last executing test programs: 4.700392286s ago: executing program 3 (id=6695): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) openat$cgroup_procs(r1, &(0x7f00000001c0)='cgroup.procs\x00', 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="120000000b0000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000340), &(0x7f0000000140)}, 0x20) getsockopt$netrom_NETROM_T2(0xffffffffffffffff, 0x103, 0x2, &(0x7f0000000080)=0x2, &(0x7f00000000c0)=0x4) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x1, @bcast, @bpq0, 0x9, 'syz0\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, 0x2, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @null]}) 4.683477256s ago: executing program 3 (id=6697): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={0x0, 0xc4}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a0000"], 0xfc}}, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r4, &(0x7f0000001680)=[{{&(0x7f0000000080)={0xa, 0x4e21, 0x1000, @mcast2}, 0x1c, 0x0}}], 0x1, 0x84) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, 0x0, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) r5 = socket(0x14, 0x2, 0x4) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x10}) r6 = socket$unix(0x1, 0x5, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='@@\x00\x00', @ANYRES16=r7, @ANYBLOB, @ANYRES32=r8, @ANYBLOB="24005a8020000180140003000000000020000800010000000000000004000200"], 0x40}}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="046c69e24e0d7f000000000000000005", @ANYRES16=0x0, @ANYBLOB="00012dbd7000fddbdf256d00000008000300", @ANYRES32=r8, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x1000}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r5, 0x0, 0x8000) r9 = socket$rds(0x15, 0x5, 0x0) bind$rds(r9, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r9, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) 3.871394456s ago: executing program 3 (id=6711): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@empty, 0x40, 0x2, 0xfd, 0xa, 0x9, 0x2768}, 0x20) socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x10, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x6}, {0x0, 0x0, 0x1abe1019, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x6e6bb8, 0x0, 0x1, 0x0, 0x1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x1}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) (async) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@updpolicy={0xc0, 0x19, 0x1, 0x0, 0x10, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x6}, {0x0, 0x0, 0x1abe1019, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x6e6bb8, 0x0, 0x1, 0x0, 0x1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x1}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000000000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e000000030100000000040000000000000008001f0001"], 0xd4}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000019c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELSET={0x60, 0xb, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x2}, [@NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x12}, @NFTA_SET_EXPR={0x24, 0x11, 0x0, 0x1, @range={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_RANGE_SREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}, @NFTA_SET_ID={0x8}, @NFTA_SET_DESC={0x18, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x4}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x28b}]}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x5, 0x0, 0x0, {0x3, 0x0, 0x2}}, @NFT_MSG_DELOBJ={0x58, 0x14, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x8}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x5}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xf4}, 0x1, 0x0, 0x0, 0x40}, 0x40) ioctl(r0, 0x8b2e, &(0x7f0000000080)="28c613176c05e9fcbb8e1b4af032ebfc0797268168fb935df401ddd79803425cf88d28b8d5ab73e429f4efd278d11f57f737e1b066a3f3cbe00ebbc9ade67a0e10e19dfafbb03e022b75609a3927a59f5fbae1c93c023667f72e68ccb1eca47f24717154a8905ba34ecec5647c0000000000") (async) ioctl(r0, 0x8b2e, &(0x7f0000000080)="28c613176c05e9fcbb8e1b4af032ebfc0797268168fb935df401ddd79803425cf88d28b8d5ab73e429f4efd278d11f57f737e1b066a3f3cbe00ebbc9ade67a0e10e19dfafbb03e022b75609a3927a59f5fbae1c93c023667f72e68ccb1eca47f24717154a8905ba34ecec5647c0000000000") 3.391550358s ago: executing program 3 (id=6722): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000200)=@ethtool_channels={0x50}}) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x78, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_REPLY={0x14, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8}, @CTA_SEQADJ_OFFSET_BEFORE={0x8}]}]}, 0x78}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r2 = socket$netlink(0x10, 0x3, 0x4) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) write(r2, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000000", 0x29) 2.854360455s ago: executing program 2 (id=6730): r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e00)={&(0x7f0000000c40)=ANY=[@ANYBLOB="9feb0100180000000000000018000000180000000300000002000002010000030000000002010000000000dfffffff00000000"], 0x0, 0x33, 0x0, 0x1}, 0x28) setsockopt$inet6_int(r0, 0x29, 0x49, &(0x7f0000000140)=0x5, 0x4) syz_emit_ethernet(0xe3, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}, @local, @val={@val={0x88a8, 0x1, 0x1, 0x3}, {0x8100, 0x7, 0x1}}, {@generic={0x22f0, "373b344dae8de655bf1fd71f67e0fbfdd938efbaf498cb766254560392fbb6ea90ac13715e3c30fb36330a1c4d6f4d8e9060ab246332a3f5f90eae2005023a7be7f7cf3c7d86bd5f6ba22f016227c05f8f7c3b9c35339843bd493e3084040981c44124f36dedd688dbb6c2a6227b1329dd78b262dd9ebeff256a91ab6d26eb8c432251d7ddfd8d917c3a1eb854b295d8eff8b4c659f478fda7f8a669ef0ad0ad4d66362338aa4b016456c3cb2d7a8dc20a11c0c4173ebfdfdcec0100d8aafee1c6685c1f8d8d341fe77e9d8711"}}}, &(0x7f0000000100)={0x1, 0x2, [0x9fa, 0x8f7, 0x6ff, 0xb3c]}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x230, 0x0, 0xffffffff, 0xffffffff, 0x100, 0xffffffff, 0x198, 0xffffff7a, 0xffffffff, 0x198, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@physdev={{0x68}, {'veth1_vlan\x00', {0xff}, 'wlan1\x00', {}, 0x0, 0x6}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x38, 0x1d}}}, {{@ip={@private=0xa010101, @loopback, 0x0, 0xff000000, 'team_slave_0\x00', 'ip6gre0\x00', {0xff}, {}, 0x6, 0x3}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x0, 0x4}, {0x4, 0x5, 0x6}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x290) syz_emit_ethernet(0xae, &(0x7f0000000240)={@random="05b1ff035660", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x78, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1803"}, {0x0, 0x1, "000001000000000000000000"}, {0x0, 0x1, "fe906d26efe3"}]}}}}}}, 0x0) 2.566067788s ago: executing program 2 (id=6733): socket$xdp(0x2c, 0x3, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="2001000012001307"], 0x120}}, 0x0) recvmsg(r1, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r1, 0x4048587b, &(0x7f0000000900)={{r1, &(0x7f0000000140)='cake\x00', 0x2482, &(0x7f0000000180)={@_ha_fsid={[0xc, 0xfffffff8]}, {0x7ff, 0x100, 0x80000001, 0xffff}}, 0x7, &(0x7f00000002c0), &(0x7f0000000300)=0x7292571e}, 0x5, &(0x7f0000000840)=[{0x2, 0x0, &(0x7f0000000340)='GPL\x00', &(0x7f0000000380)="cef185ea04e9d7d4b886867bd9c7684b47d8ef0bbd50c79392eeac0df8a8d4f91889a69a400a28c14b29f57950612f0ac8afce2848d2615cf165561b9f8e3826c444fde1c4c8", 0x46, 0x10}, {0x3, 0xffff, &(0x7f0000000440)='-+\x00', &(0x7f0000000480)="279f55ea8c1ba253af1e2c4609dd6fa660616647cc3c3b6b7f8cc3eb040f07260a7dcea68738077d17c09f550d7dfd1d4d3ca6e6eea72adede6e7077e31ddeba93172565ef23a57503af2fc1ed74b8998e81b0f38aa8f682d09eff494cbde7905789289f3ff97020473db30bd5d30e0fa4f93b78601cc3bf347595c0323c0d1590cf09110f024dcf94e575e69f1475ed3d395bf5407e558fa58feab3aebe2464b233243509ebbb92fa4b89420eb5964d6ed0ef358d913ccc824b787eb8883ad8ce", 0xc1, 0x38}, {0x3, 0x4, &(0x7f0000000600)='\x00', &(0x7f0000000640)="2f5f46abeb1cedb362e23b91014ffdd6480b1e9c763f0c37a676", 0x1a, 0x18}, {0x3, 0x40e, &(0x7f0000000680)='/dev/net/tun\x00', &(0x7f00000006c0)="32b40b3ae08615d7a68a4571a1aeafaac65725aca4be44b33583e03b78e2114d4d6f53c0121e76dd15c741eeacb310825140a4629289ee5ed471481552da5009e4efe963dfeee9673e27b1cd0a937aff41628531885f81c0240197feec1d17cd", 0x60}, {0x0, 0x7fff, &(0x7f0000000740)='$\x00', &(0x7f0000000780)="cc517326ed6946b60f9d82c04dec39b3d9d795f9569a6887085478f38de9cbe08a7deb587965beaa46bb0236dc5b1d6627a205da267833dcb99bab15c41a2a479997efe5df7a814ca6d8c72f0d7bd4c9db3119471f7de9029f7c244f4499e48d8769b5f47dd288959f4daa2430598df4fcacf21b00f49abd93388ed910216144f60e7a2fec2fe1e42fd7b8376583", 0x8e, 0x12}]}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000009c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000a80)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x40, r3, 0x200, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff9, 0x52}}}}, [@NL80211_ATTR_HIDDEN_SSID={0x15, 0x7e, @random="0a8cbaee46dd141470e9a5a1c4ec78549b"}, @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x4814) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xe, 0x4}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0x3}, @TCA_CAKE_ATM={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$bt_BT_FLUSHABLE(r0, 0x112, 0x8, &(0x7f0000000d40)=0x7f, 0x4) sendmsg$nl_xfrm(r2, &(0x7f0000000d00)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000b00)=ANY=[@ANYBLOB="840100001f0000002cbd7000fedbdf25fe880000000000000000000000000101000004d40000330064010100000000000000000000000000090000000435000008001e008100000008000b0006000000290102006374722d73657270656e742d61767832000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080700001196d1874b47b237a8609cb711910695f6c78834e080d8d65bdc3d16714f8160e005b4e267c6c7e4ccdaf16224665e92130157595b32a6ead7d3231238d387d1796d2b50da3d27d356dac38af5064669e36ae294f828f6a2a18b114aaa7bd64770c46343b017ff60e48bc3be3741ca4e68aabc1dd0400cdf053cfa3e7a8f47159fec00abe3125b42574f868e3c4781a276349edb48ec9a1aaeb40da3116b26b7440088093ca3bbcb0f5da473be7097b297f9402a57740427058220c44eb29370ac1800425dfc22b1ec49f5e8156f7ca680c742629948717f51c0824c22f31bdb4917600b1edf01a333c9fa8f"], 0x184}, 0x1, 0x0, 0x0, 0x2004044}, 0x4000004) r9 = socket$packet(0x11, 0x2, 0x300) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x6}], {0x95, 0x0, 0xc00}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) bind$packet(r9, &(0x7f00000000c0)={0x11, 0x18, r11, 0x1, 0x81}, 0x14) setsockopt$packet_int(r9, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r9, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) sendto$packet(r8, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x88a8, r7, 0x1, 0xd7, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112c9000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) 2.55960371s ago: executing program 3 (id=6734): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000000)=0x9, 0x4) recvmsg$unix(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x40010020) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "a20c89", 0x8, 0x2c, 0x0, @private0, @local, {[@hopopts={0xff}]}}}}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='htcp', 0x4) syz_emit_ethernet(0xae, &(0x7f0000000240)={@random="05b1ff035660", @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x78, 0x3a, 0xff, @private2={0xfc, 0x2, '\x00', 0x7}, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, [{0x0, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af1803"}, {0x0, 0x1, "000001000000000000000000"}, {0x0, 0x2000000000000073, "fe906d26efe3"}]}}}}}}, 0x0) 1.960157446s ago: executing program 2 (id=6742): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000180)={0x0, 0x1a000000}, &(0x7f00000001c0)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000002c0)={0x7, 0x8008, 0x10001, 0x8000, r1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) recvmmsg(r0, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x20010020, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYRES8=r0], 0x44}, 0x1, 0x0, 0x0, 0x4044054}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800010000000000000000000a80000000030000000000001400070000000000000000000000004d3737052177f9bc8867ce393b0000000001080004000120000020cea02851c66d1f28764a7cadc80664d05e99fd1c6e9c0259438db0bad40c1a5574d307904981453fb3eeb5e2204f4aedd829659d1efb7705710209944e7226f0b087656400"/153], 0x38}}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000100)) 1.929529892s ago: executing program 2 (id=6744): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r1 = socket$unix(0x1, 0x1, 0x0) (async) socket$kcm(0x11, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) (async) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0x5, 0x9}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) (async) sendmsg$nl_route(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000980)=ANY=[@ANYBLOB="180000001600010000000000000000000a00c3"], 0x18}}, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x84, 0x2c, 0xd2b, 0x800, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x9}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0xd, 0x1, 0x3, 0x1, 0x4, 0x401, 0xe, 0xfffffffa, [{0x200, 0x500, 0x3, 0xe}, {0x6783, 0x2, 0x8001, 0x10}, {0x40000, 0x53, 0xa9, 0x80000001}]}}, @TCA_U32_MARK={0x10, 0xa, {0x800, 0x8001}}]}}]}, 0x84}}, 0x20000001) (async) close(r5) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r10, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="8115d04d505daf3f8563a7ca0d5c8e0400000064974a9ff166240e3ff01264192627330600"/47, 0x2f}], 0x1}, 0x4) 1.839392759s ago: executing program 1 (id=6745): bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="bc010000190001000000000000000000fc0200000000000000000000000000000000000000000000000000000000000000000003000000000a0000005e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000800000000000000000000000000000700000000000000000000000000000000000000000000000300000000000000070000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000004010500ac1414bb000000000000000000000000000000006c00000000000000ac141408000000000000000000000000000000000000ff00000000000000000001000000fc020000000000000000000000000000000000003200000000000000fe8000000000000000000000000000bb023500000000000000000000000000000000000000000000000000000000000000000001000000003c00000002000000ac1414bb00000000000000000000000000000000010300000000000000000000000000002001000000000000000000000000000100000000ff00000002bbae00fe8800000000000000000000000000010000000004"], 0x1bc}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x75ba71a5d585e88c, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x34, 0xb, 0x6, 0x5, 0x0, 0x0, {0x3, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PROTO={0x5, 0x7, 0x88}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x20004000) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000001440)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x0, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x1, 0x2b, 0x1c, 0x68, 0x0, 0x60, 0x33, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, "11f3305280f125e6"}}, 0x2a) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xfffffffe}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xa}]}, &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x40e00, 0x40, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000600)="87fc5d85da21530562070095c108", 0x0, 0x8011, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x40}, 0x50) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x7ffffffe, @bcast, @bpq0, 0x9, 'syz0\x00', @bcast, 0x1, 0x0, [@null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @null]}) 1.650055899s ago: executing program 0 (id=6748): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000026c0)=ANY=[@ANYBLOB="4000000012000501000000000000000005001900ff00000028001a000a0101020000000000000000000000000a01010000000100000000000000a6ff02"], 0x40}}, 0x20040810) 1.57182165s ago: executing program 4 (id=6749): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x39b3) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r2, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r0, 0x2}, 0x20) close(r2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) mmap(&(0x7f0000702000/0x1000)=nil, 0x1000, 0x200000b, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) recvmmsg(r0, &(0x7f0000005b80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/163, 0xa3}], 0x1}, 0x6}], 0x1, 0x21, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="05000000010097", 0x7) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000071120a000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000001040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x70, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_ctinfo={0x58, 0x1, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_ZONE={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) 1.571407894s ago: executing program 3 (id=6750): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0b00000008000000070000000300000001"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000300, 0xe, 0x0, &(0x7f0000000000)="63eced8e46dc3f0adf3389f7b986", 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21000000}, 0x50) 1.565759652s ago: executing program 1 (id=6751): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000060a01080000000000000000050000090c000340000000000000000438000000160a0100000000fffffff500010000070900010073797a30e3ffffff0900020073797a30000000000c0003"], 0x80}}, 0x0) 1.565541471s ago: executing program 2 (id=6752): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0xf0ff) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) 1.4690106s ago: executing program 1 (id=6753): r0 = socket$kcm(0xa, 0x2, 0x88) sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f0000000500)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1458922beeb71d00f09400800700009aae95dc0000000007a211fb410c7d9cc2d3f99072bc639d38560451bb33c33b5eb50527fa5e15514b09e510806c846e0c2f50fab7b323fb4e7aa1f5506722ed97da6f08189005ea1a84bb06f53f79eea06a6342b419"], 0x18}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000440)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000150700000fff00003506000002000000170600000ee5e50cbf250000000000001f650000000000007507000002000000170700004c0001000f75000000000000bf54000000000000070400000400f9ff2d3501000000000095000000000000000500000000000000950007000000000001722fabb733a0c857c7c45402000000a2d23da04d1ffc187fa1a2ba7ba030c7267c2de00435fd233cc0f0d9b2c3127c46b0f408398d09ee4dc258d726eae098804ce25df627a64ac7efde50fd7f1dd5b17ed764c33b06598bae66ea38541a7cd29032de94983dfab0e5043daf1b46bef5135c65377bdbe65d525743d88ef4b2ee62652b07f8a4b6e6155cecc13a5ddfab726eca91bd5fecb254ab358488c400330171128be291297947d47dc570a385a459ef8e6ada84e987cc0000f6991078a21788cab9d53ad890206ab56506ab08b294c09ea4536e0b9bb0627a03a1eb9cbe6958812a98abad49f42a6fb2b69c0880548c39f13f4cca63a87ad7ff8d1006cc6d95e406deb61b9c7ac3f35f1fdb27e70900001fd13d4a22fc90e5f7300c53f2b6e7e001058dc04b434e379fd5526b52990b04b183c21e6b974a4bf85567348c6c6a4404d987f71d81fe988ddc82dac01bbb43e006203a31b02f9519ffb29cd3508d7da829712c98381a672db9fa6a8eb38d784c913a804557c4577a22acb7b73c4aa0e07998734fdfbb0d262ef88b3b8cd1a8518dd8326f6367ed938a05c108cf2639e8799fd7cb018f08453fa863f8fb8178569d26a0a48e4498f88d15abbb22d955a162ac1fd3710c1255fbe3c6d1e84152c81ec0192e54d13dc5beebe3de27967e5d1aa8a6139056e3fb738d0ca46b0a1c63a29002e5b12314390ca075ecb43e0c6cd5af64c8b676316b9bff845ea0b20562f53c5b34314411bf3d4af06bdc3def9f2791d6d076ca72e319e6a9e1098bab878a9f1274a61ddee47abb54d8cf901e78bdb85f47ef37dd0daeb6403820ee8414042904917ea1b80a0000000000004c84018fd19fb3581ca1ff9fb5758d76929ec0502802869c51511c2c9dc56ead1449c038e4d2382d6ef61a7d9399cb"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x1f1, 0x10, &(0x7f0000000000), 0xffffffffffffffa6, 0x0, 0xffffffffffffffff, 0x60}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x18, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x8}, [@alu={0x7, 0x1, 0xb, 0x0, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x8}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f00000024c0)=[{&(0x7f0000000240)="0d850ecd33a42b86f08a86e396e0af7133653b85edbd976c2a338c922a667eae1c94c629c93d8fda25f9670238c3ed769485a3df4c091e882367ad5d9caedcd48a", 0x41}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000003, 0x10, r1, 0x1d7b3000) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r4, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r4, 0x4) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000140)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x1, 0x0, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, '9\x00'}}, 0x48}}, 0x410) sendmsg$can_bcm(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)={0x1, 0x282, 0xfffffffd, {0x77359400}, {}, {}, 0x1, @can={{}, 0x0, 0x3, 0x0, 0x0, "ee6a491530f05065"}}, 0x48}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r7) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[@ANYRES8=r7, @ANYRES16=r8, @ANYBLOB="01000000000000000000010000001c0001800600010002000000050002000200000008000300ac1e0101"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockname$netrom(r1, &(0x7f0000000880)={{0x3, @bcast}, [@bcast, @remote, @bcast, @bcast, @rose, @netrom, @remote, @null]}, &(0x7f0000000840)=0x48) sendmmsg$inet6(r3, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f00000009c0)=[{&(0x7f0000000a40)="7b033f0ba6e50b02410b11fe8900000000000081eb4badd053e91f5b93b3681965f3848229d6199bd7f1708bcdef67f4cba150f547061f96d4b8b183f94904e012c1a1a91fb98e59bfec3758823508133bf576df9bf854095c60bddc2ff5cf02b67b15acae22466366b82e010c989f04c24f3066609dfa45db2e768bac843af7a378a73a6c39410118cb8bb734b664ac99eeefa97558300b1594decc92afd4b791e23026ed9e9ade0355e601fe14dca7a85ff08c8de826a25443bba27d36231bb54de7f318794d158f79bf7c8c5e770466a3f356a967667d58d0df772bbb", 0xde}, {&(0x7f00000001c0)="56ededbdd884f451eaad", 0xa}], 0x2}}], 0x1, 0x4000010) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000180)={0x0, 0x4, 0x3ff}, 0x8) setsockopt$llc_int(r2, 0x10c, 0x3, &(0x7f0000000040), 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00'}) 1.468565639s ago: executing program 0 (id=6754): r0 = socket$inet(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x8, 0x7fe2, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r1, &(0x7f0000000040), 0x0}, 0x20) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000040)={@multicast2, @loopback, 0x1, 0x1, [@empty]}, 0x14) 1.405224226s ago: executing program 4 (id=6755): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x6) (rerun: 64) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) (async, rerun: 64) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) (rerun: 64) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000900)=@newqdisc={0x24, 0x24, 0xf1d, 0x70bd29, 0x0, {0x0, 0x0, 0x0, r7, {}, {0x9, 0xffff}, {0x0, 0xffff}}}, 0x24}}, 0x4000800) ioctl$BTRFS_IOC_RM_DEV(r1, 0x5000940b, &(0x7f0000000a00)={{r1}, "43034353bc9f685fc5d678c047a4a5292e3237ca30cb0f3a9420c9fba0ec4682958baa9e0e94da65970a1c631b5f0139cf3987ad6efa4f483175bc44153da819970a879c6f3ada010c83640ed4e74958a739e85472f4c4c77469644ceadcdc5c688787fd96c27af4ce68d4a65843bd76785c6e519ee90f9a6920bf477c4891a82b124921220cbe3b082be08d48c6ed9eb46a9dc47e23779e961a3f99ea4191028fc46a22e8aad0c413261138ed0b5e2056e522c88a23ad104748d91912d3a9d239ce3ef5ce9c223039b540070954e9505d511ad49ed448daf48cab80390481984f69d19168efdba082cd2a7655d6b0139b0df978c71cd3782f409d56bf0fe9a685e0f79624ac8eb9850ec36fdf31c73234e61c34de1be1c48b7bc738125753deb1f50a00415fb76765ea1155af266b7f6f3ecc7c7754a7209684c4384e6a0884561230064b245748e9fa9f40e206d6c0008730bc1c1bc1a5649e2c4252cab52fe3b883b9a0f3f8deb174325b2a1734809c927458120698ade675a545a0082dc1a3daa41ae2923d0531d18f8231909d20edb1475df9c0684bcbd764711d9df0fcc98375d8afb5b613b79af337615b069f10f2d445fc76905d8fa1a120b65a0d62c4bef582e7292ee61629555dfaece502e533d2789773100c9ddcc1080e9574db85ffc46167537683ecc535c0684b4f64ae228bc16b6236a85e74f61886ea3aba3c6e4faf1dbd2722af34655cbe76df53958323fa8a59e1543cf60721caa411cb9c824798756d3631c61d45bf5018d09f7a2884e3672fefa55c0d7222ef614598f80518d4067061a18ef791d1dc153131417515b13afd314a49370ab130756c19c344daec5c857a867cdd5e73e7f7f4e4611a83b484af2d8cfe7a70d248719ac90c463182edec6c2fb702d9c0a4a141fdfb2a88121532da6f7bee16a4bfd9aa342a744eb798d4c274ce2fe5395966f69736b1d8e8cc737d2b7d1be6dd133eb76e2697ef6a07766a5ec66348fa6373d085be3310936bf6c39807d670d2a68c9510142f55f48455ae19377d690acefb34294622c44384def20d9d2b5f2001f94ddf291945746b3c264acf6face324e50b919f5f36dad3cacd6e6a894d773068481821d478f196ac8a1b097cfe1176b4f46e1db657e56cbd482abe729e7fc4d2b11f094cbaedd342cf72738683c8f8a075e1a6f27edff0d9e891e22b4d51e0c6bcb612390b395ec9b6b6590ca6eae2f7a8a0ffe079b8083d4a0601441571cb3ad6a5da6c1ac4143c17937710d01ff9b3f00908d8c2a9d6950d02b47b3b282aad26980f2b30d4366d7ac3691a2ef8aa959aaabc5b306ad2597a2613fb7237040e95d950ba6b78dbc4522fa0af7711f448be54019bf002719f2450d36ba9e80291357360634df225a9fcf5699658a26243ac82c15b8d4fb5eca179f09cee87a8bef8fdacbcfa74f93bf2a9a79063c17c08995ed2fe5e41eafb99b6eb7090623e3147d04f94e21d0302b1e398c0e74863156a2e4cf34c0f65a7b927f8cb840ca7ea907a6ee218bf39e24134f0f33206ca13366041940d265009eb2ee66a9f0ab3335ab14ff5a19b9d18fc98c547880cc7bf19513a353395933f1df3ad602e718ff3c344234678ee263e6f1023470466899bda51ce5e4f82f403e273a0ea32bf813f4ce90f21acc91a38379cfa454c183d5cdf670d25dd6ad168b7c4fb74cc5e6e17af5eef96478df04de0f703716e592ff8f2f7f4d36eef28095151aa1082bf828e12ca9a331ddeefddcfdb52ad2b4e89448f309ee8756224ff1878e37f3a177c0d78d7f71013252377616fa9d6d547ed9e562eae85a4c7e8776770c58e6d77ff3376c0f5c16966b8545a5f1a336bf4d60eb606035f284e14c69ab8b909938dd4f8257f5da1e8d16513c0f1a561d55208db14d69d33259d9e2befde605014340018f26079860879627754ba9e924dc3efbec4fa1186d075666a87662113bfb8750fd83a26b227ca421d5a266fac72a4258462e0fb7b2ce5ac6e692d82c2c6c8383bbae39d884c23c4c47555f924b22b60f621f2db8d009da303c919c847962ddefa13f1a0195e3b33881f11d0a15faf5617b8af3e684f50cb3a53e13b18e23a93059ecc630f98832c3f9cc8617a307b7373971aa35ddcf474fce083578ed556fbb0dc9e5ccebcaccf9fc382931278e5ad16b73432287be57f9e9d746a1b0ed9558378a7e819fd808b3aa608203c9f62bfbe88785be6c4da06dca42dcac31c6d850b82166951524df711bc044e12abf6d1817be7dbeaf19dbe068db18d93e87e1101d8c09298a71fd891d5976fc311903c9977c45fd8c8f375fc2d3f2b2ef58bf4378f148ff3a4d378174e1f26085b22cee03e252e73c28c71fc4552f1f3b9198fb6fed1c2133a65c7eda35a21b5c891db6e9cfc78abae9d2caff25bbf982f665ebaa870e87d289eb59f9b8f6151545dedf74c4d27d4aff17b507bcd71fe12efa3195bdbf5b757758f3a4b77283f7e6cd56d566c2bb3918d860eb23db3933ab1bbbf5ca63b5026f72dab99dac9a4a613b2da18eac33a398d158763bef75f70e7fc5c75a7cb7ab56b325f95a1e6d9743dd2487b6c7b5709258add8b5019a2fc22f0d18822ac79c5b3b8d5b8f7dbf611a6b1143c21ffdfb4764d10899f84892a28034a5872f7ee1015141f76368762dbd61d68308746375f8f9640019a25dd3a11c4b3596d86c83e8047cf5c47739623cb9aab3e9273b741b89a12d00829ba96301bf35f9bc7164428a031edeab4c746c1f4a38c9c05e8b0d891b7cc03aa35e9c9aacecf158381241114806a91ee0d5c1f2523b5b9f7b8f38e083c05bca2200ac96dc63272004e9ef20fd577ea7ae4a3387306fa5656229c03e4f968ce39ef07b7a89051f4f577d65651fb64ac6265be9aa8dcb238343cedcafaf7c562225fd1840dc5ccb90322766d1634993360570ec7feb40cb3101bca80a58640d0bac91308437014df7c14da356427a6ecca491e6f9588ec2c7f896e39b099591086b04d0d568eb399f0bb8c841611931cb2fd6fd73ebb7f8b9b73d48fb3b294e052953b315a951019a043b7ebca3c4821d7c540facf4c2bb4534aa3445decfd270b8f03a9d71dc2a8e4c50439c956161e1ad4b067b197db3b86b8b4022f2ee27a7e9d4658c3cd641e34ad088969674f3cc7bcc6256221922fed4c749a0d41c095c0e3995056b43744ad9b8b6ba6565c2cc4fd43d8a9abeb60e5c2db0fee542869de33fd32ef72d7bc6a918763f187538a830280e326448dca9fa31403054357234592cc1d55504d9ab55cdaa369958626b476bdbf7c5913f38db214f1be91020b327346b1e05a90026b67915abbf1fd69103935e87699dd3f920da161441764598005fbd92ff22f287ca6809be5497322b42cc300e76e7877d42949a10c79cf8a7b22e46b34b4624a0550de07ef48547abac7d30e79d6028c70aa6942c8558d61c4d3e831cb586ed72e18fd5c1a15e4d81d1c35b5bd143ec188983c524a52f69ba844fdb3b20909d32997cdc822a5646adc597463c0f354aa55943d9eca6b01751902cd8ad8bb8e19f82cccbc696989332be3af34fc9547abfbee54267d775e85e65b2d5ecc0947b2772aeb7b41db3edd3025f5f2d57b0edda51b69191bbe8bfdc06ccb2bb1f55a104bc3b4298470d44531a1b1f1400a094453a9ebe3e06f522847be402b85aecc13422ca423c7357c7cefd5acb9b7dab1e724076b755323bf375918f0de79c78dd2b76963f35ca8c3c7bf3e9fa3b6e12b63646a717a92abac968286b1d0c6b4277b9a4a975fd6a5ad30e18aeae32040687265d0d1848d30190e43cdcf167f8db57ea04be0ce696f4257abe3427eb9b785ee619c52aef573266a886b298c4371ae2e7c141c5263dd6fa898171b3b6e3194a446fe27807bb685b700188acff8d10cf5ed0d8007db138dd93b5afc9dd60470e1639b712aa8669094c32f8c8652be3d2b7100281d7d9495795a97c3dff5a844ce6a2c2c1aa92356bc7b767db8bf3a9a438aaea4d3806afa53ba86922e4c4424485cc05dc26b44059528cbf208a6774eb6dfdf1492393d9c17268a97ead7700fb2d61e3b9378f09e5bafec089b2b8f971b78ac6b5dfda6ae423ad9fb162306912c76cc6c6936b4cc08598b5cf4f3037ce1c03f0dda1018d1600c3f452d2ad9a7b52eae3b55f1d9b0e0a3283cca3db142d3daf62a8c758b9a294779b645b05dcd478c42ad24e5cec8c25da6bd7271e9df0195e13737f86996da964b6b11fabce88258c5b628cc3368ebcb7c8350f0d17c9af5250516c8cf31407ed32704a5fb5d7da05750485c687452ad238bc7f645dc9efa61f88b3f8c3faeb1f8e44a9b907fc5c3ad527270732f3ebd574a75e8ff7b6e6537f54fbf0e8e3316efda3eab14e4f0d7c74d6e3f82e0145588106be9da5d1c74297cc72bf4783078d7ffee9ded2349a53305910998c2837254e864f31e2287dcc19a7d6fb6cdcf80a5dede163a6c3d36e2c5861b89a46eaf0504ad0c7d16ddf02bf6f1d90bf9feaa0b7d9cfefd47d08aac22ee4a6241191f4d6acbdcf6eceae1d2d2028b6e559fb550e1f4a5ee9866da456c7eb034c2f34238572f0d3e3085b1f03509cca9958701fc4a73539c4d446c065bc9e2a4ff1861471c31c6223882ccf0258dcd79634975b560a4905843e26ac6a99346e2de740e4deaa6925a7afdc98025b9b89fc02035efa1457f7b343d3a4c0feeff66f6c719db8528bc49bffcdae000b64fdf1cc755d993b9a77da4c26d8cb8700545c68e4ca1bfd30fb70ad2fe57ce2881cc5b1b6e5126e7705abcc0b8e553252ebc893b5f045e51acdb19944ace5182269f111d1a3533de0c38ec8db309dc44a1c5734846fd5d9e18b07df7ebdbb546f115dc5ef4423351f131c5739e4eed6136dfa022c99c1323144db427af9e3e5c2be67967a3b637413beca8c2081d664af22ac9058bbeeb0d843d09111245a36a245e77fccd3d4e7b359f6ba6521e5a6cbd99b2ef135df13d76d07d0e847ae16ce2b4050c58a775460b6ed86631074516667d590771b2809d55d32b1ed895531e1ee10b25eec4939b0360a2064076a40a8780611ec7f261132e5f7dca1e7284085795408d1385ed7fe4a5cb18c29108cde9b7cbe844d929838a231899e772a381403685446273a564ce6c35aa294ea02b91f61e093ef9191c2d4cf8b722b17093b16d6a3b34444ff9e22ca1dd429d40c2f655ddcf7564aa1cde88a652c5a8589b522ff88938203b09b2fca155be384af4c8d12a32e705ad1d2c4e4e3a9d1a151956ae0f19f9c88ab11137975a5ab53047f5ee69ebbb8c1a2b605e738584a29ad501c0f949aa6a9c0247f17b40f3d8ccbef3c9cc2602d2eb5bf84c7d5bd2480f3478b7975cfa90faf03bbea007baa6682bce23cd245ac372523cf758b939030ad185bc1d0f5753a7268bee39056345130353e0d44d5e46f4a1d933e553f7768071b41d08631a1165b5af7ca4e9d17a3c67ac57aea2d530b6b3a21c279708e71ed6464d01409da47dbadbce0583609105ea631eab93924c1937bf496afe2a4e0758ca521753f8e03e9998618a3304329f70f9a8358416b96c0b42a2287cbd435390a2131d33a8081d5199834a13de7d195ee118bd442af7f34ac1bcce9fad8d61ccc124ed99830dec1d77e90f061ff04043d5e0ea6f1e581a378d2bcbe128ac3756e6070b8321ee6a27634deb278e60e73b9a75083f470808b4b3c4e8661ca91ebed4d028c0683623dc8cbdc01baac0a9451319d960"}) (async) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newnexthop={0x2c, 0x68, 0x1, 0x3, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x6}]}, @NHA_OIF={0x8}]}, 0x2c}}, 0x40000) 624.486184ms ago: executing program 2 (id=6756): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000f80)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000980)="91f8a9849519def28691bbc4173c3d6f357d0272b7e95a136b3ffec75b73e6937b7b22a1319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000f2ffffff2e3591ceb1757de97fb25500620d0d30506e7429fa5337b74945da657f794d5b5bf89588e07b14a17f069912dc0c3f201bff8b9a687b85baa11244632642a9be7b42b6b5882b738f05eba73221490e2d5c17cf406be2796eec488a5b5268f507ee8d6f3dd1d64abc785708eb9bd24e352a984b2b1596d35ebe1d3443aa78fb40209dcfa4666bbcc6ca80810e4d7cf28a3ef8da37545132057476c8adc3906a07f6082bc4e4771b1f84d1eb323d4f9320e33ea3d4b4c1c259db0e63f82409d07fa54d3ecdfc9cd635c1bcd7a5efead4eb3486842c600b735d0ea4bdfbff59", 0x12f}, {&(0x7f0000000bc0)="4490137c227c56ee66c372f3105eb186dd8062fad2d5b5bfb0ba068e74a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9afda48e71255a747b6d03097385fb05cf8db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac539985bac8624c50b527c68b0ff250261953f2da79a78104c2d0000000086b124945aa9ab7581ebd385fb61210c410d799168ffc4b64677af924affd442035db81e18c2d2462d0bb25fff9d3b1ce903597992b2a4d59e5ac2d704fa2595b5d36400d0b2d119796726a223f5739e45568cfdbdb3064d01bf9cd033e5e0907b2eb410b7cf31951394c2477f106d42cc844ffbf8a9ea58", 0xf0}], 0x2}}, {{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000140)="3f3600004a9e865255e6f85f4d18156225c3396c992b47cedd740a6a6c3c82aba6b56bd441a6dd0856d664fb959853821ce9917ed023550816ba4b21413e5e7c41c7e2197da810d26109c4572ec3dfb272cf3e04b596b22fcee1e1de19ab723dca070000000000000009f21c6da4db35a48c20cdfa45bba59bc862f0806217bc0f463d013ad8a399be48fab99f6ba2efae9b6b057f995610f5a7547e6580496df44df19d48a646a72b45fda13a02c1821f331a1a277492757ce58d86c15ba5d6846fb07ae50219723f3fb8707fe475655df4977f47a39b487b9233432e6fb8471ffa52906bc68d0eaee847ad93c7c92f27b0a59d36be1767c24a529294b82985dbd43393f8c25d", 0x107}], 0x1}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)="d3699ec524df667babb146c0768fa8cda957113e5a89", 0x16}], 0x1}}, {{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000640)="617fc7e5a8cb337b164f901dcb4858d08ecea922573cd1cce7f1c5c423a8ce60df543658ad88a18c47f793a8d1cf56119637f1d0a19113f7a8009e7ad23025d8bdfea45f11526de25ae5dab16d1a0efc91165a58516fe7926bcf481cff66285aa871e526c65a4d7a43b3263e1c05f08b560efc960fed49ed13374fafbca5ee738dcbc0972216a5df7785fce4f5964fffc0c763089768f51b59f31d7ee9394211e2a9398deeba0fe2aa5c76b1448c228caf2d2f", 0xb3}, {&(0x7f0000000700)="966a5aa247de09ddb011b0bd6585310190107f8d38ce5c34c1c00ea281eece14ce85e070238397c24d90484a292e7ae435d1a557ac6e4354164bbd645220d7f8d6f234f0ea35164321f2f31c58d555940e7ccbc378782e4e9b7e4bfe09fd08f30b8fde550e1d84b3555b9da5c3bbd7ec525036c51015b764d112e979ae465daf47a6e7c027eaba020166e30606696c79286c5bcd7ec23c72fee289b35a00d19301038744a13be35a86b95d4d15b6e69be9c84aeedd9b173233e1a705d23fd4aa7827c281ad301bd8df5320ef05b65c94bec4accd7ce1bf6371395eeebd00342c57162853d315486d7572facee14c", 0xee}, {&(0x7f0000000800)="c506315fee2670a9b7ef2de48aa62e", 0xf}, {&(0x7f0000000840)="b8e07cd2926d7390a2b3b03c5659ef2447b734c6f47a408a50c49efc3265972ae6aaf88ffb3c9c82c62b14769ff60db46291eb4bc23be6a1a8f8c309812f1febfcff44d7dfa85a1931022a0b51", 0x4d}], 0x4}}], 0x4, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 604.355337ms ago: executing program 4 (id=6757): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='memory.events.local\x00', 0x275a, 0x0) (async) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) (async) r3 = socket$inet_sctp(0x2, 0x0, 0x84) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000000)={r2, 0x2}, 0x8) (async) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x7, 0x5, 0x8002, 0x2, 0x6, 0x7, 0x3, 0x6, r2}, &(0x7f0000000180)=0x20) write$cgroup_devices(r0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000280)={r4, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x200, 0x2}, &(0x7f00000003c0)=0x90) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r6 = openat$cgroup_freezer_state(r5, &(0x7f0000000140), 0x2, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000080)=0x200000) (async) write$cgroup_freezer_state(r6, &(0x7f0000000340)='FREEZING\x00', 0x9) (async) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x84, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0xfffd}, 0x90) sendmmsg(r7, &(0x7f0000003ac0)=[{{&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @local, 0x8}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000380)='[', 0x1}], 0x1}}], 0x1, 0x0) (async) syz_genetlink_get_family_id$wireguard(&(0x7f0000000000), r0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040), 0x52) 595.866915ms ago: executing program 0 (id=6758): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="02030003120000002cbd7000fbdbdf2503000900800000001cdc0dca1d9f68846960e56de42944af05000600000000000a0000000000000000000000000000000000000000000010020000000000000002000100000000000000070c0000000005000500000000000a00000000000003fc01000000000000000000000000001307000000000000000100140007"], 0x90}, 0x1, 0x7}, 0x0) 525.651627ms ago: executing program 1 (id=6759): r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r0, &(0x7f0000000440)={0x0, 0xffffffffffffffa1, &(0x7f0000000500)=[{&(0x7f0000000480)=""/103, 0xffffffbd}], 0x1}, 0x0) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYRES16=r0, @ANYRES32, @ANYBLOB="dac170670909b7e4bc6252b3"], 0x1c}}, 0x0) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x2) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, 0x0, &(0x7f00000023c0)) ioctl$sock_netrom_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x1, @null, @bpq0, 0x9, 'syz0\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, 0x2, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@ipv6_getaddrlabel={0x30, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x80}, [@IFAL_ADDRESS={0x14, 0x1, @loopback}]}, 0x30}}, 0x0) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r2, 0x12, 0x2, &(0x7f0000000240)=""/197, &(0x7f0000000340)=0xc5) sendmsg$TIPC_CMD_DISABLE_BEARER(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x2c, r3, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {}, {0x10, 0x13, @udp='udp:syz1\x00'}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040080}, 0x24004045) 424.070507ms ago: executing program 0 (id=6760): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000004540), 0x0, 0x240080e4) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYRES8=r0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000004020000000000000000000020001700010000002dbd700028bd70002cbd700029bd70000100000001000080"], 0xd8}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000480), r3) sendmsg$NLBL_MGMT_C_LISTDEF(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB="758c7ba257b774aeb13da6d6c034bdc95818cc224c18a1678bc51fce3bf92e1a69c3286b2d5275f2123bc985bd0f0421b080952930e1659dba098a00037b89244d1aa0982f2bcdf31d19f04087833f90d38a9329e63d29542ff200193f75c0f1"], 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r8, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) sendto$inet(r8, 0x0, 0x0, 0x8000, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r8, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha512\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r11 = accept4(r10, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=@delqdisc={0x150, 0x25, 0x800, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0x3}, {0xfff2, 0x1}, {0xb}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0xfc, 0x2, [@TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME_EXTENSION={0xc, 0x9, 0x5}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x78, 0x2, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4c8}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x5c050f0c}, @TCA_TAPRIO_SCHED_ENTRY_CMD={0x5, 0x2, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8}]}, {0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x7}]}, {0x3c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x401}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x6}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x7}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x2}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x5}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x140000}]}]}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0x1}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x8}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0x5, 0xa, 0x7, 0x1, 0xb, 0xd, 0x7, 0xc, 0x5, 0x4, 0x5, 0x2, 0x6, 0xd, 0xb, 0x5], 0x1, [0xa4, 0x34b8, 0x6, 0x1ff, 0x9, 0x1, 0x6d, 0x0, 0xffff, 0x3, 0x6, 0x1000, 0x2, 0xbb, 0x52e, 0x3], [0xfffc, 0x3fc, 0x5, 0x100, 0xc, 0xf, 0x1, 0x1847, 0x6, 0x7, 0x0, 0x8, 0x7, 0x2, 0x9, 0xa90]}}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0xe}]}}, @qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0xda}}, @TCA_RATE={0x6, 0x5, {0x8, 0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xfff}]}, 0x150}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r13, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8810}, 0x8000) 387.955677ms ago: executing program 4 (id=6761): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x1c}, 0x1, 0xffffffa1, 0x0, 0x40000}, 0x8004) 276.943651ms ago: executing program 1 (id=6762): syz_emit_ethernet(0x4f, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6c2d01000019840100000000050000000002000000010102fe8000000000000000000000000000aaa5ba94e385673ccfd3fe184ab0643975bcc85fbf438632261b"], 0x0) 204.276161ms ago: executing program 4 (id=6763): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet6_mreq(r0, 0x29, 0x4, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) (async) connect(r1, &(0x7f0000000040)=@generic={0x9, "9c7e67494658ea5ed807f61a7d6c09249175d7bc4bd07e4eb7c72ecff6a8cd3dc0636d74022b968962ccb604e0431494d9abd232ff7fc405f0bec73aa6262ab11343deb0046add85f095514fa4bafa64b6b6620890b89d61c65d01f0e15cc321ec0174a74159424e1a0f662b69210d4b8e089fb3c6b8544e01d48dda03f9"}, 0x80) 138.817428ms ago: executing program 0 (id=6764): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000060a01080000000000000000050000090c000340000000000000000438000000160a0100000000f5ffffff00010000070900010073797a30e3ffffff0900020073797a30000000000c0003"], 0x80}}, 0x0) 138.183118ms ago: executing program 4 (id=6765): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000017000000540006803c2e040067636d286165732900000000000000000000000000000000000000000000000014000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 114.54819ms ago: executing program 1 (id=6766): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000000)) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x54, 0x12, 0x303, 0x70bd2d, 0xfffffffd, {0x0, 0x4, 0x2, 0x0, {0x4e22, 0x4e23, [0x4, 0x7, 0xfffffffa, 0x4000000], [0x2, 0x80, 0xfff], 0x0, [0x7]}, 0x2, 0x2}, [@INET_DIAG_REQ_BYTECODE={0x8, 0x3, "11000000"}]}, 0x54}, 0x1, 0x0, 0x0, 0x20040849}, 0x8004) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCDELRT(r2, 0x890c, &(0x7f0000000680)={0x1, @null, @bpq0, 0x89, 'syz1\x00', @null, 0x2, 0x8, [@null, @default, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast]}) sendto$packet(r0, &(0x7f00000000c0)="6816ab65141aae0aba8ad0fd4440112fd4e8b505a3be6a3792275313c6926932f76a36b3998f58afc6a15d5d8c7998", 0x2f, 0x4040, &(0x7f0000000100)={0x11, 0xf5, 0x0, 0x1, 0x1, 0x6, @local}, 0x14) 0s ago: executing program 0 (id=6767): sendmsg$inet(0xffffffffffffffff, 0x0, 0x84) r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x18, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000fb000000000000000000e500020000000000e500fcff00000000060000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x8}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a80)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}, 0x50) setsockopt$sock_int(r1, 0x1, 0x25, &(0x7f00000000c0)=0x10001, 0x4) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x200) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r4 = accept4(r0, 0x0, 0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) r6 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r6, 0x8923, &(0x7f0000000000)={'dummy0\x00', 0x48}) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) setsockopt$packet_fanout_data(r5, 0x107, 0x16, &(0x7f0000000100)={0x0, 0x0}, 0x10) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r9, 0x6, 0x1f, &(0x7f0000000100)="0817b984558c9db4d1c1e379ce093a756f", 0x11) sendto(r4, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000006000)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)=""/93, 0x5d}], 0x1}, 0x4}], 0x1, 0x0, 0x0) recvfrom(r3, &(0x7f0000000380)=""/49, 0xfec6, 0x10022, 0x0, 0x0) kernel console output (not intermixed with test programs): 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 539.512207][T22287] RSP: 002b:00007fae48478fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 539.512227][T22287] RAX: ffffffffffffffda RBX: 00007fae484796c0 RCX: 00007fae4755d04e [ 539.512241][T22287] RDX: 000000000000000f RSI: 00007fae484790a0 RDI: 0000000000000004 [ 539.512253][T22287] RBP: 00007fae48479090 R08: 0000000000000000 R09: 0000000000000000 [ 539.512263][T22287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 539.512272][T22287] R13: 00007fae47816038 R14: 00007fae47815fa0 R15: 00007ffff96d80d8 [ 539.512299][T22287] [ 539.824973][T22291] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 539.851267][T22291] bond5 (unregistering): Released all slaves [ 540.231094][T22315] bond3: entered promiscuous mode [ 540.435913][T22325] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 540.465573][T22325] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 540.474322][T22325] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 540.493907][T22325] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 540.512445][T22325] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 540.643212][T22323] wg1 speed is unknown, defaulting to 1000 [ 540.672566][T22323] lo speed is unknown, defaulting to 1000 [ 540.899472][T22349] l2tp_ppp: sess 2/0: no socket in recv [ 540.900709][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5200 ms [ 540.913208][ C0] lec:lec_tx_timeout: lec0 [ 540.970543][T22353] IPVS: set_ctl: invalid protocol: 8 10.1.1.0:20002 [ 541.128764][T22323] chnl_net:caif_netlink_parms(): no params data found [ 541.237443][T22323] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.244831][T22323] bridge0: port 1(bridge_slave_0) entered disabled state [ 541.252434][T22323] bridge_slave_0: entered allmulticast mode [ 541.260296][T22323] bridge_slave_0: entered promiscuous mode [ 541.292805][T22323] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.300112][T22323] bridge0: port 2(bridge_slave_1) entered disabled state [ 541.307708][T22323] bridge_slave_1: entered allmulticast mode [ 541.315010][T22323] bridge_slave_1: entered promiscuous mode [ 541.371945][T22369] syzkaller0: entered promiscuous mode [ 541.377682][T22369] syzkaller0: entered allmulticast mode [ 541.433992][T22323] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 541.447447][T22323] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 541.514725][T22323] team0: Port device team_slave_0 added [ 541.536610][T22323] team0: Port device team_slave_1 added [ 541.612248][T22385] ip6gre1: entered promiscuous mode [ 541.629278][T22385] ip6gre1: entered allmulticast mode [ 541.641693][T22323] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 541.643380][T22385] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 541.648668][T22323] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 541.648696][T22323] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 541.650562][T22323] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 541.712637][T22323] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 541.739608][T22323] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 541.758092][ T138] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 541.774973][ T138] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 541.783660][ T47] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 541.854508][T22390] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 541.988262][T22323] hsr_slave_0: entered promiscuous mode [ 542.022375][T22323] hsr_slave_1: entered promiscuous mode [ 542.154246][ T47] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 542.351046][ T47] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 542.608661][ T51] Bluetooth: hci3: command tx timeout [ 542.925141][T22323] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 542.937295][T22323] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.025308][T22421] FAULT_INJECTION: forcing a failure. [ 543.025308][T22421] name failslab, interval 1, probability 0, space 0, times 0 [ 543.038296][T22421] CPU: 0 UID: 0 PID: 22421 Comm: syz.0.5651 Not tainted syzkaller #0 PREEMPT(full) [ 543.038319][T22421] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.038331][T22421] Call Trace: [ 543.038338][T22421] [ 543.038346][T22421] dump_stack_lvl+0xe8/0x150 [ 543.038377][T22421] should_fail_ex+0x412/0x560 [ 543.038407][T22421] should_failslab+0xa8/0x100 [ 543.038430][T22421] ? skb_clone+0x212/0x3a0 [ 543.038454][T22421] kmem_cache_alloc_noprof+0x87/0x650 [ 543.038472][T22421] ? lock_acquire+0xf0/0x2e0 [ 543.038499][T22421] skb_clone+0x212/0x3a0 [ 543.038520][T22421] ? dev_queue_xmit_nit+0x268/0xad0 [ 543.038543][T22421] dev_queue_xmit_nit+0x29a/0xad0 [ 543.038565][T22421] ? dev_queue_xmit_nit+0x2d/0xad0 [ 543.038595][T22421] dev_hard_start_xmit+0x1cf/0x870 [ 543.038637][T22421] __dev_queue_xmit+0x16d1/0x3890 [ 543.038661][T22421] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.038688][T22421] ? __dev_queue_xmit+0x277/0x3890 [ 543.038733][T22421] ? __pfx___dev_queue_xmit+0x10/0x10 [ 543.038767][T22421] ? __copy_skb_header+0xa3/0x4a0 [ 543.038792][T22421] ? __asan_memcpy+0x40/0x70 [ 543.038810][T22421] ? __skb_clone+0x63/0x7a0 [ 543.038838][T22421] ? __skb_clone+0x483/0x7a0 [ 543.038869][T22421] ? skb_clone+0x246/0x3a0 [ 543.038896][T22421] __netlink_deliver_tap+0x5ad/0x850 [ 543.038931][T22421] ? netlink_deliver_tap+0x2e/0x1b0 [ 543.038953][T22421] netlink_deliver_tap+0x19c/0x1b0 [ 543.038976][T22421] netlink_unicast+0x7e3/0x9b0 [ 543.039003][T22421] ? __pfx_netlink_unicast+0x10/0x10 [ 543.039025][T22421] ? netlink_sendmsg+0x650/0xb40 [ 543.039043][T22421] ? skb_put+0x11b/0x210 [ 543.039069][T22421] netlink_sendmsg+0x813/0xb40 [ 543.039099][T22421] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.039124][T22421] ? aa_sock_msg_perm+0xf1/0x1b0 [ 543.039152][T22421] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 543.039177][T22421] ____sys_sendmsg+0x972/0x9f0 [ 543.039210][T22421] ? __pfx_____sys_sendmsg+0x10/0x10 [ 543.039243][T22421] ? import_iovec+0x73/0xa0 [ 543.039268][T22421] ___sys_sendmsg+0x2a5/0x360 [ 543.039298][T22421] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.039349][T22421] ? __fget_files+0x2a/0x420 [ 543.039365][T22421] ? __fget_files+0x3a0/0x420 [ 543.039389][T22421] __x64_sys_sendmsg+0x1bd/0x2a0 [ 543.039414][T22421] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 543.039446][T22421] ? __pfx_ksys_write+0x10/0x10 [ 543.039475][T22421] do_syscall_64+0x14d/0xf80 [ 543.039498][T22421] ? trace_irq_disable+0x3b/0x150 [ 543.039513][T22421] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.039534][T22421] ? clear_bhb_loop+0x40/0x90 [ 543.039554][T22421] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.039570][T22421] RIP: 0033:0x7f4cb7b9c819 [ 543.039588][T22421] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.039603][T22421] RSP: 002b:00007f4cb8a25028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 543.039623][T22421] RAX: ffffffffffffffda RBX: 00007f4cb7e15fa0 RCX: 00007f4cb7b9c819 [ 543.039637][T22421] RDX: 0000000000004000 RSI: 0000200000000200 RDI: 0000000000000009 [ 543.039650][T22421] RBP: 00007f4cb8a25090 R08: 0000000000000000 R09: 0000000000000000 [ 543.039661][T22421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 543.039672][T22421] R13: 00007f4cb7e16038 R14: 00007f4cb7e15fa0 R15: 00007ffc5e30a538 [ 543.039818][T22421] [ 543.632599][T22323] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.643228][T22323] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.657977][T22425] syzkaller0: entered promiscuous mode [ 543.663947][T22425] syzkaller0: entered allmulticast mode [ 543.835392][T22453] FAULT_INJECTION: forcing a failure. [ 543.835392][T22453] name failslab, interval 1, probability 0, space 0, times 0 [ 543.849574][T22453] CPU: 0 UID: 0 PID: 22453 Comm: syz.3.5661 Not tainted syzkaller #0 PREEMPT(full) [ 543.849601][T22453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 543.849613][T22453] Call Trace: [ 543.849629][T22453] [ 543.849637][T22453] dump_stack_lvl+0xe8/0x150 [ 543.849667][T22453] should_fail_ex+0x412/0x560 [ 543.849699][T22453] should_failslab+0xa8/0x100 [ 543.849724][T22453] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 543.849746][T22453] ? __alloc_skb+0x186/0x7d0 [ 543.849767][T22453] ? __alloc_skb+0x1d0/0x7d0 [ 543.849786][T22453] ? __local_bh_enable_ip+0xd0/0x130 [ 543.849814][T22453] __alloc_skb+0x1d0/0x7d0 [ 543.849840][T22453] netlink_sendmsg+0x5d4/0xb40 [ 543.849872][T22453] ? __pfx_netlink_sendmsg+0x10/0x10 [ 543.849896][T22453] ? aa_sock_msg_perm+0xf1/0x1b0 [ 543.849924][T22453] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 543.849948][T22453] ____sys_sendmsg+0x972/0x9f0 [ 543.849980][T22453] ? __pfx_____sys_sendmsg+0x10/0x10 [ 543.850012][T22453] ? import_iovec+0x73/0xa0 [ 543.850038][T22453] ___sys_sendmsg+0x2a5/0x360 [ 543.850067][T22453] ? __pfx____sys_sendmsg+0x10/0x10 [ 543.850124][T22453] ? __fget_files+0x2a/0x420 [ 543.850140][T22453] ? __fget_files+0x3a0/0x420 [ 543.850168][T22453] __x64_sys_sendmsg+0x1bd/0x2a0 [ 543.850194][T22453] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 543.850227][T22453] ? __pfx_ksys_write+0x10/0x10 [ 543.850259][T22453] do_syscall_64+0x14d/0xf80 [ 543.850283][T22453] ? trace_irq_disable+0x3b/0x150 [ 543.850300][T22453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.850319][T22453] ? clear_bhb_loop+0x40/0x90 [ 543.850341][T22453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 543.850360][T22453] RIP: 0033:0x7ff451b9c819 [ 543.850378][T22453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 543.850395][T22453] RSP: 002b:00007ff452adf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 543.850416][T22453] RAX: ffffffffffffffda RBX: 00007ff451e15fa0 RCX: 00007ff451b9c819 [ 543.850430][T22453] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 543.850443][T22453] RBP: 00007ff452adf090 R08: 0000000000000000 R09: 0000000000000000 [ 543.850454][T22453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 543.850466][T22453] R13: 00007ff451e16038 R14: 00007ff451e15fa0 R15: 00007ffdc6250b68 [ 543.850495][T22453] [ 543.851159][T22451] netlink: 'syz.1.5660': attribute type 4 has an invalid length. [ 543.864008][T22323] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 543.886650][T22451] __nla_validate_parse: 9 callbacks suppressed [ 543.886668][T22451] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5660'. [ 543.893064][T22323] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.141369][T22443] syzkaller0: entered promiscuous mode [ 544.146870][T22443] syzkaller0: entered allmulticast mode [ 544.209087][T22323] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 544.240336][T22323] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 544.473831][T22476] tipc: Enabled bearer , priority 11 [ 544.510043][T22479] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 544.648837][T22479] tipc: Enabling of bearer rejected, failed to enable media [ 544.660957][ T51] Bluetooth: hci3: command tx timeout [ 544.694131][T22323] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 544.725477][T22323] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 544.733506][T22323] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 544.775163][T22323] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 544.974098][T22491] bridge0: port 3(gretap0) entered disabled state [ 545.460909][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 545.498104][T22503] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5674'. [ 545.640183][T22491] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 545.671642][T22491] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 545.997608][T22491] veth1_vlan: left allmulticast mode [ 546.073166][T22495] vlan3: entered promiscuous mode [ 546.078331][T22495] bridge0: entered promiscuous mode [ 546.088075][T22323] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 546.097515][T22323] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 546.107281][ T91] wg1 speed is unknown, defaulting to 1000 [ 546.118721][T22323] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 546.125685][ T91] syz2: Port: 1 Link DOWN [ 546.151248][T22323] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 546.186584][ T6393] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.213147][ T6393] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.244505][ T6393] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.265142][ T6393] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.296118][ T6393] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.327927][ T6393] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.356301][ T6393] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 546.365620][ T6393] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.416850][T22535] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5681'. [ 546.449382][T22535] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5681'. [ 546.563518][T22542] netlink: 'syz.2.5684': attribute type 4 has an invalid length. [ 546.585322][T22323] 8021q: adding VLAN 0 to HW filter on device bond0 [ 546.593677][T22542] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5684'. [ 546.622032][T22323] 8021q: adding VLAN 0 to HW filter on device team0 [ 546.646064][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 546.653272][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 546.697078][ T1097] bridge0: port 2(bridge_slave_1) entered blocking state [ 546.704283][ T1097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 546.743891][ T51] Bluetooth: hci3: command tx timeout [ 546.879542][T22549] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 546.906154][T22552] vlan3: entered promiscuous mode [ 546.964283][T22549] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 547.053467][T22554] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 547.208235][T22559] syzkaller0: entered promiscuous mode [ 547.222643][T22559] syzkaller0: entered allmulticast mode [ 547.236178][T22323] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 547.554686][T22576] l2tp_ppp: sess 2/0: no socket in recv [ 547.615119][T22570] syzkaller0: entered promiscuous mode [ 547.620624][T22570] syzkaller0: entered allmulticast mode [ 548.832977][ T51] Bluetooth: hci3: command tx timeout [ 549.520539][T22323] veth0_vlan: entered promiscuous mode [ 549.536974][T22323] veth1_vlan: entered promiscuous mode [ 549.624759][T22323] veth0_macvtap: entered promiscuous mode [ 549.647252][T22323] veth1_macvtap: entered promiscuous mode [ 549.675624][T22611] netlink: 60 bytes leftover after parsing attributes in process `syz.0.5704'. [ 549.696713][T22323] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 549.739964][T22323] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 549.769507][ T6393] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.788369][T22617] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.801351][ T6393] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.826050][ T6393] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.861316][ T6393] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 549.873579][T22620] syzkaller0: entered promiscuous mode [ 549.879091][T22620] syzkaller0: entered allmulticast mode [ 550.218463][ T6393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 550.232323][ T6393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 550.235523][T22640] syzkaller0: entered promiscuous mode [ 550.262552][T22640] syzkaller0: entered allmulticast mode [ 550.380395][ T6401] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 550.389656][ T6401] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 550.609839][T22662] bridge6: entered promiscuous mode [ 550.615720][T22662] bridge6: entered allmulticast mode [ 550.624519][T22662] team0: Port device bridge6 added [ 550.654264][T22664] syzkaller0: entered promiscuous mode [ 550.669983][T22664] syzkaller0: entered allmulticast mode [ 550.837108][T22670] syz_tun: entered allmulticast mode [ 550.946297][T22679] netlink: 'syz.0.5726': attribute type 21 has an invalid length. [ 550.946953][T22677] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.5725'. [ 551.733038][T22698] bridge7: entered promiscuous mode [ 551.742894][T22698] bridge7: entered allmulticast mode [ 551.755856][T22698] team0: Port device bridge7 added [ 551.782022][ T6401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.798373][ T6401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.993247][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 552.101161][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 552.424107][T22730] syzkaller0: entered promiscuous mode [ 552.429861][T22730] syzkaller0: entered allmulticast mode [ 552.662104][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 552.673729][T22735] bridge1: entered promiscuous mode [ 552.678964][T22735] bridge1: entered allmulticast mode [ 552.702509][T22735] team0: Port device bridge1 added [ 552.768220][T22737] bridge0: port 3(team0) entered blocking state [ 552.787039][T22737] bridge0: port 3(team0) entered disabled state [ 552.805228][T22737] team0: entered allmulticast mode [ 552.810596][T22737] team_slave_0: entered allmulticast mode [ 552.816876][T22737] team_slave_1: entered allmulticast mode [ 552.825828][T22737] team0: entered promiscuous mode [ 552.831431][T22737] team_slave_0: entered promiscuous mode [ 552.837253][T22737] team_slave_1: entered promiscuous mode [ 552.845118][T22737] bridge0: port 3(team0) entered blocking state [ 552.851522][T22737] bridge0: port 3(team0) entered forwarding state [ 553.142339][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 553.150551][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 553.315463][T22777] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5761'. [ 553.410868][T22775] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5760'. [ 553.417452][T22783] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 553.420566][T22775] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5760'. [ 553.490925][ T24] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 553.522837][ T24] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 553.684120][T22795] netlink: 'syz.0.5769': attribute type 1 has an invalid length. [ 553.719726][T22795] 8021q: adding VLAN 0 to HW filter on device bond4 [ 553.864838][T22809] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 553.943990][T22816] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 553.969926][T22809] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 554.083497][T22809] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 554.108410][T22825] netlink: 'syz.0.5777': attribute type 10 has an invalid length. [ 554.161472][T22825] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.175159][T22825] bridge_slave_1: left allmulticast mode [ 554.182275][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.229357][T22825] bridge_slave_1: left promiscuous mode [ 554.235773][T22825] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.350266][T22830] syzkaller0: entered promiscuous mode [ 554.360810][T22830] syzkaller0: entered allmulticast mode [ 555.226371][ T24] net_ratelimit: 5 callbacks suppressed [ 555.226391][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.863322][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.873288][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.882433][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.897576][T17129] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.081731][T22864] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5791'. [ 556.093107][T22864] netlink: 'syz.4.5791': attribute type 1 has an invalid length. [ 556.101189][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.110264][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.122693][T22864] netlink: 96 bytes leftover after parsing attributes in process `syz.4.5791'. [ 556.142798][T22864] netlink: 658 bytes leftover after parsing attributes in process `syz.4.5791'. [ 556.156880][T22864] netlink: 1 bytes leftover after parsing attributes in process `syz.4.5791'. [ 556.219407][T22872] xt_TPROXY: Can be used only with -p tcp or -p udp [ 556.263464][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.275142][T22869] netlink: 'syz.3.5793': attribute type 28 has an invalid length. [ 556.356560][T22879] x_tables: duplicate underflow at hook 1 [ 556.364979][T22879] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 556.402041][T22885] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 556.548935][ T7568] lec:lec_start_xmit: lec0:No lecd attached [ 556.558916][T22891] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5801'. [ 556.588879][T22899] Cannot find set identified by id 0 to match [ 556.604844][T22891] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5801'. [ 556.649746][T22903] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.5807'. [ 556.840297][T22926] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.684391][T22906] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 559.823505][T22947] set match dimension is over the limit! [ 559.921540][T22952] netlink: 1624 bytes leftover after parsing attributes in process `syz.4.5822'. [ 559.981907][T22958] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.5826'. [ 560.057184][T22958] bridge0: entered allmulticast mode [ 560.173071][T22969] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5830'. [ 560.342402][T17129] net_ratelimit: 5 callbacks suppressed [ 560.342422][T17129] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 560.356362][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 560.420922][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 560.487221][T22987] netlink: 'syz.3.5836': attribute type 21 has an invalid length. [ 560.888604][T23000] bond5: entered promiscuous mode [ 560.894153][T23000] bond5: entered allmulticast mode [ 560.899894][T23000] 8021q: adding VLAN 0 to HW filter on device bond5 [ 561.462462][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.860705][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5310 ms [ 561.868764][ C0] lec:lec_tx_timeout: lec0 [ 562.061644][T23050] __nla_validate_parse: 6 callbacks suppressed [ 562.061665][T23050] netlink: 68 bytes leftover after parsing attributes in process `syz.3.5855'. [ 562.159593][T23052] syzkaller0: entered promiscuous mode [ 562.175465][T23052] syzkaller0: entered allmulticast mode [ 562.263502][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.571251][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.911272][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.919751][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.929644][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.936233][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.944827][ T1299] lec:lec_start_xmit: lec0:No lecd attached [ 562.947552][T23065] skbuff: bad partial csum: csum=65535/2 headroom=178 headlen=65543 [ 563.058916][T23071] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5864'. [ 563.253557][T23084] netlink: 'syz.3.5867': attribute type 32 has an invalid length. [ 563.261938][T23084] netlink: 776 bytes leftover after parsing attributes in process `syz.3.5867'. [ 563.450749][T23087] syzkaller0: entered promiscuous mode [ 563.476449][T23087] syzkaller0: entered allmulticast mode [ 563.647587][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 563.813434][T23099] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5873'. [ 563.944564][T23099] netlink: 5 bytes leftover after parsing attributes in process `syz.4.5873'. [ 564.324073][T23132] netlink: 'syz.2.5885': attribute type 4 has an invalid length. [ 564.350873][T23132] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5885'. [ 564.405213][T23134] veth3: entered promiscuous mode [ 564.424431][T23134] veth3: entered allmulticast mode [ 564.425188][T23138] netlink: 52 bytes leftover after parsing attributes in process `syz.0.5886'. [ 564.623655][T23154] IPVS: length: 32 != 24 [ 564.835056][T23174] netlink: 'syz.1.5901': attribute type 4 has an invalid length. [ 564.845916][T23174] netlink: 152 bytes leftover after parsing attributes in process `syz.1.5901'. [ 565.133325][T23190] syzkaller0: entered promiscuous mode [ 565.138866][T23190] syzkaller0: entered allmulticast mode [ 565.314273][T22325] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 565.321017][T23196] netlink: 288 bytes leftover after parsing attributes in process `syz.4.5909'. [ 565.331091][T22325] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 565.339429][T22325] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 565.351948][T22325] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 565.361437][T22325] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 565.381941][ C0] net_ratelimit: 2 callbacks suppressed [ 565.381961][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.447337][T23202] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.531158][T23204] netlink: 'syz.2.5911': attribute type 8 has an invalid length. [ 565.538919][T23197] wg1 speed is unknown, defaulting to 1000 [ 565.546405][T23209] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5914'. [ 565.558497][T23197] lo speed is unknown, defaulting to 1000 [ 565.702383][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.941220][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 565.969527][T23235] netlink: 'syz.1.5924': attribute type 4 has an invalid length. [ 566.017745][ T13] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.029713][ T13] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.041931][ T13] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 566.097270][T23237] vlan2: entered promiscuous mode [ 566.113974][T23237] bridge0: entered promiscuous mode [ 566.163752][ T13] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.191613][ T13] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.219643][ T13] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 566.304962][ T13] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.326417][ T13] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.343743][ T13] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 566.377665][T23197] chnl_net:caif_netlink_parms(): no params data found [ 566.446165][ T13] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 566.460870][ T13] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 566.470973][ T13] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 566.751365][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 566.862672][T23197] bridge0: port 1(bridge_slave_0) entered blocking state [ 566.873482][T23197] bridge0: port 1(bridge_slave_0) entered disabled state [ 566.888284][T23197] bridge_slave_0: entered allmulticast mode [ 566.896552][T23197] bridge_slave_0: entered promiscuous mode [ 566.929940][T23197] bridge0: port 2(bridge_slave_1) entered blocking state [ 566.943492][T23197] bridge0: port 2(bridge_slave_1) entered disabled state [ 566.954013][T23197] bridge_slave_1: entered allmulticast mode [ 566.962344][T23197] bridge_slave_1: entered promiscuous mode [ 567.043799][T23283] Cannot find set identified by id 0 to match [ 567.052139][T23281] hsr_slave_1 (unregistering): left promiscuous mode [ 567.092997][ T13] bridge0: port 1(batadv0) entered disabled state [ 567.113426][ T13] team0: left allmulticast mode [ 567.120798][ T13] team_slave_1: left allmulticast mode [ 567.132626][ T13] team0: left promiscuous mode [ 567.137538][ T13] team_slave_1: left promiscuous mode [ 567.147060][ T13] bridge0: port 4(team0) entered disabled state [ 567.160580][ T13] H: left allmulticast mode [ 567.178175][ T13] bridge0: port 3(H) entered disabled state [ 567.212388][ T13] tipc: Resetting bearer [ 567.363401][ T13] tipc: Disabling bearer [ 567.390885][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 567.460935][ T51] Bluetooth: hci5: command tx timeout [ 567.474552][ T13] bond2 (unregistering): (slave geneve2): Releasing active interface [ 567.522787][ T13] bridge0 (unregistering): left allmulticast mode [ 567.606984][T23310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 567.668972][T23310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 567.684842][ T13] team0: Port device bridge3 removed [ 567.730440][T23310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 567.745546][ T13] team0: Port device bridge4 removed [ 567.781111][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.794725][ T13] bond0 (unregistering): Released all slaves [ 567.808172][ T13] bond1 (unregistering): Released all slaves [ 567.820564][ T13] bond2 (unregistering): Released all slaves [ 567.835415][ T13] bond3 (unregistering): Released all slaves [ 567.848854][ T13] bond4 (unregistering): Released all slaves [ 567.869484][ T13] bond5 (unregistering): Released all slaves [ 567.890489][T23197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 567.923007][T23197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 567.951894][ T5488] 8021q: adding VLAN 0 to HW filter on device eth1 [ 567.960735][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 567.968757][ C0] lec:lec_tx_timeout: lec0 [ 568.058983][ T13] tipc: Left network mode [ 568.068888][T23197] team0: Port device team_slave_0 added [ 568.120233][T23197] team0: Port device team_slave_1 added [ 568.155812][T23321] netlink: 'syz.2.5945': attribute type 4 has an invalid length. [ 568.164363][T23321] __nla_validate_parse: 6 callbacks suppressed [ 568.164379][T23321] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5945'. [ 568.217069][T23322] netlink: 'syz.1.5946': attribute type 1 has an invalid length. [ 568.266078][T23325] netlink: 'syz.3.5947': attribute type 1 has an invalid length. [ 568.271396][T23197] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 568.297193][T23197] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 568.337089][T23197] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 568.388280][T23333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5947'. [ 568.396909][T23197] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 568.404692][T23197] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 568.430937][T23197] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 568.556338][T23339] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5949'. [ 568.651656][T23342] macvlan2: entered promiscuous mode [ 568.659149][T23342] macvlan2: entered allmulticast mode [ 568.686444][T23342] bond7: entered promiscuous mode [ 568.694576][T23342] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 568.749160][T23342] bond7: left promiscuous mode [ 568.822595][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 568.899506][T23197] hsr_slave_0: entered promiscuous mode [ 568.944412][T23197] hsr_slave_1: entered promiscuous mode [ 568.954564][T23197] debugfs: 'hsr0' already exists in 'hsr' [ 568.960327][T23197] Cannot create hsr debugfs directory [ 568.981831][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 569.006647][T23358] set match dimension is over the limit! [ 569.193790][ T13] hsr_slave_0: left promiscuous mode [ 569.232248][ T13] hsr_slave_1: left promiscuous mode [ 569.239516][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 569.260319][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 569.279599][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 569.298646][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 569.329637][ T13] veth0_macvtap: left allmulticast mode [ 569.335635][ T13] veth1_macvtap: left promiscuous mode [ 569.347924][ T13] veth0_macvtap: left promiscuous mode [ 569.361035][ T13] veth1_vlan: left promiscuous mode [ 569.383418][ T13] veth0_vlan: left promiscuous mode [ 569.536096][ T13] pimreg3 (unregistering): left allmulticast mode [ 569.553441][ T51] Bluetooth: hci5: command tx timeout [ 569.740720][ T13] team0 (unregistering): Port device team_slave_1 removed [ 569.874496][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 569.935141][ T5488] 8021q: adding VLAN 0 to HW filter on device eth2 [ 570.245354][T23401] netlink: 'syz.2.5961': attribute type 1 has an invalid length. [ 570.302950][T23398] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5960'. [ 570.329822][T23406] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 570.518603][ T13] IPVS: stop unused estimator thread 0... [ 570.543513][T23427] netlink: 68 bytes leftover after parsing attributes in process `syz.4.5965'. [ 570.978650][ T24] net_ratelimit: 1 callbacks suppressed [ 570.978669][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.110537][T23446] netlink: 830 bytes leftover after parsing attributes in process `syz.2.5970'. [ 571.351855][T23454] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5972'. [ 571.508603][T23197] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 571.527133][T23197] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 571.544741][T23197] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 571.551713][T23458] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5974'. [ 571.587349][T23197] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 571.605868][T23197] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 571.607031][T23462] skbuff: bad partial csum: csum=65535/2 headroom=4 headlen=65543 [ 571.624185][T23197] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 571.637799][ T51] Bluetooth: hci5: command tx timeout [ 571.659551][T23197] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 571.663777][T23468] openvswitch: netlink: IPv4 tunnel dst address is zero [ 571.676589][T23197] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 572.021118][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.029276][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.030868][T23493] netlink: 176 bytes leftover after parsing attributes in process `syz.4.5985'. [ 572.054444][T23197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 572.061030][T23493] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5985'. [ 572.088653][T23197] 8021q: adding VLAN 0 to HW filter on device team0 [ 572.117998][T23493] netlink: 'syz.4.5985': attribute type 29 has an invalid length. [ 572.128076][ T1097] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.135270][ T1097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 572.147671][ T1097] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.155066][ T1097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 572.199628][T23493] wg1 speed is unknown, defaulting to 1000 [ 572.233442][T23493] lo speed is unknown, defaulting to 1000 [ 572.542628][ T5903] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 572.907603][T23531] IPv6: sit1: Disabled Multicast RS [ 572.933768][T23197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 573.066822][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.099635][T23544] FAULT_INJECTION: forcing a failure. [ 573.099635][T23544] name failslab, interval 1, probability 0, space 0, times 0 [ 573.112400][T23544] CPU: 0 UID: 0 PID: 23544 Comm: syz.3.5995 Not tainted syzkaller #0 PREEMPT(full) [ 573.112434][T23544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 573.112445][T23544] Call Trace: [ 573.112453][T23544] [ 573.112461][T23544] dump_stack_lvl+0xe8/0x150 [ 573.112492][T23544] should_fail_ex+0x412/0x560 [ 573.112524][T23544] should_failslab+0xa8/0x100 [ 573.112550][T23544] kmem_cache_alloc_bulk_noprof+0x8d/0x7e0 [ 573.112573][T23544] ? pfn_valid+0x125/0x4c0 [ 573.112603][T23544] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 573.112643][T23544] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 573.112674][T23544] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 573.112717][T23544] ? 0xffffffffa02019c8 [ 573.112732][T23544] ? 0xffffffffa0201a14 [ 573.112772][T23544] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 573.112805][T23544] ? _copy_from_user+0x94/0xb0 [ 573.112827][T23544] ? bpf_test_init+0x113/0x150 [ 573.112845][T23544] ? xdp_convert_md_to_buff+0x5b/0x330 [ 573.112870][T23544] bpf_prog_test_run_xdp+0x81c/0x1160 [ 573.112906][T23544] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 573.112932][T23544] ? __fget_files+0x2a/0x420 [ 573.112952][T23544] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 573.112973][T23544] bpf_prog_test_run+0x2c7/0x340 [ 573.112992][T23544] __sys_bpf+0x643/0x950 [ 573.113010][T23544] ? __pfx___sys_bpf+0x10/0x10 [ 573.113042][T23544] ? ksys_write+0x242/0x270 [ 573.113066][T23544] ? __pfx_ksys_write+0x10/0x10 [ 573.113091][T23544] __x64_sys_bpf+0x7c/0x90 [ 573.113117][T23544] do_syscall_64+0x14d/0xf80 [ 573.113142][T23544] ? trace_irq_disable+0x3b/0x150 [ 573.113157][T23544] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.113176][T23544] ? clear_bhb_loop+0x40/0x90 [ 573.113199][T23544] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 573.113218][T23544] RIP: 0033:0x7ff451b9c819 [ 573.113235][T23544] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 573.113252][T23544] RSP: 002b:00007ff452adf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 573.113273][T23544] RAX: ffffffffffffffda RBX: 00007ff451e15fa0 RCX: 00007ff451b9c819 [ 573.113287][T23544] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 573.113300][T23544] RBP: 00007ff452adf090 R08: 0000000000000000 R09: 0000000000000000 [ 573.113312][T23544] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 573.113324][T23544] R13: 00007ff451e16038 R14: 00007ff451e15fa0 R15: 00007ffdc6250b68 [ 573.113355][T23544] [ 573.191186][ T5936] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.375918][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.476075][T23197] veth0_vlan: entered promiscuous mode [ 573.489228][T23197] veth1_vlan: entered promiscuous mode [ 573.707174][ T51] Bluetooth: hci5: command tx timeout [ 573.752287][T23197] veth0_macvtap: entered promiscuous mode [ 573.775898][T23197] veth1_macvtap: entered promiscuous mode [ 573.801584][T23557] syzkaller0: entered promiscuous mode [ 573.807336][T23557] syzkaller0: entered allmulticast mode [ 574.595915][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 575.481100][T23595] __nla_validate_parse: 1 callbacks suppressed [ 575.481138][T23595] netlink: 1024 bytes leftover after parsing attributes in process `syz.3.6002'. [ 575.534543][T23588] vlan3: entered promiscuous mode [ 575.557609][T23197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 575.645165][T23197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 575.783910][ T35] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 575.928231][T23598] syzkaller0: entered promiscuous mode [ 575.970811][T23598] syzkaller0: entered allmulticast mode [ 576.015646][ T1097] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 576.073777][ T1097] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 576.103682][T23601] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6004'. [ 576.182490][ T1097] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 576.212901][T23613] FAULT_INJECTION: forcing a failure. [ 576.212901][T23613] name failslab, interval 1, probability 0, space 0, times 0 [ 576.225674][T23613] CPU: 0 UID: 0 PID: 23613 Comm: syz.4.6007 Not tainted syzkaller #0 PREEMPT(full) [ 576.225698][T23613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 576.225709][T23613] Call Trace: [ 576.225716][T23613] [ 576.225723][T23613] dump_stack_lvl+0xe8/0x150 [ 576.225753][T23613] should_fail_ex+0x412/0x560 [ 576.225784][T23613] should_failslab+0xa8/0x100 [ 576.225806][T23613] kmem_cache_alloc_bulk_noprof+0x8d/0x7e0 [ 576.225827][T23613] ? pfn_valid+0x125/0x4c0 [ 576.225855][T23613] bpf_test_run_xdp_live+0x179c/0x1cf0 [ 576.225891][T23613] ? bpf_test_run_xdp_live+0x438/0x1cf0 [ 576.225918][T23613] ? __pfx_bpf_test_run_xdp_live+0x10/0x10 [ 576.225956][T23613] ? 0xffffffffa02019c8 [ 576.225970][T23613] ? 0xffffffffa0201a0c [ 576.226009][T23613] ? __pfx_xdp_test_run_init_page+0x10/0x10 [ 576.226038][T23613] ? _copy_from_user+0x94/0xb0 [ 576.226059][T23613] ? bpf_test_init+0x113/0x150 [ 576.226077][T23613] ? xdp_convert_md_to_buff+0x5b/0x330 [ 576.226099][T23613] bpf_prog_test_run_xdp+0x81c/0x1160 [ 576.226133][T23613] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 576.226158][T23613] ? __fget_files+0x2a/0x420 [ 576.226178][T23613] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 576.226262][T23613] bpf_prog_test_run+0x2c7/0x340 [ 576.226285][T23613] __sys_bpf+0x643/0x950 [ 576.226305][T23613] ? __pfx___sys_bpf+0x10/0x10 [ 576.226337][T23613] ? ksys_write+0x242/0x270 [ 576.226359][T23613] ? __pfx_ksys_write+0x10/0x10 [ 576.226384][T23613] __x64_sys_bpf+0x7c/0x90 [ 576.226408][T23613] do_syscall_64+0x14d/0xf80 [ 576.226431][T23613] ? trace_irq_disable+0x3b/0x150 [ 576.226446][T23613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.226464][T23613] ? clear_bhb_loop+0x40/0x90 [ 576.226485][T23613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.226503][T23613] RIP: 0033:0x7f7f34d9c819 [ 576.226520][T23613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 576.226536][T23613] RSP: 002b:00007f7f35b87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 576.226554][T23613] RAX: ffffffffffffffda RBX: 00007f7f35015fa0 RCX: 00007f7f34d9c819 [ 576.226567][T23613] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 576.226579][T23613] RBP: 00007f7f35b87090 R08: 0000000000000000 R09: 0000000000000000 [ 576.226589][T23613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 576.226599][T23613] R13: 00007f7f35016038 R14: 00007f7f35015fa0 R15: 00007fffa0429b18 [ 576.226626][T23613] [ 576.302854][T23625] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6008'. [ 576.423123][ T10] net_ratelimit: 1 callbacks suppressed [ 576.423142][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 576.587767][T23629] netlink: 1024 bytes leftover after parsing attributes in process `syz.4.6009'. [ 576.676112][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.625877][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.718739][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.031568][ T6396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.039427][ T6396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.118936][ T6396] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 578.127728][ T6396] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 578.273143][T23651] netlink: 'syz.0.5905': attribute type 1 has an invalid length. [ 578.299988][T23651] netlink: 2088 bytes leftover after parsing attributes in process `syz.0.5905'. [ 578.321678][T23651] netlink: 1 bytes leftover after parsing attributes in process `syz.0.5905'. [ 578.342458][T23658] syzkaller0: entered promiscuous mode [ 578.347968][T23658] syzkaller0: entered allmulticast mode [ 578.370416][T23663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6021'. [ 578.394946][T23664] netlink: 'syz.4.6020': attribute type 1 has an invalid length. [ 578.402859][T23664] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6020'. [ 578.428569][T23664] netlink: 1 bytes leftover after parsing attributes in process `syz.4.6020'. [ 578.456700][T23664] netlink: 'syz.4.6020': attribute type 1 has an invalid length. [ 578.472449][T23664] netlink: 618 bytes leftover after parsing attributes in process `syz.4.6020'. [ 578.477920][T23663] erspan0: entered promiscuous mode [ 578.491743][T23663] macvtap1: entered promiscuous mode [ 578.510990][T23663] macvtap1: entered allmulticast mode [ 578.516572][T23663] erspan0: entered allmulticast mode [ 578.746717][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.764363][T22325] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 578.775121][T22325] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 578.784344][T22325] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 578.792554][T22325] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 578.801138][T22325] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 579.022714][T23674] wg1 speed is unknown, defaulting to 1000 [ 579.030253][T23674] lo speed is unknown, defaulting to 1000 [ 579.131254][T23693] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 579.243095][ T6396] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.257146][ T6396] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.415997][ T6396] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.432051][ T6396] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.461719][T17129] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.535766][T23705] syzkaller0: entered promiscuous mode [ 579.546725][T17129] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.550783][T23705] syzkaller0: entered allmulticast mode [ 579.599863][T23711] wg1 speed is unknown, defaulting to 1000 [ 579.609178][T23711] lo speed is unknown, defaulting to 1000 [ 579.664288][ T6396] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.675380][ T6396] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 579.735106][T23674] chnl_net:caif_netlink_parms(): no params data found [ 579.784143][ T5936] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.829000][T23720] vlan2: entered promiscuous mode [ 579.834576][T23720] bridge0: entered promiscuous mode [ 579.864114][ T6396] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 579.894449][ T6396] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.091406][T23740] openvswitch: netlink: IP tunnel dst address not specified [ 580.137071][T23745] netlink: 'syz.0.6045': attribute type 4 has an invalid length. [ 580.182075][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.337576][T23745] .`: renamed from bond0 (while UP) [ 580.426640][T23674] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.440868][T23674] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.457937][T23674] bridge_slave_0: entered allmulticast mode [ 580.467405][T23674] bridge_slave_0: entered promiscuous mode [ 580.476394][T23674] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.491135][T23674] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.498447][T23674] bridge_slave_1: entered allmulticast mode [ 580.508539][T23674] bridge_slave_1: entered promiscuous mode [ 580.591964][ T6396] bridge_slave_1: left allmulticast mode [ 580.597651][ T6396] bridge_slave_1: left promiscuous mode [ 580.626627][ T6396] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.647752][ T6396] bridge_slave_0: left allmulticast mode [ 580.661259][ T6396] bridge_slave_0: left promiscuous mode [ 580.678346][ T6396] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.901065][ T51] Bluetooth: hci4: command tx timeout [ 581.049314][ T6396] bond3 (unregistering): (slave gretap1): Releasing active interface [ 581.106627][ T6396] bridge0 (unregistering): left allmulticast mode [ 581.176161][ T6396] bond0 (unregistering): (slave bridge1): Releasing active interface [ 581.197125][ T6396] bridge1 (unregistering): left promiscuous mode [ 581.204314][ T6396] bridge1 (unregistering): left allmulticast mode [ 581.477923][ T6396] bond0 (unregistering): Released all slaves [ 581.491243][ T6396] bond1 (unregistering): Released all slaves [ 581.504760][ T6396] bond2 (unregistering): (slave vxcan3): Releasing backup interface [ 581.513965][ T6396] bond2 (unregistering): Released all slaves [ 581.532989][ T6396] bond3 (unregistering): Released all slaves [ 581.541045][ C0] net_ratelimit: 6 callbacks suppressed [ 581.541064][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.548365][ T6396] bond4 (unregistering): Released all slaves [ 581.555263][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.569612][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.602864][T23674] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 581.641796][T23674] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 581.660001][ T6396] 9: left promiscuous mode [ 581.714824][ T5488] 8021q: adding VLAN 0 to HW filter on device eth1 [ 581.715868][T23794] __nla_validate_parse: 4 callbacks suppressed [ 581.715886][T23794] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6054'. [ 581.767168][ T6396] tipc: Disabling bearer [ 581.787074][ T6396] tipc: Left network mode [ 581.819983][T23674] team0: Port device team_slave_0 added [ 581.844519][T23674] team0: Port device team_slave_1 added [ 581.881200][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.953535][T23801] netlink: 96 bytes leftover after parsing attributes in process `syz.0.6055'. [ 582.506732][T23674] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 582.514195][T23674] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 582.540888][T23674] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 582.554863][T23674] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 582.563681][T23674] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 582.621006][T23674] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 582.646989][T23813] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6057'. [ 582.839835][ T5488] 8021q: adding VLAN 0 to HW filter on device eth2 [ 582.924065][ T47] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 582.981081][ T51] Bluetooth: hci4: command tx timeout [ 583.002405][T23841] FAULT_INJECTION: forcing a failure. [ 583.002405][T23841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 583.027809][T23841] CPU: 0 UID: 0 PID: 23841 Comm: syz.4.6062 Not tainted syzkaller #0 PREEMPT(full) [ 583.027844][T23841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 583.027855][T23841] Call Trace: [ 583.027862][T23841] [ 583.027870][T23841] dump_stack_lvl+0xe8/0x150 [ 583.027901][T23841] should_fail_ex+0x412/0x560 [ 583.027933][T23841] _copy_from_user+0x2d/0xb0 [ 583.027962][T23841] ax25_ioctl+0x994/0xd40 [ 583.027991][T23841] ? __pfx_ax25_ioctl+0x10/0x10 [ 583.028015][T23841] ? tomoyo_path_number_perm+0x219/0x630 [ 583.028040][T23841] ? tomoyo_path_number_perm+0x219/0x630 [ 583.028066][T23841] ? do_vfs_ioctl+0x1166/0x1530 [ 583.028088][T23841] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 583.028116][T23841] sock_do_ioctl+0x101/0x320 [ 583.028138][T23841] ? __pfx_sock_do_ioctl+0x10/0x10 [ 583.028154][T23841] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 583.028195][T23841] sock_ioctl+0x5c6/0x7f0 [ 583.028223][T23841] ? __pfx_sock_ioctl+0x10/0x10 [ 583.028249][T23841] ? __fget_files+0x2a/0x420 [ 583.028266][T23841] ? __fget_files+0x3a0/0x420 [ 583.028280][T23841] ? __fget_files+0x2a/0x420 [ 583.028297][T23841] ? bpf_lsm_file_ioctl+0x9/0x20 [ 583.028319][T23841] ? __pfx_sock_ioctl+0x10/0x10 [ 583.028343][T23841] __se_sys_ioctl+0xfc/0x170 [ 583.028365][T23841] do_syscall_64+0x14d/0xf80 [ 583.028388][T23841] ? trace_irq_disable+0x3b/0x150 [ 583.028404][T23841] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.028439][T23841] ? clear_bhb_loop+0x40/0x90 [ 583.028460][T23841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 583.028478][T23841] RIP: 0033:0x7f7f34d9c819 [ 583.028495][T23841] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 583.028509][T23841] RSP: 002b:00007f7f35b87028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 583.028527][T23841] RAX: ffffffffffffffda RBX: 00007f7f35015fa0 RCX: 00007f7f34d9c819 [ 583.028541][T23841] RDX: 0000200000000040 RSI: 00000000000089ea RDI: 0000000000000005 [ 583.028553][T23841] RBP: 00007f7f35b87090 R08: 0000000000000000 R09: 0000000000000000 [ 583.028564][T23841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 583.028575][T23841] R13: 00007f7f35016038 R14: 00007f7f35015fa0 R15: 00007fffa0429b18 [ 583.028602][T23841] [ 583.257210][ T10] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.282431][T23674] hsr_slave_0: entered promiscuous mode [ 583.289294][T23674] hsr_slave_1: entered promiscuous mode [ 583.295886][T23674] debugfs: 'hsr0' already exists in 'hsr' [ 583.315100][T23674] Cannot create hsr debugfs directory [ 583.326790][T23845] netlink: 212340 bytes leftover after parsing attributes in process `syz.3.6064'. [ 583.373751][T23845] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 583.494239][ T6396] hsr_slave_0: left promiscuous mode [ 583.500535][ T6396] hsr_slave_1: left promiscuous mode [ 583.517624][ T6396] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 583.550595][ T6396] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 583.582486][ T6396] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 583.600090][ T6396] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 583.629977][ T6396] veth1_macvtap: left promiscuous mode [ 583.638062][ T6396] veth0_macvtap: left promiscuous mode [ 583.645589][ T6396] veth1_vlan: left promiscuous mode [ 583.657486][ T6396] veth0_vlan: left promiscuous mode [ 583.773245][ T6396] pimreg3 (unregistering): left allmulticast mode [ 583.944846][ T5936] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.046108][T23871] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6071'. [ 584.058946][T23871] openvswitch: netlink: Flow actions attr not present in new flow. [ 584.077520][ T6396] team0 (unregistering): Port device team_slave_1 removed [ 584.283914][T23846] lec:lec_start_xmit: lec0:No lecd attached [ 584.319442][ T5488] 8021q: adding VLAN 0 to HW filter on device eth3 [ 584.544834][T23884] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.582655][T23887] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6073'. [ 584.608679][T23888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6076'. [ 584.656103][T23888] netlink: 'syz.4.6076': attribute type 3 has an invalid length. [ 584.960965][T23895] netlink: 76 bytes leftover after parsing attributes in process `syz.1.6078'. [ 585.066595][ T51] Bluetooth: hci4: command tx timeout [ 585.170385][T23911] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6080'. [ 585.180488][T23911] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6080'. [ 585.279666][ T6396] IPVS: stop unused estimator thread 0... [ 585.674470][T23674] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 585.705884][T23674] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 585.719474][T23674] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 585.739864][T23948] FAULT_INJECTION: forcing a failure. [ 585.739864][T23948] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 585.757805][T23948] CPU: 0 UID: 0 PID: 23948 Comm: syz.3.6087 Not tainted syzkaller #0 PREEMPT(full) [ 585.757832][T23948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 585.757844][T23948] Call Trace: [ 585.757852][T23948] [ 585.757860][T23948] dump_stack_lvl+0xe8/0x150 [ 585.757892][T23948] should_fail_ex+0x412/0x560 [ 585.757924][T23948] _copy_from_iter+0x1d3/0x1670 [ 585.757945][T23948] ? trace_kmem_cache_alloc+0x29/0xf0 [ 585.757976][T23948] ? __pfx__copy_from_iter+0x10/0x10 [ 585.757997][T23948] ? alloc_pages_noprof+0xbd/0x1a0 [ 585.758022][T23948] ? skb_page_frag_refill+0x199/0x310 [ 585.758057][T23948] tcp_sendmsg_locked+0x2151/0x5490 [ 585.758146][T23948] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 585.758179][T23948] ? tcp_sendmsg+0x21/0x50 [ 585.758207][T23948] ? __local_bh_enable_ip+0xd0/0x130 [ 585.758234][T23948] tcp_sendmsg+0x2f/0x50 [ 585.758259][T23948] ____sys_sendmsg+0x80a/0x9f0 [ 585.758281][T23948] ? __lock_acquire+0x6b5/0x2cf0 [ 585.758313][T23948] ? __pfx_____sys_sendmsg+0x10/0x10 [ 585.758345][T23948] ? import_iovec+0x73/0xa0 [ 585.758371][T23948] ___sys_sendmsg+0x2a5/0x360 [ 585.758398][T23948] ? __pfx____sys_sendmsg+0x10/0x10 [ 585.758467][T23948] __sys_sendmmsg+0x27c/0x4e0 [ 585.758502][T23948] ? __pfx___sys_sendmmsg+0x10/0x10 [ 585.758523][T23948] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 585.758575][T23948] ? ksys_write+0x242/0x270 [ 585.758598][T23948] ? __pfx_ksys_write+0x10/0x10 [ 585.758625][T23948] __x64_sys_sendmmsg+0xa0/0xc0 [ 585.758652][T23948] do_syscall_64+0x14d/0xf80 [ 585.758676][T23948] ? trace_irq_disable+0x3b/0x150 [ 585.758693][T23948] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.758712][T23948] ? clear_bhb_loop+0x40/0x90 [ 585.758734][T23948] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.758752][T23948] RIP: 0033:0x7ff451b9c819 [ 585.758770][T23948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 585.758785][T23948] RSP: 002b:00007ff452adf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 585.758806][T23948] RAX: ffffffffffffffda RBX: 00007ff451e15fa0 RCX: 00007ff451b9c819 [ 585.758818][T23948] RDX: 0000000000000002 RSI: 0000200000000700 RDI: 0000000000000003 [ 585.758829][T23948] RBP: 00007ff452adf090 R08: 0000000000000000 R09: 0000000000000000 [ 585.758840][T23948] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 585.758851][T23948] R13: 00007ff451e16038 R14: 00007ff451e15fa0 R15: 00007ffdc6250b68 [ 585.758880][T23948] [ 585.765340][T23674] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 586.040579][T23958] netlink: 'syz.4.6091': attribute type 1 has an invalid length. [ 586.071114][T23674] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 586.105231][T23674] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 586.173259][T23674] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 586.189455][T23674] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 586.218363][T23967] bond1: (slave bridge2): making interface the new active one [ 586.229825][T23967] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 586.557855][T23674] 8021q: adding VLAN 0 to HW filter on device bond0 [ 586.588549][T23674] 8021q: adding VLAN 0 to HW filter on device team0 [ 586.631782][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 586.638994][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 586.668592][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 586.675787][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 587.039681][T23674] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 587.065703][ T91] net_ratelimit: 2050 callbacks suppressed [ 587.065721][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 587.104256][T23674] veth0_vlan: entered promiscuous mode [ 587.126013][T23674] veth1_vlan: entered promiscuous mode [ 587.141234][ T51] Bluetooth: hci4: command tx timeout [ 587.169206][T23674] veth0_macvtap: entered promiscuous mode [ 587.187315][T23674] veth1_macvtap: entered promiscuous mode [ 587.210995][T23674] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.244489][T23674] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.260142][ T6396] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.278052][ T6396] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.320288][ T6396] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.336989][ T6396] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.105811][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.141450][ T5830] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.149630][ T91] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.301534][ T1209] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.443133][T23988] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 589.595566][ T6396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.625056][ T6396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.713412][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 589.740943][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 589.782318][ T5830] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.845983][T24072] __nla_validate_parse: 4 callbacks suppressed [ 589.846004][T24072] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6104'. [ 589.861589][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5580 ms [ 589.861622][ C0] lec:lec_tx_timeout: lec0 [ 589.874736][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 590.316990][T24091] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6110'. [ 590.352765][T24090] syzkaller0: entered promiscuous mode [ 590.358627][T24090] syzkaller0: entered allmulticast mode [ 590.484766][T24098] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6113'. [ 590.714864][T22325] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 590.727796][T22325] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 590.741203][T22325] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 590.749338][T22325] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 590.761206][T22325] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 590.906701][T24102] wg1 speed is unknown, defaulting to 1000 [ 590.926036][T24102] lo speed is unknown, defaulting to 1000 [ 590.972565][T24099] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6114'. [ 591.076885][T24099] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6114'. [ 591.096810][T24108] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6116'. [ 591.242969][T24113] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.6118'. [ 591.386547][T24102] chnl_net:caif_netlink_parms(): no params data found [ 591.431925][T24123] netlink: 'syz.3.6120': attribute type 1 has an invalid length. [ 591.535446][T24132] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6124'. [ 591.559799][T24132] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6124'. [ 591.567702][T24126] gretap1: entered promiscuous mode [ 591.569955][T24132] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6124'. [ 591.585984][T24126] batman_adv: batadv0: Adding interface: gretap1 [ 591.601193][T24126] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 591.656622][T24126] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 591.759170][T24102] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.766939][T24129] netlink: 'syz.0.6121': attribute type 9 has an invalid length. [ 591.780058][T24102] bridge0: port 1(bridge_slave_0) entered disabled state [ 591.797236][T24102] bridge_slave_0: entered allmulticast mode [ 591.812527][T24102] bridge_slave_0: entered promiscuous mode [ 591.842984][T24102] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.890903][T24102] bridge0: port 2(bridge_slave_1) entered disabled state [ 591.898395][T24102] bridge_slave_1: entered allmulticast mode [ 592.105621][T24102] bridge_slave_1: entered promiscuous mode [ 592.337894][T24102] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 592.440350][T24102] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 592.562178][T24102] team0: Port device team_slave_0 added [ 592.579558][T24102] team0: Port device team_slave_1 added [ 592.694027][T24102] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 592.710342][T24102] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.749387][T24102] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 592.782713][T24102] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 592.789687][T24102] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 592.828565][ T51] Bluetooth: hci1: command tx timeout [ 592.836883][T24102] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 592.960334][T24184] syzkaller1: entered promiscuous mode [ 592.979141][T24184] syzkaller1: entered allmulticast mode [ 593.133650][T24102] hsr_slave_0: entered promiscuous mode [ 593.149982][T24102] hsr_slave_1: entered promiscuous mode [ 593.169974][T24102] debugfs: 'hsr0' already exists in 'hsr' [ 593.176326][T24102] Cannot create hsr debugfs directory [ 593.227555][T24207] wg1 speed is unknown, defaulting to 1000 [ 593.238198][T24214] IPv6: sit1: Disabled Multicast RS [ 593.267377][T24207] lo speed is unknown, defaulting to 1000 [ 593.594932][T24102] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.609868][T24102] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.907211][T24102] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.934624][T24102] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.067685][T24102] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.098596][T24102] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.252781][T24102] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 594.282033][T24102] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.336325][T24263] openvswitch: netlink: IPv4 tun info is not correct [ 594.505316][T24275] netlink: 'syz.4.6163': attribute type 1 has an invalid length. [ 594.611985][T24102] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 594.638679][T24102] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 594.683115][T24287] netlink: 'syz.0.6165': attribute type 1 has an invalid length. [ 594.720391][T24102] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 594.746347][T24102] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 594.762027][T24290] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 594.780585][T24284] syzkaller0: entered promiscuous mode [ 594.793858][T24102] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 594.825763][T24102] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 594.851180][T24298] netlink: 'syz.4.6169': attribute type 32 has an invalid length. [ 594.859210][T24298] __nla_validate_parse: 8 callbacks suppressed [ 594.859228][T24298] netlink: 776 bytes leftover after parsing attributes in process `syz.4.6169'. [ 594.886285][T24298] netlink: 196 bytes leftover after parsing attributes in process `syz.4.6169'. [ 594.891894][T24102] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 594.902356][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 594.902382][ T51] Bluetooth: hci1: command tx timeout [ 594.902386][ C0] lec:lec_tx_timeout: lec0 [ 594.906742][T24298] netlink: 'syz.4.6169': attribute type 19 has an invalid length. [ 594.910506][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 594.918560][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 594.954892][T24102] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 594.968646][T24298] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6169'. [ 595.055170][T24298] bond2: option lp_interval: invalid value (0) [ 595.075295][T24298] bond2: option lp_interval: allowed values 1 - 2147483647 [ 595.107638][T24298] bond2 (unregistering): Released all slaves [ 595.149702][T24316] netlink: 'syz.2.6174': attribute type 72 has an invalid length. [ 595.333785][T24102] 8021q: adding VLAN 0 to HW filter on device bond0 [ 595.389159][T24102] 8021q: adding VLAN 0 to HW filter on device team0 [ 595.409683][T24332] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.416988][T24332] bridge0: port 1(bridge_slave_0) entered forwarding state [ 595.447369][T24332] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.452694][ T91] IPVS: starting estimator thread 0... [ 595.454537][T24332] bridge0: port 2(bridge_slave_1) entered forwarding state [ 595.470369][T24329] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 595.495735][T24337] netlink: 'syz.0.6180': attribute type 1 has an invalid length. [ 595.531144][T24340] netlink: 'syz.0.6180': attribute type 1 has an invalid length. [ 595.560842][T24336] IPVS: using max 35 ests per chain, 84000 per kthread [ 595.712861][T24352] netlink: 'syz.0.6185': attribute type 72 has an invalid length. [ 595.907292][T24102] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 596.014834][T24102] veth0_vlan: entered promiscuous mode [ 596.048434][T24102] veth1_vlan: entered promiscuous mode [ 596.133175][T24102] veth0_macvtap: entered promiscuous mode [ 596.162912][T24102] veth1_macvtap: entered promiscuous mode [ 596.179328][T24376] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 596.203152][ T5830] IPVS: starting estimator thread 0... [ 596.224493][T24102] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 596.268157][T24102] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 596.295281][ T6396] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.304907][ T6396] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.328880][ T6396] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.341084][T24382] IPVS: using max 31 ests per chain, 74400 per kthread [ 596.654730][T24390] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 596.691324][ T6396] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 596.909847][ T6396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 596.937216][ T6396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 596.981259][ T51] Bluetooth: hci1: command tx timeout [ 597.051515][T24331] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 597.070737][T24331] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.454549][T24421] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.6204'. [ 597.584218][T24428] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 597.797642][T24442] netlink: zone id is out of range [ 597.834045][T24442] netlink: zone id is out of range [ 597.839477][T24442] netlink: zone id is out of range [ 597.849386][T24442] netlink: zone id is out of range [ 597.860414][T24442] netlink: zone id is out of range [ 597.879262][T24442] netlink: zone id is out of range [ 598.028631][T24461] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.6217'. [ 598.221206][T24468] netlink: 'syz.1.6221': attribute type 1 has an invalid length. [ 598.503091][T24480] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6226'. [ 598.581841][T24481] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6226'. [ 598.593250][T24480] F: renamed from gre0 [ 598.625797][T24480] F: entered allmulticast mode [ 598.922105][T24494] netlink: 1752 bytes leftover after parsing attributes in process `syz.0.6231'. [ 599.062415][ T51] Bluetooth: hci1: command tx timeout [ 599.485231][T24538] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6244'. [ 599.835293][T24545] syzkaller0: entered promiscuous mode [ 599.841055][T24545] syzkaller0: entered allmulticast mode [ 599.853904][T24545] tcf_pedit_act: 7 callbacks suppressed [ 599.853922][T24545] tc action pedit 'at' offset 257 out of bounds [ 599.920774][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 599.928844][ C0] lec:lec_tx_timeout: lec0 [ 599.935033][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 600.012553][T24552] x_tables: duplicate underflow at hook 3 [ 600.210582][T24554] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6251'. [ 600.245964][T24564] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6255'. [ 600.255211][T24564] netlink: 6 bytes leftover after parsing attributes in process `syz.2.6255'. [ 600.307364][T24573] netlink: 294 bytes leftover after parsing attributes in process `syz.0.6256'. [ 600.316878][T24573] net_ratelimit: 57 callbacks suppressed [ 600.316896][T24573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 600.457843][T24580] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6258'. [ 600.481291][T24582] netlink: 76 bytes leftover after parsing attributes in process `syz.4.6261'. [ 600.504110][T24582] syzkaller0: entered promiscuous mode [ 600.509621][T24582] syzkaller0: entered allmulticast mode [ 600.824376][T24602] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6268'. [ 601.022278][T24617] netlink: 'syz.0.6272': attribute type 10 has an invalid length. [ 601.066919][T24620] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6276'. [ 601.084234][T24620] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6276'. [ 601.155522][T24622] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 601.163253][ T47] IPVS: starting estimator thread 0... [ 601.208912][T24635] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6279'. [ 601.251271][T24631] IPVS: using max 35 ests per chain, 84000 per kthread [ 604.050895][T24620] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 604.199344][T24645] netlink: 'syz.0.6282': attribute type 7 has an invalid length. [ 604.345709][T24654] veth3: entered allmulticast mode [ 604.950684][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 604.958762][ C0] lec:lec_tx_timeout: lec0 [ 604.963692][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 604.969976][ T5830] IPVS: starting estimator thread 0... [ 605.291529][T24685] IPVS: using max 39 ests per chain, 93600 per kthread [ 605.368794][T24702] __nla_validate_parse: 4 callbacks suppressed [ 605.368814][T24702] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6304'. [ 605.404392][T24700] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6302'. [ 605.611629][T24718] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 605.612829][T24716] netlink: 'syz.0.6309': attribute type 1 has an invalid length. [ 606.145037][T24752] netlink: 'syz.0.6323': attribute type 17 has an invalid length. [ 606.164793][T24752] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6323'. [ 606.187810][T24752] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6323'. [ 606.215354][T24754] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 606.251715][T22325] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 606.263139][T22325] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 606.272696][T22325] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 606.284238][T22325] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 606.291994][T22325] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 606.339288][T24755] wg1 speed is unknown, defaulting to 1000 [ 606.346782][T24755] lo speed is unknown, defaulting to 1000 [ 606.386817][T24758] netlink: 'syz.4.6325': attribute type 1 has an invalid length. [ 606.434843][T24761] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6326'. [ 606.448412][T24758] netlink: 'syz.4.6325': attribute type 1 has an invalid length. [ 606.456892][T24758] netlink: 'syz.4.6325': attribute type 3 has an invalid length. [ 606.477513][T24758] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6325'. [ 606.498001][T24758] NCSI netlink: No device for ifindex 813332851 [ 606.763566][T24755] chnl_net:caif_netlink_parms(): no params data found [ 606.886077][T24788] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 606.932340][T24755] bridge0: port 1(bridge_slave_0) entered blocking state [ 606.939682][T24755] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.947652][T24755] bridge_slave_0: entered allmulticast mode [ 606.955670][T24755] bridge_slave_0: entered promiscuous mode [ 606.970377][T24755] bridge0: port 2(bridge_slave_1) entered blocking state [ 606.977749][T24755] bridge0: port 2(bridge_slave_1) entered disabled state [ 606.985837][T24755] bridge_slave_1: entered allmulticast mode [ 606.996931][T24755] bridge_slave_1: entered promiscuous mode [ 607.084444][T24755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 607.096811][T24755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 607.143875][T24755] team0: Port device team_slave_0 added [ 607.175441][T24755] team0: Port device team_slave_1 added [ 607.279082][T24755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 607.297737][T24755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 607.339152][T24755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 607.352980][T24807] ¾x9ÿ: renamed from bridge_slave_0 (while UP) [ 607.371769][T24755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 607.390755][T24755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 607.443402][T24755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 607.469181][T24818] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 607.491300][T24820] tipc: Enabling of bearer rejected, failed to enable media [ 607.531131][T24825] reject_tg6_check: 55 callbacks suppressed [ 607.531152][T24825] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 607.603717][T24755] hsr_slave_0: entered promiscuous mode [ 607.610490][T24755] hsr_slave_1: entered promiscuous mode [ 607.642514][T24755] debugfs: 'hsr0' already exists in 'hsr' [ 607.653884][T24755] Cannot create hsr debugfs directory [ 608.128994][T24855] syzkaller0: entered promiscuous mode [ 608.345449][ T51] Bluetooth: hci0: command tx timeout [ 608.612546][T24898] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6375'. [ 608.625647][T24895] netlink: 'syz.4.6374': attribute type 1 has an invalid length. [ 608.635272][T24895] netlink: 'syz.4.6374': attribute type 12 has an invalid length. [ 608.643250][T24895] netlink: 'syz.4.6374': attribute type 29 has an invalid length. [ 608.651326][T24895] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6374'. [ 608.660388][T24895] netlink: 59 bytes leftover after parsing attributes in process `syz.4.6374'. [ 608.687289][T24755] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 608.699538][T24755] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 608.707778][T24755] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 608.719183][T24755] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 608.753192][T24755] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 608.772546][T24755] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 608.780362][T24755] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 608.819433][T24755] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 608.909810][T24909] syzkaller0: entered promiscuous mode [ 608.915588][T24909] syzkaller0: entered allmulticast mode [ 608.926795][T24919] netlink: 'syz.0.6381': attribute type 1 has an invalid length. [ 608.950755][T24919] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6381'. [ 609.152526][T24755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 609.162031][T24933] ipt_REJECT: ECHOREPLY no longer supported. [ 609.183857][T24933] ipt_REJECT: ECHOREPLY no longer supported. [ 609.234165][T24755] 8021q: adding VLAN 0 to HW filter on device team0 [ 609.273296][T24331] bridge0: port 1(bridge_slave_0) entered blocking state [ 609.280498][T24331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 609.310358][T24331] bridge0: port 2(bridge_slave_1) entered blocking state [ 609.317711][T24331] bridge0: port 2(bridge_slave_1) entered forwarding state [ 609.690014][T24971] vcan0: tx address claim with dlc 1 [ 609.772856][T24332] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.797288][T24980] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 609.807190][T24332] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.830143][T24332] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.839403][T24332] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 609.964761][T24988] FAULT_INJECTION: forcing a failure. [ 609.964761][T24988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 609.976479][T24975] netlink: 'syz.0.6400': attribute type 25 has an invalid length. [ 609.978074][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 609.993894][ C0] lec:lec_tx_timeout: lec0 [ 609.995110][T24755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 609.998806][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 610.030933][T24988] CPU: 1 UID: 0 PID: 24988 Comm: syz.1.6404 Not tainted syzkaller #0 PREEMPT(full) [ 610.030960][T24988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 610.030971][T24988] Call Trace: [ 610.030979][T24988] [ 610.030987][T24988] dump_stack_lvl+0xe8/0x150 [ 610.031018][T24988] should_fail_ex+0x412/0x560 [ 610.031050][T24988] _copy_from_user+0x2d/0xb0 [ 610.031072][T24988] nr_rt_ioctl+0x966/0xf90 [ 610.031106][T24988] ? kasan_quarantine_put+0xbb/0x1f0 [ 610.031127][T24988] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 610.031162][T24988] ? apparmor_capable+0x126/0x170 [ 610.031198][T24988] ? capable+0x88/0xe0 [ 610.031222][T24988] ? nr_ioctl+0x1b1/0x3b0 [ 610.031245][T24988] sock_do_ioctl+0x101/0x320 [ 610.031266][T24988] ? __pfx_sock_do_ioctl+0x10/0x10 [ 610.031282][T24988] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 610.031323][T24988] sock_ioctl+0x5c6/0x7f0 [ 610.031352][T24988] ? __pfx_sock_ioctl+0x10/0x10 [ 610.031378][T24988] ? __fget_files+0x2a/0x420 [ 610.031401][T24988] ? __fget_files+0x3a0/0x420 [ 610.031417][T24988] ? __fget_files+0x2a/0x420 [ 610.031437][T24988] ? bpf_lsm_file_ioctl+0x9/0x20 [ 610.031460][T24988] ? __pfx_sock_ioctl+0x10/0x10 [ 610.031486][T24988] __se_sys_ioctl+0xfc/0x170 [ 610.031510][T24988] do_syscall_64+0x14d/0xf80 [ 610.031534][T24988] ? trace_irq_disable+0x3b/0x150 [ 610.031550][T24988] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.031569][T24988] ? clear_bhb_loop+0x40/0x90 [ 610.031591][T24988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.031609][T24988] RIP: 0033:0x7fbaa379c819 [ 610.031627][T24988] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.031645][T24988] RSP: 002b:00007fbaa4670028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 610.031663][T24988] RAX: ffffffffffffffda RBX: 00007fbaa3a15fa0 RCX: 00007fbaa379c819 [ 610.031677][T24988] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000004 [ 610.031690][T24988] RBP: 00007fbaa4670090 R08: 0000000000000000 R09: 0000000000000000 [ 610.031701][T24988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.031713][T24988] R13: 00007fbaa3a16038 R14: 00007fbaa3a15fa0 R15: 00007ffd22b21908 [ 610.031743][T24988] [ 610.420253][T25001] ksmbd: Unknown IPC event: 3, ignore. [ 610.427302][ T51] Bluetooth: hci0: command tx timeout [ 610.498290][T24755] veth0_vlan: entered promiscuous mode [ 610.596452][T25007] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 610.681885][T24755] veth1_vlan: entered promiscuous mode [ 610.774756][T24755] veth0_macvtap: entered promiscuous mode [ 610.786726][T24755] veth1_macvtap: entered promiscuous mode [ 610.808816][T24755] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 610.843472][T25014] pimreg3: entered allmulticast mode [ 610.864512][T24755] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 610.895551][T25018] __nla_validate_parse: 2 callbacks suppressed [ 610.895572][T25018] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6413'. [ 610.903449][T24332] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.905155][T24332] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.966391][T24332] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.988711][T24332] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 611.105286][T25024] syzkaller0: entered promiscuous mode [ 611.122780][T25024] syzkaller0: entered allmulticast mode [ 611.144084][T24332] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 611.159906][T24332] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 611.285550][ T283] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 611.302546][ T283] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 611.484343][T25036] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 611.650119][T25045] netlink: 'syz.4.6424': attribute type 10 has an invalid length. [ 611.689814][T25045] vxcan1: entered promiscuous mode [ 611.695576][T25045] vxcan1: entered allmulticast mode [ 611.705581][T25045] team0: Device vxcan1 is of different type [ 611.738789][T25056] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6426'. [ 611.851040][T25059] syzkaller0: entered promiscuous mode [ 611.856551][T25059] syzkaller0: entered allmulticast mode [ 611.983309][T25073] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 612.032646][T25075] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6433'. [ 612.492779][T25080] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6435'. [ 612.501188][ T51] Bluetooth: hci0: command tx timeout [ 613.152663][T25101] macsec1: entered promiscuous mode [ 613.207987][T25105] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6442'. [ 613.236344][T25103] macsec1: entered promiscuous mode [ 613.665789][T25106] syzkaller0: entered promiscuous mode [ 613.697668][T25106] syzkaller0: entered allmulticast mode [ 613.903741][T25137] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6451'. [ 614.143586][T25153] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6455'. [ 614.239768][T25163] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6458'. [ 614.583168][ T51] Bluetooth: hci0: command tx timeout [ 615.022648][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 615.030713][ C0] lec:lec_tx_timeout: lec0 [ 615.035351][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 615.660304][T25147] erspan0: entered promiscuous mode [ 615.666094][T25147] erspan0: entered allmulticast mode [ 615.855420][T25177] netlink: 'syz.1.6462': attribute type 1 has an invalid length. [ 615.928340][T25177] bond1: entered promiscuous mode [ 615.936226][T25177] 8021q: adding VLAN 0 to HW filter on device bond1 [ 615.955504][T25189] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6464'. [ 615.966432][T25189] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6464'. [ 616.009360][T25187] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 616.024347][T25187] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 616.036634][T25187] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 616.047259][T25193] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6464'. [ 616.086494][T25193] bond0: (slave bond_slave_1): Releasing backup interface [ 616.121489][T25195] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6466'. [ 616.301425][T25204] Cannot find del_set index 0 as target [ 616.474496][T25218] syzkaller0: entered promiscuous mode [ 616.492993][T25204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6467'. [ 616.493081][T25218] syzkaller0: entered allmulticast mode [ 616.577478][T25227] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6475'. [ 617.314586][T25260] netlink: 204 bytes leftover after parsing attributes in process `syz.0.6487'. [ 617.318369][T25259] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6486'. [ 617.574318][T25272] syzkaller0: entered promiscuous mode [ 617.579896][T25272] syzkaller0: entered allmulticast mode [ 617.707210][T25276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6489'. [ 617.800777][T25280] netlink: 288 bytes leftover after parsing attributes in process `syz.3.6491'. [ 617.812549][T25278] openvswitch: netlink: IP tunnel dst address not specified [ 617.883267][T25282] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 617.921340][T25282] bond0: (slave lo): Error: Device can not be enslaved while up [ 618.024059][T25291] bridge0: port 3(team0) entered disabled state [ 618.030618][T25291] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.037993][T25291] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.173121][T25298] syzkaller1: entered promiscuous mode [ 618.178721][T25298] syzkaller1: entered allmulticast mode [ 618.205470][T25298] af_packet: tpacket_rcv: packet too big, clamped from 64993 to 3944. macoff=96 [ 618.236751][T25302] bridge1: entered promiscuous mode [ 618.243202][T25302] bridge1: entered allmulticast mode [ 618.254817][T25302] team0: Port device bridge1 added [ 618.336648][T25302] bridge0: port 3(team0) entered blocking state [ 618.351962][T25302] bridge0: port 3(team0) entered disabled state [ 618.358935][T25302] team0: entered allmulticast mode [ 618.396491][T25302] team_slave_0: entered allmulticast mode [ 618.407167][T25302] team_slave_1: entered allmulticast mode [ 618.417311][T25302] team0: entered promiscuous mode [ 618.424628][T25302] team_slave_0: entered promiscuous mode [ 618.448826][T25302] team_slave_1: entered promiscuous mode [ 618.459358][T25302] bridge0: port 3(team0) entered blocking state [ 618.465889][T25302] bridge0: port 3(team0) entered forwarding state [ 618.473821][ T6396] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 618.565463][T25308] syzkaller0: entered promiscuous mode [ 618.571349][T25308] syzkaller0: entered allmulticast mode [ 618.578682][ T6396] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 618.605217][ T6396] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 618.684364][T25317] bond0: entered promiscuous mode [ 618.721230][T25317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 618.772111][ T6396] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 618.794517][T25317] Bluetooth: MGMT ver 1.23 [ 619.045059][T25344] FAULT_INJECTION: forcing a failure. [ 619.045059][T25344] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 619.059091][T25344] CPU: 0 UID: 0 PID: 25344 Comm: syz.1.6510 Not tainted syzkaller #0 PREEMPT(full) [ 619.059118][T25344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 619.059129][T25344] Call Trace: [ 619.059136][T25344] [ 619.059143][T25344] dump_stack_lvl+0xe8/0x150 [ 619.059172][T25344] should_fail_ex+0x412/0x560 [ 619.059204][T25344] _copy_from_user+0x2d/0xb0 [ 619.059227][T25344] nr_rt_ioctl+0x966/0xf90 [ 619.059259][T25344] ? kasan_quarantine_put+0xbb/0x1f0 [ 619.059277][T25344] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 619.059306][T25344] ? apparmor_capable+0x126/0x170 [ 619.059331][T25344] ? capable+0x88/0xe0 [ 619.059351][T25344] ? nr_ioctl+0x1b1/0x3b0 [ 619.059370][T25344] sock_do_ioctl+0x101/0x320 [ 619.059390][T25344] ? __pfx_sock_do_ioctl+0x10/0x10 [ 619.059406][T25344] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 619.059444][T25344] sock_ioctl+0x5c6/0x7f0 [ 619.059471][T25344] ? __pfx_sock_ioctl+0x10/0x10 [ 619.059496][T25344] ? __fget_files+0x2a/0x420 [ 619.059511][T25344] ? __fget_files+0x3a0/0x420 [ 619.059526][T25344] ? __fget_files+0x2a/0x420 [ 619.059544][T25344] ? bpf_lsm_file_ioctl+0x9/0x20 [ 619.059568][T25344] ? __pfx_sock_ioctl+0x10/0x10 [ 619.059592][T25344] __se_sys_ioctl+0xfc/0x170 [ 619.059614][T25344] do_syscall_64+0x14d/0xf80 [ 619.059637][T25344] ? trace_irq_disable+0x3b/0x150 [ 619.059653][T25344] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.059683][T25344] ? clear_bhb_loop+0x40/0x90 [ 619.059703][T25344] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.059722][T25344] RIP: 0033:0x7fbaa379c819 [ 619.059749][T25344] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 619.059764][T25344] RSP: 002b:00007fbaa4670028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 619.059781][T25344] RAX: ffffffffffffffda RBX: 00007fbaa3a15fa0 RCX: 00007fbaa379c819 [ 619.059793][T25344] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000004 [ 619.059803][T25344] RBP: 00007fbaa4670090 R08: 0000000000000000 R09: 0000000000000000 [ 619.059812][T25344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 619.059821][T25344] R13: 00007fbaa3a16038 R14: 00007fbaa3a15fa0 R15: 00007ffd22b21908 [ 619.059846][T25344] [ 620.054383][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 620.062575][ C0] lec:lec_tx_timeout: lec0 [ 620.067606][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 620.775535][T25327] : entered promiscuous mode [ 620.943377][T16656] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.964026][T16656] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 620.987503][T25379] __nla_validate_parse: 6 callbacks suppressed [ 620.987523][T25379] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6515'. [ 621.130520][T25386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6519'. [ 621.158769][T25386] netlink: 'syz.1.6519': attribute type 6 has an invalid length. [ 621.183106][T16656] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.192261][T16656] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 621.205854][T25377] netlink: 'syz.3.6514': attribute type 1 has an invalid length. [ 621.214903][T25377] netlink: 'syz.3.6514': attribute type 2 has an invalid length. [ 621.223473][T25377] netlink: 'syz.3.6514': attribute type 1 has an invalid length. [ 621.231795][T25377] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6514'. [ 621.240170][T25382] bridge1: entered promiscuous mode [ 621.265260][T25382] bridge1: entered allmulticast mode [ 621.288137][T25382] team0: Port device bridge1 added [ 621.304901][T25385] bridge0: port 3(team0) entered blocking state [ 621.312057][T25385] bridge0: port 3(team0) entered disabled state [ 621.325835][T25385] team0: entered allmulticast mode [ 621.331444][T25385] team_slave_0: entered allmulticast mode [ 621.337369][T25385] team_slave_1: entered allmulticast mode [ 621.369870][T25385] team0: entered promiscuous mode [ 621.386540][T25385] team_slave_0: entered promiscuous mode [ 621.402585][T25385] team_slave_1: entered promiscuous mode [ 621.417073][T25385] bridge0: port 3(team0) entered blocking state [ 621.423499][T25385] bridge0: port 3(team0) entered forwarding state [ 621.637352][T25404] syzkaller0: entered promiscuous mode [ 621.679558][T25404] syzkaller0: entered allmulticast mode [ 621.969573][T25431] bridge2: entered promiscuous mode [ 621.982163][T25431] bridge2: entered allmulticast mode [ 622.002535][T25431] team0: Port device bridge2 added [ 622.084519][T25440] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6538'. [ 622.231233][T25444] netlink: 'syz.2.6541': attribute type 11 has an invalid length. [ 622.264018][T25444] gretap1: entered promiscuous mode [ 622.292353][T25444] batman_adv: batadv0: Adding interface: gretap1 [ 622.311786][T25444] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 622.341905][T25444] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 622.376134][T25456] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 622.458338][T25455] syzkaller0: entered promiscuous mode [ 622.464261][T25455] syzkaller0: entered allmulticast mode [ 622.635779][T25469] bridge2: entered promiscuous mode [ 622.642072][T25469] bridge2: entered allmulticast mode [ 622.650444][T25469] team0: Port device bridge2 added [ 622.786091][T25474] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6554'. [ 623.084066][T25497] netlink: 'syz.4.6561': attribute type 4 has an invalid length. [ 623.120326][T25497] netlink: 152 bytes leftover after parsing attributes in process `syz.4.6561'. [ 623.163792][T25497] .`: renamed from bond0 (while UP) [ 623.334459][T25512] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6565'. [ 623.517414][T25534] FAULT_INJECTION: forcing a failure. [ 623.517414][T25534] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 623.605294][T25534] CPU: 1 UID: 0 PID: 25534 Comm: syz.0.6573 Not tainted syzkaller #0 PREEMPT(full) [ 623.605321][T25534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 623.605333][T25534] Call Trace: [ 623.605340][T25534] [ 623.605349][T25534] dump_stack_lvl+0xe8/0x150 [ 623.605380][T25534] should_fail_ex+0x412/0x560 [ 623.605413][T25534] _copy_to_user+0x31/0xb0 [ 623.605438][T25534] simple_read_from_buffer+0xe1/0x170 [ 623.605468][T25534] proc_fail_nth_read+0x1bb/0x230 [ 623.605498][T25534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 623.605527][T25534] ? rw_verify_area+0x2a6/0x4d0 [ 623.605547][T25534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 623.605574][T25534] vfs_read+0x20c/0xa70 [ 623.605592][T25534] ? fdget_pos+0x246/0x320 [ 623.605614][T25534] ? __pfx___mutex_lock+0x10/0x10 [ 623.605647][T25534] ? __pfx_vfs_read+0x10/0x10 [ 623.605668][T25534] ? __fget_files+0x2a/0x420 [ 623.605689][T25534] ? __fget_files+0x3a0/0x420 [ 623.605705][T25534] ? __fget_files+0x2a/0x420 [ 623.605730][T25534] ksys_read+0x150/0x270 [ 623.605753][T25534] ? __pfx_ksys_read+0x10/0x10 [ 623.605773][T25534] ? __pfx_sock_ioctl+0x10/0x10 [ 623.605809][T25534] do_syscall_64+0x14d/0xf80 [ 623.605833][T25534] ? trace_irq_disable+0x3b/0x150 [ 623.605849][T25534] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.605869][T25534] ? clear_bhb_loop+0x40/0x90 [ 623.605892][T25534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.605910][T25534] RIP: 0033:0x7fb71dd5d04e [ 623.605928][T25534] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 623.605945][T25534] RSP: 002b:00007fb71ec17fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 623.605966][T25534] RAX: ffffffffffffffda RBX: 00007fb71ec186c0 RCX: 00007fb71dd5d04e [ 623.605979][T25534] RDX: 000000000000000f RSI: 00007fb71ec180a0 RDI: 0000000000000003 [ 623.605991][T25534] RBP: 00007fb71ec18090 R08: 0000000000000000 R09: 0000000000000000 [ 623.606004][T25534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 623.606015][T25534] R13: 00007fb71e016038 R14: 00007fb71e015fa0 R15: 00007ffdd6bbced8 [ 623.606045][T25534] [ 623.953157][T25542] syzkaller0: entered promiscuous mode [ 623.958708][T25542] syzkaller0: entered allmulticast mode [ 623.996112][T25542] netlink: 32 bytes leftover after parsing attributes in process `syz.4.6575'. [ 624.082649][T25548] vlan2: entered promiscuous mode [ 624.108648][T25548] bridge0: entered promiscuous mode [ 624.212947][T25557] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6582'. [ 624.357409][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.365775][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.644481][T25586] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6593'. [ 624.843653][T25594] syzkaller0: entered promiscuous mode [ 624.862624][T25594] syzkaller0: entered allmulticast mode [ 625.528570][T25610] xt_ipcomp: unknown flags 1D [ 625.860666][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 625.868752][ C0] lec:lec_tx_timeout: lec0 [ 625.873942][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 626.281999][T25641] __nla_validate_parse: 1 callbacks suppressed [ 626.282019][T25641] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6606'. [ 626.339335][T25637] syzkaller0: entered promiscuous mode [ 626.351650][T25637] syzkaller0: entered allmulticast mode [ 626.369276][T25643] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6608'. [ 626.385035][T25643] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6608'. [ 626.455004][T25645] bridge0: port 3(team0) entered blocking state [ 626.462434][T25645] bridge0: port 3(team0) entered disabled state [ 626.469752][T25645] team0: entered allmulticast mode [ 626.479856][T25645] team_slave_0: entered allmulticast mode [ 626.493175][T25645] team_slave_1: entered allmulticast mode [ 626.501907][T25645] team0: entered promiscuous mode [ 626.507468][T25645] team_slave_0: entered promiscuous mode [ 626.514267][T25645] team_slave_1: entered promiscuous mode [ 626.526910][T25645] bridge0: port 3(team0) entered blocking state [ 626.533426][T25645] bridge0: port 3(team0) entered forwarding state [ 626.591717][T25649] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6610'. [ 626.661019][T25653] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6611'. [ 628.400161][T25673] netlink: 64985 bytes leftover after parsing attributes in process `syz.0.6614'. [ 628.674167][T25685] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6618'. [ 628.745247][T25685] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6618'. [ 628.769641][T25698] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6623'. [ 628.906642][T25702] vlan2: entered promiscuous mode [ 628.913746][T25702] bridge0: entered promiscuous mode [ 628.973182][T25705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6628'. [ 629.009468][T25708] netlink: 'syz.2.6629': attribute type 10 has an invalid length. [ 629.053428][T25708] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 629.095117][T25705] bridge_slave_0: left allmulticast mode [ 629.103310][T25705] bridge_slave_0: left promiscuous mode [ 629.109194][T25705] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.144636][T25705] bridge_slave_1: left allmulticast mode [ 629.150480][T25705] bridge_slave_1: left promiscuous mode [ 629.156487][T25707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 629.167109][T25705] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.213849][T25705] bond0: (slave bond_slave_0): Releasing backup interface [ 629.235597][T25705] team0: Port device team_slave_0 removed [ 629.250232][T25705] team0: Port device team_slave_1 removed [ 629.265159][T25705] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 629.273527][T25705] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 629.283252][T25705] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 629.291593][T25705] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 629.307521][T25705] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 629.367815][T25723] netlink: 'syz.4.6631': attribute type 29 has an invalid length. [ 629.523714][T25731] netlink: 'syz.4.6634': attribute type 2 has an invalid length. [ 629.939773][ C1] vcan0: j1939_tp_rxtimer: 0xffff888032eac800: rx timeout, send abort [ 629.950218][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801dbd2800: rx timeout, send abort [ 630.449144][ C1] vcan0: j1939_tp_rxtimer: 0xffff888032eac800: abort rx timeout. Force session deactivation [ 630.461005][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801dbd2800: abort rx timeout. Force session deactivation [ 630.900962][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 630.909061][ C0] lec:lec_tx_timeout: lec0 [ 630.913896][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 631.057928][T25814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 631.121817][T25814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 631.197062][T25814] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 631.654683][T25839] netlink: 'syz.3.6669': attribute type 10 has an invalid length. [ 631.660860][T25840] netlink: 'syz.3.6669': attribute type 10 has an invalid length. [ 631.669354][T25839] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 631.754141][T25844] netlink: 'syz.2.6671': attribute type 11 has an invalid length. [ 631.764444][T25844] __nla_validate_parse: 5 callbacks suppressed [ 631.764465][T25844] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6671'. [ 631.809116][T25848] netlink: 68 bytes leftover after parsing attributes in process `syz.0.6672'. [ 631.812341][T25844] netlink: 'syz.2.6671': attribute type 11 has an invalid length. [ 631.819001][ T1097] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.845067][ T1097] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.854705][T25844] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6671'. [ 631.909186][ T1097] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 631.939023][ T1097] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 632.179924][T25871] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6681'. [ 632.334938][ T5830] IPVS: starting estimator thread 0... [ 632.343023][T25877] FAULT_INJECTION: forcing a failure. [ 632.343023][T25877] name failslab, interval 1, probability 0, space 0, times 0 [ 632.380746][T25883] FAULT_INJECTION: forcing a failure. [ 632.380746][T25883] name failslab, interval 1, probability 0, space 0, times 0 [ 632.384363][T25877] CPU: 0 UID: 0 PID: 25877 Comm: syz.3.6682 Not tainted syzkaller #0 PREEMPT(full) [ 632.384389][T25877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 632.384400][T25877] Call Trace: [ 632.384408][T25877] [ 632.384416][T25877] dump_stack_lvl+0xe8/0x150 [ 632.384445][T25877] should_fail_ex+0x412/0x560 [ 632.384477][T25877] should_failslab+0xa8/0x100 [ 632.384502][T25877] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 632.384525][T25877] ? __alloc_skb+0x1d0/0x7d0 [ 632.384545][T25877] ? __local_bh_enable_ip+0xd0/0x130 [ 632.384572][T25877] __alloc_skb+0x1d0/0x7d0 [ 632.384599][T25877] ctrl_getfamily+0x3d0/0x5c0 [ 632.384625][T25877] ? __pfx_ctrl_getfamily+0x10/0x10 [ 632.384649][T25877] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 632.384684][T25877] genl_family_rcv_msg_doit+0x22a/0x330 [ 632.384708][T25877] ? __asan_memcpy+0x40/0x70 [ 632.384729][T25877] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 632.384774][T25877] genl_rcv_msg+0x61c/0x7a0 [ 632.384879][T25877] ? __pfx_genl_rcv_msg+0x10/0x10 [ 632.384904][T25877] ? __pfx_ctrl_getfamily+0x10/0x10 [ 632.384927][T25877] ? __lock_acquire+0x6b5/0x2cf0 [ 632.384961][T25877] netlink_rcv_skb+0x232/0x4b0 [ 632.384982][T25877] ? __pfx_genl_rcv_msg+0x10/0x10 [ 632.385007][T25877] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 632.385043][T25877] ? down_read+0x272/0x2e0 [ 632.385058][T25877] ? genl_rcv+0xd/0x40 [ 632.385082][T25877] genl_rcv+0x28/0x40 [ 632.385105][T25877] netlink_unicast+0x80f/0x9b0 [ 632.385131][T25877] ? __pfx_netlink_unicast+0x10/0x10 [ 632.385151][T25877] ? netlink_sendmsg+0x650/0xb40 [ 632.385169][T25877] ? skb_put+0x11b/0x210 [ 632.385193][T25877] netlink_sendmsg+0x813/0xb40 [ 632.385223][T25877] ? __pfx_netlink_sendmsg+0x10/0x10 [ 632.385247][T25877] ? aa_sock_msg_perm+0xf1/0x1b0 [ 632.385274][T25877] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 632.385296][T25877] ? __pfx_netlink_sendmsg+0x10/0x10 [ 632.385318][T25877] __sys_sendto+0x672/0x710 [ 632.385343][T25877] ? __pfx___sys_sendto+0x10/0x10 [ 632.385361][T25877] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 632.385399][T25877] ? __fget_files+0x3a0/0x420 [ 632.385427][T25877] ? ksys_write+0x242/0x270 [ 632.385456][T25877] ? __pfx_ksys_write+0x10/0x10 [ 632.385482][T25877] __x64_sys_sendto+0xde/0x100 [ 632.385508][T25877] do_syscall_64+0x14d/0xf80 [ 632.385532][T25877] ? trace_irq_disable+0x3b/0x150 [ 632.385549][T25877] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.385568][T25877] ? clear_bhb_loop+0x40/0x90 [ 632.385590][T25877] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.385609][T25877] RIP: 0033:0x7fbdc1d5d04e [ 632.385638][T25877] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 632.385654][T25877] RSP: 002b:00007fbdc2c84e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 632.385674][T25877] RAX: ffffffffffffffda RBX: 00007fbdc2c866c0 RCX: 00007fbdc1d5d04e [ 632.385688][T25877] RDX: 0000000000000020 RSI: 00007fbdc2c85000 RDI: 0000000000000006 [ 632.385700][T25877] RBP: 0000000000000000 R08: 00007fbdc2c84f04 R09: 000000000000000c [ 632.385712][T25877] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 632.385723][T25877] R13: 00007fbdc2c84f58 R14: 00007fbdc2c85000 R15: 0000000000000000 [ 632.385753][T25877] [ 632.661505][T25879] IPVS: using max 31 ests per chain, 74400 per kthread [ 632.680146][T25883] CPU: 1 UID: 0 PID: 25883 Comm: syz.2.6684 Not tainted syzkaller #0 PREEMPT(full) [ 632.680171][T25883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 632.680182][T25883] Call Trace: [ 632.680189][T25883] [ 632.680198][T25883] dump_stack_lvl+0xe8/0x150 [ 632.680227][T25883] should_fail_ex+0x412/0x560 [ 632.680258][T25883] should_failslab+0xa8/0x100 [ 632.680284][T25883] __kmalloc_noprof+0xe8/0x760 [ 632.680305][T25883] ? tomoyo_encode+0x28b/0x550 [ 632.680328][T25883] tomoyo_encode+0x28b/0x550 [ 632.680351][T25883] tomoyo_realpath_from_path+0x58d/0x5d0 [ 632.680379][T25883] ? tomoyo_path_number_perm+0x219/0x630 [ 632.680404][T25883] tomoyo_path_number_perm+0x246/0x630 [ 632.680430][T25883] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 632.680456][T25883] ? __lock_acquire+0x6b5/0x2cf0 [ 632.680488][T25883] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 632.680528][T25883] ? __fget_files+0x2a/0x420 [ 632.680547][T25883] ? __fget_files+0x2a/0x420 [ 632.680563][T25883] ? __fget_files+0x3a0/0x420 [ 632.680577][T25883] ? __fget_files+0x2a/0x420 [ 632.680597][T25883] security_file_ioctl+0xc3/0x2a0 [ 632.680627][T25883] __se_sys_ioctl+0x47/0x170 [ 632.680651][T25883] do_syscall_64+0x14d/0xf80 [ 632.680673][T25883] ? trace_irq_disable+0x3b/0x150 [ 632.680702][T25883] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.680720][T25883] ? clear_bhb_loop+0x40/0x90 [ 632.680745][T25883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.680762][T25883] RIP: 0033:0x7f9240d9c819 [ 632.680780][T25883] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.680795][T25883] RSP: 002b:00007f9241be9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 632.680815][T25883] RAX: ffffffffffffffda RBX: 00007f9241015fa0 RCX: 00007f9240d9c819 [ 632.680828][T25883] RDX: 0000200000000680 RSI: 000000000000890c RDI: 0000000000000004 [ 632.680840][T25883] RBP: 00007f9241be9090 R08: 0000000000000000 R09: 0000000000000000 [ 632.680852][T25883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.680863][T25883] R13: 00007f9241016038 R14: 00007f9241015fa0 R15: 00007ffe36c72968 [ 632.680892][T25883] [ 632.680988][T25883] ERROR: Out of memory at tomoyo_realpath_from_path. [ 632.757229][ T51] Bluetooth: hci0: command tx timeout [ 633.266528][T25926] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6699'. [ 633.270387][T25932] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6697'. [ 633.583576][T25945] FAULT_INJECTION: forcing a failure. [ 633.583576][T25945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 633.607033][T25945] CPU: 1 UID: 0 PID: 25945 Comm: syz.1.6702 Not tainted syzkaller #0 PREEMPT(full) [ 633.607060][T25945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 633.607071][T25945] Call Trace: [ 633.607080][T25945] [ 633.607088][T25945] dump_stack_lvl+0xe8/0x150 [ 633.607118][T25945] should_fail_ex+0x412/0x560 [ 633.607150][T25945] _copy_from_user+0x2d/0xb0 [ 633.607173][T25945] nr_rt_ioctl+0x933/0xf90 [ 633.607207][T25945] ? kasan_quarantine_put+0xbb/0x1f0 [ 633.607228][T25945] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 633.607262][T25945] ? apparmor_capable+0x126/0x170 [ 633.607291][T25945] ? capable+0x88/0xe0 [ 633.607316][T25945] ? nr_ioctl+0x1b1/0x3b0 [ 633.607339][T25945] sock_do_ioctl+0x101/0x320 [ 633.607360][T25945] ? __pfx_sock_do_ioctl+0x10/0x10 [ 633.607376][T25945] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 633.607417][T25945] sock_ioctl+0x5c6/0x7f0 [ 633.607444][T25945] ? __pfx_sock_ioctl+0x10/0x10 [ 633.607469][T25945] ? __fget_files+0x2a/0x420 [ 633.607484][T25945] ? __fget_files+0x3a0/0x420 [ 633.607500][T25945] ? __fget_files+0x2a/0x420 [ 633.607519][T25945] ? bpf_lsm_file_ioctl+0x9/0x20 [ 633.607543][T25945] ? __pfx_sock_ioctl+0x10/0x10 [ 633.607568][T25945] __se_sys_ioctl+0xfc/0x170 [ 633.607592][T25945] do_syscall_64+0x14d/0xf80 [ 633.607615][T25945] ? trace_irq_disable+0x3b/0x150 [ 633.607632][T25945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.607650][T25945] ? clear_bhb_loop+0x40/0x90 [ 633.607672][T25945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 633.607690][T25945] RIP: 0033:0x7fbaa379c819 [ 633.607709][T25945] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 633.607725][T25945] RSP: 002b:00007fbaa4670028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 633.607744][T25945] RAX: ffffffffffffffda RBX: 00007fbaa3a15fa0 RCX: 00007fbaa379c819 [ 633.607757][T25945] RDX: 0000200000000680 RSI: 000000000000890c RDI: 0000000000000004 [ 633.607770][T25945] RBP: 00007fbaa4670090 R08: 0000000000000000 R09: 0000000000000000 [ 633.607782][T25945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 633.607793][T25945] R13: 00007fbaa3a16038 R14: 00007fbaa3a15fa0 R15: 00007ffd22b21908 [ 633.607822][T25945] [ 634.014599][T25960] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6711'. [ 634.283000][T25971] netlink: 'syz.4.6713': attribute type 2 has an invalid length. [ 634.330945][T25971] netlink: 'syz.4.6713': attribute type 2 has an invalid length. [ 634.419482][T25971] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6713'. [ 634.441541][T25971] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6713'. [ 634.489943][T25971] geneve2: entered promiscuous mode [ 634.506895][T25971] geneve2: entered allmulticast mode [ 634.599071][T26000] wg1 speed is unknown, defaulting to 1000 [ 634.690515][T26000] lo speed is unknown, defaulting to 1000 [ 635.368611][T26047] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6735'. [ 635.415892][T26047] netlink: 'syz.1.6735': attribute type 12 has an invalid length. [ 635.428290][T26046] syzkaller0: entered promiscuous mode [ 635.437601][T26046] syzkaller0: entered allmulticast mode [ 635.525825][T26054] FAULT_INJECTION: forcing a failure. [ 635.525825][T26054] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 635.546496][T26054] CPU: 1 UID: 0 PID: 26054 Comm: syz.1.6738 Not tainted syzkaller #0 PREEMPT(full) [ 635.546522][T26054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 635.546533][T26054] Call Trace: [ 635.546542][T26054] [ 635.546550][T26054] dump_stack_lvl+0xe8/0x150 [ 635.546580][T26054] should_fail_ex+0x412/0x560 [ 635.546613][T26054] _copy_from_user+0x2d/0xb0 [ 635.546636][T26054] kstrtouint_from_user+0xd6/0x180 [ 635.546658][T26054] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 635.546693][T26054] proc_fail_nth_write+0x8e/0x210 [ 635.546720][T26054] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 635.546796][T26054] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 635.546823][T26054] vfs_write+0x29a/0xb90 [ 635.546853][T26054] ? __pfx_vfs_write+0x10/0x10 [ 635.546876][T26054] ? __fget_files+0x2a/0x420 [ 635.546898][T26054] ? __fget_files+0x3a0/0x420 [ 635.546914][T26054] ? __fget_files+0x2a/0x420 [ 635.546940][T26054] ksys_write+0x150/0x270 [ 635.546963][T26054] ? __pfx_ksys_write+0x10/0x10 [ 635.546983][T26054] ? __pfx_sock_ioctl+0x10/0x10 [ 635.547019][T26054] do_syscall_64+0x14d/0xf80 [ 635.547043][T26054] ? trace_irq_disable+0x3b/0x150 [ 635.547059][T26054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.547078][T26054] ? clear_bhb_loop+0x40/0x90 [ 635.547102][T26054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 635.547121][T26054] RIP: 0033:0x7fbaa375d04e [ 635.547139][T26054] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 635.547156][T26054] RSP: 002b:00007fbaa466ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 635.547177][T26054] RAX: ffffffffffffffda RBX: 00007fbaa46706c0 RCX: 00007fbaa375d04e [ 635.547191][T26054] RDX: 0000000000000001 RSI: 00007fbaa46700a0 RDI: 0000000000000003 [ 635.547203][T26054] RBP: 00007fbaa4670090 R08: 0000000000000000 R09: 0000000000000000 [ 635.547215][T26054] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 635.547226][T26054] R13: 00007fbaa3a16038 R14: 00007fbaa3a15fa0 R15: 00007ffd22b21908 [ 635.547258][T26054] [ 635.920709][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 635.928751][ C0] lec:lec_tx_timeout: lec0 [ 635.934783][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 635.967799][T26066] syzkaller0: entered promiscuous mode [ 635.977777][T26066] syzkaller0: entered allmulticast mode [ 636.315041][T26089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.393782][T26091] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 636.633651][T26089] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 637.495008][T26117] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 637.752127][T26128] __nla_validate_parse: 3 callbacks suppressed [ 637.752148][T26128] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6765'. [ 637.859424][T26131] [ 637.861788][T26131] ====================================================== [ 637.869017][T26131] WARNING: possible circular locking dependency detected [ 637.876059][T26131] syzkaller #0 Not tainted [ 637.880473][T26131] ------------------------------------------------------ [ 637.887528][T26131] syz.1.6766/26131 is trying to acquire lock: [ 637.893610][T26131] ffff888062144270 (&nr_node->node_lock){+...}-{3:3}, at: nr_del_node+0x2a9/0xbb0 [ 637.902876][T26131] [ 637.902876][T26131] but task is already holding lock: [ 637.910244][T26131] ffffffff8fd4e138 (nr_node_list_lock){+...}-{3:3}, at: nr_del_node+0x253/0xbb0 [ 637.919336][T26131] [ 637.919336][T26131] which lock already depends on the new lock. [ 637.919336][T26131] [ 637.929751][T26131] [ 637.929751][T26131] the existing dependency chain (in reverse order) is: [ 637.938774][T26131] [ 637.938774][T26131] -> #2 (nr_node_list_lock){+...}-{3:3}: [ 637.946675][T26131] _raw_spin_lock_bh+0x36/0x50 [ 637.951987][T26131] nr_rt_device_down+0xbe/0x860 [ 637.957463][T26131] nr_device_event+0x137/0x150 [ 637.962757][T26131] notifier_call_chain+0x1be/0x400 [ 637.968413][T26131] __dev_notify_flags+0x16d/0x310 [ 637.974006][T26131] netif_change_flags+0xe8/0x1a0 [ 637.979575][T26131] dev_change_flags+0x130/0x260 [ 637.984973][T26131] dev_ioctl+0x7b4/0x1150 [ 637.989846][T26131] sock_do_ioctl+0x23e/0x320 [ 637.994991][T26131] sock_ioctl+0x5c6/0x7f0 [ 637.999884][T26131] __se_sys_ioctl+0xfc/0x170 [ 638.005006][T26131] do_syscall_64+0x14d/0xf80 [ 638.010144][T26131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.016577][T26131] [ 638.016577][T26131] -> #1 (nr_neigh_list_lock){+...}-{3:3}: [ 638.024503][T26131] _raw_spin_lock_bh+0x36/0x50 [ 638.029810][T26131] nr_remove_neigh+0x25/0xe0 [ 638.034941][T26131] nr_add_node+0x1e41/0x2630 [ 638.040069][T26131] nr_rt_ioctl+0xe59/0xf90 [ 638.045015][T26131] sock_do_ioctl+0x101/0x320 [ 638.050136][T26131] sock_ioctl+0x5c6/0x7f0 [ 638.055055][T26131] __se_sys_ioctl+0xfc/0x170 [ 638.060179][T26131] do_syscall_64+0x14d/0xf80 [ 638.065303][T26131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.071725][T26131] [ 638.071725][T26131] -> #0 (&nr_node->node_lock){+...}-{3:3}: [ 638.079919][T26131] __lock_acquire+0x15a5/0x2cf0 [ 638.085403][T26131] lock_acquire+0xf0/0x2e0 [ 638.090398][T26131] _raw_spin_lock_bh+0x36/0x50 [ 638.095708][T26131] nr_del_node+0x2a9/0xbb0 [ 638.100660][T26131] nr_rt_ioctl+0xb34/0xf90 [ 638.105611][T26131] sock_do_ioctl+0x101/0x320 [ 638.110727][T26131] sock_ioctl+0x5c6/0x7f0 [ 638.115599][T26131] __se_sys_ioctl+0xfc/0x170 [ 638.120803][T26131] do_syscall_64+0x14d/0xf80 [ 638.125952][T26131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.132397][T26131] [ 638.132397][T26131] other info that might help us debug this: [ 638.132397][T26131] [ 638.142753][T26131] Chain exists of: [ 638.142753][T26131] &nr_node->node_lock --> nr_neigh_list_lock --> nr_node_list_lock [ 638.142753][T26131] [ 638.156698][T26131] Possible unsafe locking scenario: [ 638.156698][T26131] [ 638.164154][T26131] CPU0 CPU1 [ 638.169550][T26131] ---- ---- [ 638.174911][T26131] lock(nr_node_list_lock); [ 638.179505][T26131] lock(nr_neigh_list_lock); [ 638.186880][T26131] lock(nr_node_list_lock); [ 638.193984][T26131] lock(&nr_node->node_lock); [ 638.198745][T26131] [ 638.198745][T26131] *** DEADLOCK *** [ 638.198745][T26131] [ 638.206875][T26131] 1 lock held by syz.1.6766/26131: [ 638.211971][T26131] #0: ffffffff8fd4e138 (nr_node_list_lock){+...}-{3:3}, at: nr_del_node+0x253/0xbb0 [ 638.221656][T26131] [ 638.221656][T26131] stack backtrace: [ 638.227535][T26131] CPU: 1 UID: 0 PID: 26131 Comm: syz.1.6766 Not tainted syzkaller #0 PREEMPT(full) [ 638.227557][T26131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 638.227568][T26131] Call Trace: [ 638.227575][T26131] [ 638.227584][T26131] dump_stack_lvl+0xe8/0x150 [ 638.227610][T26131] print_circular_bug+0x2e1/0x300 [ 638.227637][T26131] check_noncircular+0x12e/0x150 [ 638.227665][T26131] __lock_acquire+0x15a5/0x2cf0 [ 638.227694][T26131] ? ref_tracker_alloc+0x35c/0x4c0 [ 638.227712][T26131] lock_acquire+0xf0/0x2e0 [ 638.227730][T26131] ? nr_del_node+0x2a9/0xbb0 [ 638.227752][T26131] ? nr_del_node+0x247/0xbb0 [ 638.227773][T26131] ? nr_del_node+0x247/0xbb0 [ 638.227792][T26131] ? nr_del_node+0x2a9/0xbb0 [ 638.227813][T26131] _raw_spin_lock_bh+0x36/0x50 [ 638.227831][T26131] ? nr_del_node+0x2a9/0xbb0 [ 638.227851][T26131] nr_del_node+0x2a9/0xbb0 [ 638.227871][T26131] ? dev_get_by_name+0x21/0x200 [ 638.227896][T26131] nr_rt_ioctl+0xb34/0xf90 [ 638.227919][T26131] ? kasan_quarantine_put+0xbb/0x1f0 [ 638.227936][T26131] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 638.227960][T26131] ? apparmor_capable+0x126/0x170 [ 638.227981][T26131] ? capable+0x88/0xe0 [ 638.228001][T26131] ? nr_ioctl+0x1b1/0x3b0 [ 638.228019][T26131] sock_do_ioctl+0x101/0x320 [ 638.228035][T26131] ? __pfx_sock_do_ioctl+0x10/0x10 [ 638.228048][T26131] ? do_futex+0x395/0x420 [ 638.228072][T26131] sock_ioctl+0x5c6/0x7f0 [ 638.228095][T26131] ? __pfx_sock_ioctl+0x10/0x10 [ 638.228117][T26131] ? __fget_files+0x2a/0x420 [ 638.228131][T26131] ? __fget_files+0x3a0/0x420 [ 638.228143][T26131] ? __fget_files+0x2a/0x420 [ 638.228157][T26131] ? bpf_lsm_file_ioctl+0x9/0x20 [ 638.228178][T26131] ? __pfx_sock_ioctl+0x10/0x10 [ 638.228199][T26131] __se_sys_ioctl+0xfc/0x170 [ 638.228218][T26131] do_syscall_64+0x14d/0xf80 [ 638.228239][T26131] ? trace_irq_disable+0x3b/0x150 [ 638.228252][T26131] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.228269][T26131] ? clear_bhb_loop+0x40/0x90 [ 638.228286][T26131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.228301][T26131] RIP: 0033:0x7fbaa379c819 [ 638.228317][T26131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 638.228332][T26131] RSP: 002b:00007fbaa4670028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 638.228350][T26131] RAX: ffffffffffffffda RBX: 00007fbaa3a15fa0 RCX: 00007fbaa379c819 [ 638.228362][T26131] RDX: 0000200000000680 RSI: 000000000000890c RDI: 0000000000000006 [ 638.228373][T26131] RBP: 00007fbaa3832c91 R08: 0000000000000000 R09: 0000000000000000 [ 638.228384][T26131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 638.228400][T26131] R13: 00007fbaa3a16038 R14: 00007fbaa3a15fa0 R15: 00007ffd22b21908 [ 638.228418][T26131] [ 638.540444][T26132] H: renamed from dummy0 (while UP) [ 640.950719][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 640.958736][ C0] lec:lec_tx_timeout: lec0 [ 640.963389][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 645.970700][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 645.978782][ C0] lec:lec_tx_timeout: lec0 [ 645.983843][ C0] lec:lec_start_xmit: lec0:No lecd attached