode [ 1956.524708][T28175] dummy0: entered promiscuous mode [ 1956.539262][T28175] macvtap1: entered allmulticast mode [ 1956.546379][T28175] dummy0: entered allmulticast mode [ 1956.609017][T28124] lo speed is unknown, defaulting to 1000 [ 1956.711857][T28175] dummy0: left allmulticast mode [ 1956.727912][T28190] FAULT_INJECTION: forcing a failure. [ 1956.727912][T28190] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1956.742258][T28175] dummy0: left promiscuous mode [ 1956.747613][T28190] CPU: 0 UID: 0 PID: 28190 Comm: syz.3.17163 Not tainted syzkaller #0 PREEMPT(full) [ 1956.747642][T28190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1956.747656][T28190] Call Trace: [ 1956.747664][T28190] [ 1956.747673][T28190] dump_stack_lvl+0xe8/0x150 [ 1956.747707][T28190] should_fail_ex+0x412/0x560 [ 1956.747736][T28190] _copy_from_user+0x2d/0xb0 [ 1956.747767][T28190] bpf_test_init+0xd8/0x150 [ 1956.747796][T28190] bpf_prog_test_run_xdp+0x529/0x1160 [ 1956.747846][T28190] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1956.747878][T28190] ? __fget_files+0x2a/0x420 [ 1956.747914][T28190] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1956.747941][T28190] bpf_prog_test_run+0x2c7/0x340 [ 1956.747967][T28190] __sys_bpf+0x643/0x950 [ 1956.748001][T28190] ? __pfx___sys_bpf+0x10/0x10 [ 1956.748048][T28190] ? ksys_write+0x242/0x270 [ 1956.748072][T28190] ? __pfx_ksys_write+0x10/0x10 [ 1956.748102][T28190] __x64_sys_bpf+0x7c/0x90 [ 1956.748131][T28190] do_syscall_64+0x14d/0xf80 [ 1956.748162][T28190] ? trace_irq_disable+0x3b/0x150 [ 1956.748192][T28190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1956.748214][T28190] ? clear_bhb_loop+0x40/0x90 [ 1956.748239][T28190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1956.748260][T28190] RIP: 0033:0x7f384399c629 [ 1956.748281][T28190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1956.748300][T28190] RSP: 002b:00007f3844775028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1956.748323][T28190] RAX: ffffffffffffffda RBX: 00007f3843c15fa0 RCX: 00007f384399c629 [ 1956.748338][T28190] RDX: 0000000000000050 RSI: 0000200000000280 RDI: 000000000000000a [ 1956.748352][T28190] RBP: 00007f3844775090 R08: 0000000000000000 R09: 0000000000000000 [ 1956.748366][T28190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1956.748379][T28190] R13: 00007f3843c16038 R14: 00007f3843c15fa0 R15: 00007fff19eee8d8 [ 1956.748413][T28190] [ 1956.972881][T28185] block nbd2: server does not support multiple connections per device. [ 1956.981812][T28185] block nbd2: shutting down sockets [ 1957.256521][T28199] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.17165'. [ 1957.584081][T28212] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17172'. [ 1957.640450][T28212] netlink: 112 bytes leftover after parsing attributes in process `syz.1.17172'. [ 1957.663496][T28212] syz.1.17172: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1957.679392][T28219] sctp: [Deprecated]: syz.3.17174 (pid 28219) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1957.679392][T28219] Use struct sctp_sack_info instead [ 1957.712331][T28212] CPU: 0 UID: 0 PID: 28212 Comm: syz.1.17172 Not tainted syzkaller #0 PREEMPT(full) [ 1957.712366][T28212] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1957.712381][T28212] Call Trace: [ 1957.712390][T28212] [ 1957.712399][T28212] dump_stack_lvl+0xe8/0x150 [ 1957.712434][T28212] warn_alloc+0x249/0x340 [ 1957.712461][T28212] ? stack_trace_save+0xa9/0x100 [ 1957.712487][T28212] ? __pfx_warn_alloc+0x10/0x10 [ 1957.712518][T28212] ? kasan_save_track+0x4f/0x80 [ 1957.712537][T28212] ? kasan_save_track+0x3e/0x80 [ 1957.712556][T28212] ? __kasan_kmalloc+0x93/0xb0 [ 1957.712576][T28212] ? __kmalloc_cache_noprof+0x31c/0x660 [ 1957.712597][T28212] ? xskq_create+0x56/0x170 [ 1957.712630][T28212] ? xsk_setsockopt+0x54c/0x990 [ 1957.712656][T28212] ? do_sock_setsockopt+0x17c/0x1b0 [ 1957.712693][T28212] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 1957.712721][T28212] ? do_syscall_64+0x14d/0xf80 [ 1957.712758][T28212] __vmalloc_node_range_noprof+0x132/0x1730 [ 1957.712817][T28212] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1957.712847][T28212] ? __kasan_kmalloc+0x93/0xb0 [ 1957.712879][T28212] vmalloc_user_noprof+0xad/0xe0 [ 1957.712901][T28212] ? xskq_create+0xbf/0x170 [ 1957.712931][T28212] xskq_create+0xbf/0x170 [ 1957.712964][T28212] xsk_init_queue+0x8a/0xe0 [ 1957.712995][T28212] xsk_setsockopt+0x54c/0x990 [ 1957.713026][T28212] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1957.713053][T28212] ? __pfx_aa_sk_perm+0x10/0x10 [ 1957.713082][T28212] ? aa_sock_opt_perm+0xff/0x1a0 [ 1957.713112][T28212] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1957.713135][T28212] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1957.713165][T28212] do_sock_setsockopt+0x17c/0x1b0 [ 1957.713201][T28212] __x64_sys_setsockopt+0x13d/0x1b0 [ 1957.713238][T28212] do_syscall_64+0x14d/0xf80 [ 1957.713269][T28212] ? trace_irq_disable+0x3b/0x150 [ 1957.713300][T28212] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1957.713323][T28212] ? clear_bhb_loop+0x40/0x90 [ 1957.713350][T28212] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1957.713372][T28212] RIP: 0033:0x7f7bb559c629 [ 1957.713394][T28212] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1957.713419][T28212] RSP: 002b:00007f7bb637d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1957.713443][T28212] RAX: ffffffffffffffda RBX: 00007f7bb5815fa0 RCX: 00007f7bb559c629 [ 1957.713461][T28212] RDX: 0000000000000006 RSI: 000000000000011b RDI: 000000000000000e [ 1957.713475][T28212] RBP: 00007f7bb5632b39 R08: 0000000000000004 R09: 0000000000000000 [ 1957.713489][T28212] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1957.713503][T28212] R13: 00007f7bb5816038 R14: 00007f7bb5815fa0 R15: 00007ffc88f77638 [ 1957.713539][T28212] [ 1957.713563][T28212] Mem-Info: [ 1958.048296][T28212] active_anon:10793 inactive_anon:1 isolated_anon:0 [ 1958.048296][T28212] active_file:3002 inactive_file:41645 isolated_file:0 [ 1958.048296][T28212] unevictable:768 dirty:173 writeback:0 [ 1958.048296][T28212] slab_reclaimable:15232 slab_unreclaimable:186447 [ 1958.048296][T28212] mapped:32452 shmem:1381 pagetables:2459 [ 1958.048296][T28212] sec_pagetables:0 bounce:0 [ 1958.048296][T28212] kernel_misc_reclaimable:0 [ 1958.048296][T28212] free:1208193 free_pcp:21969 free_cma:0 [ 1958.118327][T28212] Node 0 active_anon:43172kB inactive_anon:4kB active_file:12008kB inactive_file:166380kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:23312kB dirty:592kB writeback:100kB shmem:3988kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:18564kB pagetables:9696kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1958.167594][T28212] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:106496kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1958.242481][T28212] Node 0 DMA free:11224kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:40kB local_pcp:8kB free_cma:0kB [ 1958.381145][T28212] lowmem_reserve[]: 0 2493 2493 2493 2493 [ 1958.430623][T28212] Node 0 DMA32 free:1130492kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:42972kB inactive_anon:4kB active_file:12008kB inactive_file:166380kB unevictable:1536kB writepending:592kB zspages:0kB present:3129332kB managed:2552852kB mlocked:0kB bounce:0kB free_pcp:40408kB local_pcp:19740kB free_cma:0kB [ 1958.521808][T28212] lowmem_reserve[]: 0 0 0 0 0 [ 1958.558223][T28212] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:4kB free_cma:0kB [ 1958.608776][T28212] lowmem_reserve[]: 0 0 0 0 0 [ 1958.628235][T28212] Node 1 Normal free:3691376kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:47564kB local_pcp:23504kB free_cma:0kB [ 1958.722859][T28212] lowmem_reserve[]: 0 0 0 0 0 [ 1958.727784][T28212] Node 0 DMA: 0*4kB 1*8kB (U) 1*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 0*4096kB = 11224kB [ 1958.803006][T28212] Node 0 DMA32: 10563*4kB (UME) 10912*8kB (UME) 7145*16kB (UME) 464*32kB (UME) 156*64kB (UME) 58*128kB (UME) 231*256kB (UME) 412*512kB (UM) 325*1024kB (UME) 123*2048kB (U) 0*4096kB = 1130908kB [ 1958.881048][T28212] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1958.962875][T28212] Node 1 Normal: 7*4kB (UM) 12*8kB (UM) 19*16kB (UME) 12*32kB (UME) 21*64kB (UM) 12*128kB (UME) 12*256kB (UME) 13*512kB (UME) 8*1024kB (UM) 10*2048kB (UE) 891*4096kB (UM) = 3691628kB [ 1959.026899][T28212] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1959.059442][T28212] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1959.097943][T28212] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1959.132300][T28212] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1959.141781][T28212] 46024 total pagecache pages [ 1959.187119][T28212] 0 pages in swap cache [ 1959.191529][T28212] Free swap = 124996kB [ 1959.212638][T28212] Total swap = 124996kB [ 1959.216959][T28212] 2097051 pages RAM [ 1959.220818][T28212] 0 pages HighMem/MovableOnly [ 1959.270437][T28212] 427002 pages reserved [ 1959.279613][T28212] 0 pages cma reserved [ 1959.317530][T28239] tipc: Enabled bearer , priority 0 [ 1959.325761][T28262] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17186'. [ 1959.440293][T28241] syzkaller0: entered promiscuous mode [ 1959.448132][T28241] syzkaller0: entered allmulticast mode [ 1959.535136][T28267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17187'. [ 1959.585513][T28255] tipc: Resetting bearer [ 1959.803415][T28255] tipc: Disabling bearer [ 1959.825727][T28285] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17190'. [ 1959.853016][T28285] netlink: 168 bytes leftover after parsing attributes in process `syz.4.17190'. [ 1959.877097][T28280] netlink: 292 bytes leftover after parsing attributes in process `syz.4.17190'. [ 1960.512726][T28316] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1960.572709][T28316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1960.605657][T28316] bond5: (slave bond0): Enslaving as an active interface with an up link [ 1960.949734][T28338] syzkaller0: entered promiscuous mode [ 1960.957460][T28338] syzkaller0: entered allmulticast mode [ 1961.354903][T28326] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1961.538708][T28353] __nla_validate_parse: 4 callbacks suppressed [ 1961.538738][T28353] netlink: 20 bytes leftover after parsing attributes in process `syz.5.17214'. [ 1961.588416][T28356] netlink: 16 bytes leftover after parsing attributes in process `syz.1.17215'. [ 1961.958836][T28360] netlink: 'syz.3.17217': attribute type 8 has an invalid length. [ 1962.011887][T28366] netlink: 28 bytes leftover after parsing attributes in process `syz.5.17219'. [ 1962.665652][ T4090] Bluetooth: hci0: command 0x0406 tx timeout [ 1965.985189][T28402] netlink: 36 bytes leftover after parsing attributes in process `syz.3.17230'. [ 1966.002460][T28405] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17232'. [ 1966.137200][T28415] netlink: 28 bytes leftover after parsing attributes in process `syz.0.17235'. [ 1966.473876][T28432] netlink: 20 bytes leftover after parsing attributes in process `syz.0.17241'. [ 1967.418348][T28458] netlink: 36 bytes leftover after parsing attributes in process `syz.5.17247'. [ 1970.639023][T28461] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 1970.670980][T28467] netlink: 4188 bytes leftover after parsing attributes in process `syz.5.17252'. [ 1970.692435][T28468] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17251'. [ 1970.729452][T28468] vlan1: entered promiscuous mode [ 1970.792358][T28469] bond0: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1971.029639][T28485] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17258'. [ 1971.422925][T28505] netlink: 20 bytes leftover after parsing attributes in process `syz.1.17265'. [ 1971.929921][T28520] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17270'. [ 1971.946886][T28520] netlink: 168 bytes leftover after parsing attributes in process `syz.0.17270'. [ 1971.961754][T28520] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17270'. [ 1971.975119][T28520] netlink: 292 bytes leftover after parsing attributes in process `syz.0.17270'. [ 1973.870054][T28516] Bluetooth: hci2: command 0x0406 tx timeout [ 1975.166604][T28498] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1975.410514][T28533] tipc: Enabled bearer , priority 0 [ 1975.423981][T28535] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17273'. [ 1975.479103][T28528] tipc: Disabling bearer [ 1975.684771][T28550] syzkaller1: entered promiscuous mode [ 1975.720938][T28550] syzkaller1: entered allmulticast mode [ 1975.875669][T28561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17281'. [ 1975.886946][T28561] netlink: 168 bytes leftover after parsing attributes in process `syz.1.17281'. [ 1975.922450][T28561] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17281'. [ 1975.966579][T28558] netlink: 292 bytes leftover after parsing attributes in process `syz.1.17281'. [ 1976.109504][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 1976.245238][T28578] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17285'. [ 1976.301134][T28578] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17285'. [ 1976.315933][T28578] netlink: 336 bytes leftover after parsing attributes in process `syz.4.17285'. [ 1976.363848][T28578] netlink: 4 bytes leftover after parsing attributes in process `syz.4.17285'. [ 1976.398327][T28578] netlink: 336 bytes leftover after parsing attributes in process `syz.4.17285'. [ 1976.909498][T28600] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1976.956318][T28598] syzkaller0: entered promiscuous mode [ 1976.994254][T28598] syzkaller0: entered allmulticast mode [ 1977.451029][T28618] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 1978.136778][T28655] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1978.394542][T28663] netlink: 'syz.0.17313': attribute type 1 has an invalid length. [ 1978.473141][T28663] bond1: entered promiscuous mode [ 1978.478806][T28663] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1978.795060][T28675] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1978.827358][T28675] tipc: Enabled bearer , priority 0 [ 1978.857617][T28675] syzkaller0: entered promiscuous mode [ 1978.892434][T28675] syzkaller0: entered allmulticast mode [ 1979.029720][T28688] geneve3: entered promiscuous mode [ 1979.035457][T28688] geneve3: entered allmulticast mode [ 1979.073209][T28674] tipc: Resetting bearer [ 1979.156749][T28674] tipc: Disabling bearer [ 1979.232776][T28687] lo: Caught tx_queue_len zero misconfig [ 1979.860427][T28689] bond0: option packets_per_slave: invalid value (1048582) [ 1979.904594][T28689] bond0: option packets_per_slave: allowed values 0 - 65535 [ 1979.957060][T28689] bond0 (unregistering): Released all slaves [ 1980.956752][T28724] __nla_validate_parse: 15 callbacks suppressed [ 1980.956775][T28724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17332'. [ 1981.008632][T28728] netlink: 292 bytes leftover after parsing attributes in process `syz.1.17332'. [ 1981.019035][T28724] netlink: 168 bytes leftover after parsing attributes in process `syz.1.17332'. [ 1981.073700][T28724] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17332'. [ 1981.122243][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1981.130527][ C0] lec:lec_tx_timeout: lec0 [ 1981.404691][T28746] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 1981.426414][T28746] netlink: 212916 bytes leftover after parsing attributes in process `syz.1.17337'. [ 1982.732947][T28792] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17352'. [ 1982.865166][T28794] netlink: 'syz.1.17354': attribute type 21 has an invalid length. [ 1982.874886][T28796] netlink: 'syz.0.17355': attribute type 9 has an invalid length. [ 1989.254813][T28792] vlan4: entered promiscuous mode [ 1989.481451][T28812] x_tables: unsorted underflow at hook 3 [ 1989.638093][T28812] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1989.661736][T28819] netlink: 4188 bytes leftover after parsing attributes in process `syz.1.17363'. [ 1989.714665][T28820] tipc: Enabling of bearer rejected, failed to enable media [ 1989.829419][T28826] netlink: 4188 bytes leftover after parsing attributes in process `syz.0.17364'. [ 1990.058481][T28834] netlink: 12 bytes leftover after parsing attributes in process `syz.1.17369'. [ 1990.131756][T28834] vlan2: entered promiscuous mode [ 1990.137530][T28834] bridge0: entered promiscuous mode [ 1991.955980][T28879] netlink: 148 bytes leftover after parsing attributes in process `syz.5.17382'. [ 1992.053838][T28880] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17382'. [ 1992.090542][T28880] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1998.530298][T28884] netlink: 12 bytes leftover after parsing attributes in process `syz.0.17383'. [ 1998.664432][T28884] vlan2: entered promiscuous mode [ 1998.740401][T28893] hsr0: entered promiscuous mode [ 1998.804035][T28893] hsr0: left promiscuous mode [ 1998.891584][T28901] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17388'. [ 1998.923018][T28901] netlink: 8 bytes leftover after parsing attributes in process `syz.1.17388'. [ 1999.170447][T28914] netlink: 'syz.1.17392': attribute type 3 has an invalid length. [ 1999.223418][T28914] netlink: 'syz.1.17392': attribute type 4 has an invalid length. [ 1999.238614][T28915] netlink: 'syz.1.17392': attribute type 4 has an invalid length. [ 1999.252118][T28914] netlink: 'syz.1.17392': attribute type 4 has an invalid length. [ 1999.264190][T28918] C: renamed from team_slave_0 [ 1999.561710][T28918] netlink: 'syz.0.17393': attribute type 2 has an invalid length. [ 1999.608210][T28918] netlink: 128 bytes leftover after parsing attributes in process `syz.0.17393'. [ 1999.640307][T28918] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1999.921290][T28925] netlink: 20 bytes leftover after parsing attributes in process `syz.5.17396'. [ 2000.353352][T28933] netlink: 36 bytes leftover after parsing attributes in process `syz.1.17398'. [ 2000.396342][T28936] netlink: 8 bytes leftover after parsing attributes in process `syz.4.17401'. [ 2000.548983][T28937] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17401'. [ 2000.573799][T28937] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17401'. [ 2000.763500][T28949] netlink: 'syz.1.17406': attribute type 10 has an invalid length. [ 2000.797369][T28949] netlink: 40 bytes leftover after parsing attributes in process `syz.1.17406'. [ 2000.849797][T28949] team0: Failed to send options change via netlink (err -105) [ 2000.881223][T28949] team0: Port device geneve0 added [ 2001.747843][T28986] hsr_slave_0: left promiscuous mode [ 2001.760807][T28986] hsr_slave_1: left promiscuous mode [ 2002.370444][T22488] lec:lec_start_xmit: lec0:No lecd attached [ 2002.557220][T29021] vlan2: entered promiscuous mode [ 2003.005930][T29045] netlink: 'syz.3.17439': attribute type 7 has an invalid length. [ 2003.518262][T29061] vlan1: entered promiscuous mode [ 2003.575540][T29026] lec:lec_atm_close: lec0: Shut down! [ 2003.843676][T29066] syzkaller0: entered promiscuous mode [ 2003.849226][T29066] syzkaller0: entered allmulticast mode [ 2003.958459][T29070] tipc: Enabled bearer , priority 0 [ 2004.567640][T29094] syzkaller0: entered promiscuous mode [ 2004.583383][T29094] syzkaller0: entered allmulticast mode [ 2004.815983][T29103] netlink: 'syz.4.17460': attribute type 1 has an invalid length. [ 2004.868731][T29066] tipc: Resetting bearer [ 2004.966992][T29066] tipc: Disabling bearer [ 2004.972584][T29111] netlink: 'syz.1.17462': attribute type 4 has an invalid length. [ 2005.081671][T29103] bond7: entered promiscuous mode [ 2005.089138][T29103] 8021q: adding VLAN 0 to HW filter on device bond7 [ 2005.179897][T29114] 8021q: adding VLAN 0 to HW filter on device bond7 [ 2005.200218][T29114] bond7: (slave vcan1): The slave device specified does not support setting the MAC address [ 2005.228465][T29127] __nla_validate_parse: 18 callbacks suppressed [ 2005.228488][T29127] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17465'. [ 2005.235280][T29114] bond7: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 2005.245427][T29114] bond7: (slave vcan1): making interface the new active one [ 2005.245455][T29114] vcan1: entered promiscuous mode [ 2005.251360][T29114] bond7: (slave vcan1): Enslaving as an active interface with an up link [ 2006.010127][T29163] netlink: 76 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.810523][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.836867][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.857509][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.903457][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.933304][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.950791][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2008.982451][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5410 ms [ 2008.990539][ C0] lec:lec_tx_timeout: lec0 [ 2008.993220][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2009.024271][T29167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.17472'. [ 2009.258622][T29143] ip6_vti0 speed is unknown, defaulting to 1000 [ 2009.286380][ T1148] netdevsim netdevsim4 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2009.318235][ T1148] netdevsim netdevsim4 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2009.342847][ T1148] netdevsim netdevsim4 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2009.361623][ T1148] netdevsim netdevsim4 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2009.791100][T29143] lo speed is unknown, defaulting to 1000 [ 2010.235747][T29207] __nla_validate_parse: 189 callbacks suppressed [ 2010.235769][T29207] netlink: 36 bytes leftover after parsing attributes in process `syz.1.17485'. [ 2010.418261][T29219] A link change request failed with some changes committed already. Interface macsec0 may have been left with an inconsistent configuration, please check. [ 2010.696027][T29228] syzkaller0: entered promiscuous mode [ 2010.701763][T29228] syzkaller0: entered allmulticast mode [ 2010.759224][T29228] netlink: 'syz.0.17492': attribute type 13 has an invalid length. [ 2010.818315][T29228] tipc: Enabled bearer , priority 0 [ 2010.853493][T29227] tipc: Resetting bearer [ 2010.947340][T29227] tipc: Disabling bearer [ 2011.201350][T29241] netlink: 'syz.0.17494': attribute type 1 has an invalid length. [ 2011.226413][T29241] netlink: 244 bytes leftover after parsing attributes in process `syz.0.17494'. [ 2011.561745][T29253] netlink: 28 bytes leftover after parsing attributes in process `syz.4.17499'. [ 2011.618819][T29251] pim6reg: entered allmulticast mode [ 2011.629706][T29256] netlink: 'syz.0.17500': attribute type 1 has an invalid length. [ 2011.649368][T29256] netlink: 'syz.0.17500': attribute type 1 has an invalid length. [ 2011.662455][T29251] bridge0: entered allmulticast mode [ 2011.707887][T29254] pim6reg: left allmulticast mode [ 2011.715171][T29254] bridge0: left allmulticast mode [ 2011.969445][T29265] netlink: 36 bytes leftover after parsing attributes in process `syz.5.17503'. [ 2011.988424][T29267] netlink: 12 bytes leftover after parsing attributes in process `syz.4.17504'. [ 2012.170907][T29276] netlink: 'syz.0.17505': attribute type 3 has an invalid length. [ 2012.264313][T29278] netlink: 20 bytes leftover after parsing attributes in process `syz.1.17507'. [ 2012.298665][T29280] ip6tnl0: Caught tx_queue_len zero misconfig [ 2012.327539][T29272] syzkaller1: entered allmulticast mode [ 2012.348800][T29284] netlink: 4188 bytes leftover after parsing attributes in process `syz.3.17510'. [ 2012.359424][T29280] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17508'. [ 2012.376949][T29280] netlink: 168 bytes leftover after parsing attributes in process `syz.5.17508'. [ 2012.406362][T29280] netlink: 8 bytes leftover after parsing attributes in process `syz.5.17508'. [ 2012.507768][T29287] netlink: 'syz.4.17512': attribute type 2 has an invalid length. [ 2012.857593][T29305] macvtap5: entered promiscuous mode [ 2012.863825][T29305] macvtap5: entered allmulticast mode [ 2012.869408][T29305] veth1_vlan: entered allmulticast mode [ 2014.290181][T29358] vlan2: entered promiscuous mode [ 2014.410077][T29361] tunl0: Caught tx_queue_len zero misconfig [ 2014.444032][T29370] netlink: 'syz.3.17538': attribute type 2 has an invalid length. [ 2015.134112][T29395] ip6_vti0 speed is unknown, defaulting to 1000 [ 2015.381874][T29406] __nla_validate_parse: 16 callbacks suppressed [ 2015.381894][T29406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17546'. [ 2015.415244][T29406] netlink: 168 bytes leftover after parsing attributes in process `syz.3.17546'. [ 2015.425220][T29406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.17546'. [ 2015.436955][T29409] netlink: 16 bytes leftover after parsing attributes in process `syz.4.17547'. [ 2015.449974][T29410] netlink: 292 bytes leftover after parsing attributes in process `syz.3.17546'. [ 2015.670625][T29414] netlink: 12 bytes leftover after parsing attributes in process `syz.3.17548'. [ 2016.053042][T29429] netlink: 36 bytes leftover after parsing attributes in process `syz.0.17552'. [ 2016.080889][T29395] lo speed is unknown, defaulting to 1000 [ 2037.550052][ T1301] lec:lec_start_xmit: lec0:No lecd attached [ 2042.982556][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5430 ms [ 2042.990632][ C0] lec:lec_tx_timeout: lec0 [ 2047.783169][ T31] INFO: task kworker/1:2H:8543 blocked for more than 143 seconds. [ 2047.791066][ T31] Not tainted syzkaller #0 [ 2047.798332][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2047.807437][ T31] task:kworker/1:2H state:D stack:26536 pid:8543 tgid:8543 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2047.820300][ T31] Workqueue: kblockd blk_mq_requeue_work [ 2047.826398][ T31] Call Trace: [ 2047.829727][ T31] [ 2047.834181][ T31] __schedule+0x1585/0x5340 [ 2047.838781][ T31] ? do_raw_spin_lock+0x12b/0x2f0 [ 2047.844295][ T31] ? __pfx___schedule+0x10/0x10 [ 2047.849221][ T31] ? schedule+0x90/0x360 [ 2047.854453][ T31] schedule+0x164/0x360 [ 2047.858676][ T31] schedule_timeout+0x158/0x2c0 [ 2047.866167][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2047.871601][ T31] ? __pfx_process_timeout+0x10/0x10 [ 2047.877854][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 2047.884161][ T31] ? prepare_to_wait_event+0x436/0x480 [ 2047.889768][ T31] nbd_queue_rq+0x857/0x1100 [ 2047.895806][ T31] ? __pfx_nbd_queue_rq+0x10/0x10 [ 2047.900908][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2047.908708][ T31] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 2047.915262][ T31] ? sbitmap_get+0x229/0x390 [ 2047.919923][ T31] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 2047.926439][ T31] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 2047.933062][ T31] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 2047.939494][ T31] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 2047.950247][ T31] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 2047.957141][ T31] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 2047.962820][ T31] blk_mq_run_hw_queue+0x348/0x4f0 [ 2047.968005][ T31] blk_mq_run_hw_queues+0x26c/0x3f0 [ 2047.974263][ T31] blk_mq_requeue_work+0x71c/0x780 [ 2047.979447][ T31] ? __pfx_blk_mq_requeue_work+0x10/0x10 [ 2047.985922][ T31] ? process_scheduled_works+0xa25/0x1830 [ 2047.991708][ T31] ? process_scheduled_works+0xa25/0x1830 [ 2047.998859][ T31] process_scheduled_works+0xb02/0x1830 [ 2048.004912][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 2048.010966][ T31] ? assign_work+0x3d5/0x5e0 [ 2048.017652][ T31] worker_thread+0xa50/0xfc0 [ 2048.026122][ T31] kthread+0x388/0x470 [ 2048.030251][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2048.036300][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.040952][ T31] ret_from_fork+0x51e/0xb90 [ 2048.046068][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2048.051247][ T31] ? __switch_to+0xc7d/0x1450 [ 2048.057997][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.063112][ T31] ret_from_fork_asm+0x1a/0x30 [ 2048.067957][ T31] [ 2048.071186][ T31] [ 2048.071186][ T31] Showing all locks held in the system: [ 2048.081196][ T31] 1 lock held by ksoftirqd/0/15: [ 2048.086507][ T31] #0: ffff8880b863ade0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 [ 2048.097778][ T31] 1 lock held by khungtaskd/31: [ 2048.105056][ T31] #0: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2048.115730][ T31] 2 locks held by udevd/5193: [ 2048.120451][ T31] 2 locks held by getty/5585: [ 2048.126838][ T31] #0: ffff8880329c10a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2048.137585][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 2048.148173][ T31] 1 lock held by udevd/31918: [ 2048.153667][ T31] #0: ffff8880263ff358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 2048.164896][ T31] 4 locks held by kworker/1:2H/8543: [ 2048.170234][ T31] #0: ffff88801feb8148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 2048.183011][ T31] #1: ffffc9000c7efc40 ((work_completion)(&(&q->requeue_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 2048.197050][ T31] #2: ffff888025b9a098 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 2048.207061][ T31] #3: ffff8880268e0380 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc6/0x1100 [ 2048.218146][ T31] [ 2048.220537][ T31] ============================================= [ 2048.220537][ T31] [ 2048.229639][ T31] NMI backtrace for cpu 1 [ 2048.229658][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2048.229681][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2048.229694][ T31] Call Trace: [ 2048.229702][ T31] [ 2048.229710][ T31] dump_stack_lvl+0xe8/0x150 [ 2048.229745][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 2048.229771][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2048.229800][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 2048.229828][ T31] sys_info+0x135/0x170 [ 2048.229849][ T31] watchdog+0xfd9/0x1030 [ 2048.229886][ T31] ? watchdog+0x21a/0x1030 [ 2048.229924][ T31] kthread+0x388/0x470 [ 2048.229946][ T31] ? __pfx_watchdog+0x10/0x10 [ 2048.229974][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.230018][ T31] ret_from_fork+0x51e/0xb90 [ 2048.230048][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2048.230074][ T31] ? __switch_to+0xc7d/0x1450 [ 2048.230101][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.230123][ T31] ret_from_fork_asm+0x1a/0x30 [ 2048.230192][ T31] [ 2048.230200][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2048.343864][ C0] NMI backtrace for cpu 0 [ 2048.343882][ C0] CPU: 0 UID: 0 PID: 11966 Comm: kworker/u8:17 Not tainted syzkaller #0 PREEMPT(full) [ 2048.343903][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2048.343915][ C0] Workqueue: krds_cp_wq#18/0 rds_connect_worker [ 2048.343948][ C0] RIP: 0010:lock_acquire+0x20b/0x2e0 [ 2048.343973][ C0] Code: e9 30 ff ff ff e8 65 95 0b 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 e1 22 7a 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 c6 7b 0e 0a cc 48 8d 3d 9e 48 73 [ 2048.343989][ C0] RSP: 0018:ffffc9000c827358 EFLAGS: 00000282 [ 2048.344004][ C0] RAX: 313625574d72af00 RBX: 0000000000000246 RCX: 0000000000000046 [ 2048.344016][ C0] RDX: 00000000662cbe9e RSI: ffffffff8e161e0a RDI: ffffffff8c27a480 [ 2048.344030][ C0] RBP: 0000000000000000 R08: ffffffff81767a45 R09: ffffffff8e7602e0 [ 2048.344043][ C0] R10: ffffc9000c8274b8 R11: ffffffff81b0b130 R12: 0000000000000002 [ 2048.344056][ C0] R13: ffffffff8e7602e0 R14: 0000000000000000 R15: 0000000000000000 [ 2048.344068][ C0] FS: 0000000000000000(0000) GS:ffff888125466000(0000) knlGS:0000000000000000 [ 2048.344083][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2048.344095][ C0] CR2: 000055d143dec168 CR3: 000000007edd6000 CR4: 00000000003526f0 [ 2048.344112][ C0] Call Trace: [ 2048.344119][ C0] [ 2048.344126][ C0] ? process_scheduled_works+0xb02/0x1830 [ 2048.344151][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 2048.344175][ C0] unwind_next_frame+0xc2/0x23c0 [ 2048.344200][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 2048.344229][ C0] ? unwind_next_frame+0xa5/0x23c0 [ 2048.344254][ C0] ? rds_connect_worker+0x1d8/0x290 [ 2048.344277][ C0] ? process_scheduled_works+0xb02/0x1830 [ 2048.344308][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 2048.344327][ C0] arch_stack_walk+0x11b/0x150 [ 2048.344357][ C0] ? process_scheduled_works+0xb02/0x1830 [ 2048.344382][ C0] stack_trace_save+0xa9/0x100 [ 2048.344399][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 2048.344424][ C0] kasan_save_track+0x3e/0x80 [ 2048.344440][ C0] ? kasan_save_track+0x3e/0x80 [ 2048.344456][ C0] ? kasan_save_free_info+0x46/0x50 [ 2048.344479][ C0] ? __kasan_slab_free+0x5c/0x80 [ 2048.344496][ C0] ? kfree+0x1c1/0x630 [ 2048.344519][ C0] ? security_sk_free+0xa4/0x180 [ 2048.344543][ C0] ? __sk_destruct+0x5dd/0x880 [ 2048.344567][ C0] ? inet_release+0x143/0x190 [ 2048.344607][ C0] ? sock_release+0x85/0x150 [ 2048.344623][ C0] ? rds_tcp_conn_path_connect+0x78c/0x930 [ 2048.344641][ C0] ? rds_connect_worker+0x1d8/0x290 [ 2048.344664][ C0] ? process_scheduled_works+0xb02/0x1830 [ 2048.344711][ C0] ? sock_release+0x85/0x150 [ 2048.344729][ C0] kasan_save_free_info+0x46/0x50 [ 2048.344753][ C0] __kasan_slab_free+0x5c/0x80 [ 2048.344772][ C0] kfree+0x1c1/0x630 [ 2048.344796][ C0] ? security_sk_free+0xa4/0x180 [ 2048.344824][ C0] security_sk_free+0xa4/0x180 [ 2048.344849][ C0] __sk_destruct+0x5dd/0x880 [ 2048.344875][ C0] inet_release+0x143/0x190 [ 2048.344900][ C0] sock_release+0x85/0x150 [ 2048.344918][ C0] rds_tcp_conn_path_connect+0x78c/0x930 [ 2048.344944][ C0] ? __pfx_rds_tcp_conn_path_connect+0x10/0x10 [ 2048.344962][ C0] ? do_raw_spin_unlock+0xf5/0x210 [ 2048.344991][ C0] rds_connect_worker+0x1d8/0x290 [ 2048.345014][ C0] ? process_scheduled_works+0xa25/0x1830 [ 2048.345039][ C0] process_scheduled_works+0xb02/0x1830 [ 2048.345078][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 2048.345106][ C0] ? assign_work+0x3d5/0x5e0 [ 2048.345131][ C0] worker_thread+0xa50/0xfc0 [ 2048.345175][ C0] kthread+0x388/0x470 [ 2048.345192][ C0] ? __pfx_worker_thread+0x10/0x10 [ 2048.345214][ C0] ? __pfx_kthread+0x10/0x10 [ 2048.345231][ C0] ret_from_fork+0x51e/0xb90 [ 2048.345256][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 2048.345277][ C0] ? __switch_to+0xc7d/0x1450 [ 2048.345306][ C0] ? __pfx_kthread+0x10/0x10 [ 2048.345324][ C0] ret_from_fork_asm+0x1a/0x30 [ 2048.345360][ C0] [ 2048.746667][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2048.753598][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2048.762749][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 2048.774067][ T31] Call Trace: [ 2048.777381][ T31] [ 2048.780342][ T31] vpanic+0x56c/0xa60 [ 2048.784382][ T31] ? __pfx___schedule+0x10/0x10 [ 2048.789282][ T31] ? __pfx_vpanic+0x10/0x10 [ 2048.793837][ T31] ? __pfx_console_unlock+0x10/0x10 [ 2048.799099][ T31] panic+0xc5/0xd0 [ 2048.802875][ T31] ? __pfx_panic+0x10/0x10 [ 2048.807354][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 2048.812877][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 2048.819082][ T31] watchdog+0x1023/0x1030 [ 2048.823479][ T31] ? watchdog+0x21a/0x1030 [ 2048.827954][ T31] kthread+0x388/0x470 [ 2048.832073][ T31] ? __pfx_watchdog+0x10/0x10 [ 2048.836797][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.841427][ T31] ret_from_fork+0x51e/0xb90 [ 2048.846081][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2048.851238][ T31] ? __switch_to+0xc7d/0x1450 [ 2048.855960][ T31] ? __pfx_kthread+0x10/0x10 [ 2048.860577][ T31] ret_from_fork_asm+0x1a/0x30 [ 2048.865401][ T31] [ 2048.869090][ T31] Kernel Offset: disabled [ 2048.873443][ T31] Rebooting in 86400 seconds..