last executing test programs: 2.474576958s ago: executing program 1 (id=3914): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f00000000c0)={0xb}, 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000100)={0xc0}, 0x1) sendto$inet6(r0, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x40000000, @loopback, 0xfffffffd}, 0x1c) 2.343365719s ago: executing program 4 (id=3916): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x8, 0x81, 0x5}) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x6, 0x4, 0x4, 0x6, 0x0, 0x1, 0x0, '\x00', 0x0, r0}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 2.260360783s ago: executing program 3 (id=3917): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv6_newrule={0x44, 0x20, 0x1, 0x0, 0x25dfdbfb, {0xa, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2001f}, [@FRA_DST={0x14, 0x1, @rand_addr=' \x01\x00'}, @FIB_RULE_POLICY=@FRA_IIFNAME={0x14, 0x3, 'veth0_macvtap\x00'}]}, 0x44}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYBLOB="200000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000403c0012800b000100697036746e6c00002c000280140003002001000000000000000000000000000114000200fc"], 0x5c}}, 0x0) 2.108506748s ago: executing program 1 (id=3919): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'hash\x00', 0x0, 0x0, 'mcryptd(blake2b-160)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) accept4(r1, 0x0, 0x0, 0x800) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x3, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x48890}, 0x24000000) setsockopt$SO_J1939_FILTER(r1, 0x6b, 0x1, 0x0, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000100)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd700000100000010000000c0002000400000000000000100007800c00018008000100", @ANYBLOB="d531da53a2299dfa90ba2becab0b354c10acf3704f085481d9550451066d17b23ad8", @ANYBLOB="0c0005001e"], 0x3c}}, 0x4000004) 2.105443879s ago: executing program 4 (id=3920): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000001540)=@raw={'raw\x00', 0x8, 0x3, 0x568, 0x0, 0xffffffff, 0xffffffff, 0x210, 0xffffffff, 0x498, 0xffffffff, 0xffffffff, 0x498, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x210, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@dev={0xac, 0x14, 0x14, 0x2f}, [0xff, 0xffffffff, 0xffffffff, 0xffffffff], 0x4e20, 0x4e20, 0x4e23, 0x4e21, 0x1, 0xd, 0x9, 0x4, 0x80}}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x2, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c8) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x258, 0x120, 0x1000000, 0xffffffff, 0x1c0, 0xffffffff, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x3, 0x0, {[{{@ip={@rand_addr=0x64010101, @rand_addr=0x640100ff, 0xffffffff, 0x0, 'bond_slave_1\x00', 'geneve1\x00', {}, {}, 0x4, 0x0, 0x28}, 0x0, 0xf0, 0x120, 0x0, {0x0, 0x1c8}, [@common=@inet=@ecn={{0x28}, {0x0, 0x10, 0x1a}}, @common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0xa, 0x1eb, 0x8, 0x0, 0x0, 0x5, 0x23}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9, 0x4, 0x3ff, 0xc15ac56b9c76af00}}}, {{@ip={@loopback, @rand_addr=0x64010101, 0xff, 0xffffff00, 'veth0_to_team\x00', 'vcan0\x00', {}, {0xff}, 0x32, 0x3}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x9, 0x3, 0x3, 0x55367656ae40811c}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x64}}}}, 0x2b8) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000580)={{r0, &(0x7f0000000300)='aead\x00', 0x100, &(0x7f0000000340)={@align=0x8, {0xca13, 0x10, 0x2}}, 0x101, &(0x7f0000000380), &(0x7f00000003c0)=0x26c}, 0x1, &(0x7f0000000540)=[{0x3, 0x8, &(0x7f0000000440)='e:*$%\\&*%,\x00', &(0x7f0000000480)="b4e7a17a2d0a575359f6dc9ff6ca9849958471eb61576648b7715f97140cc37e275f7c2ab86e4bc1d4681289a6dc7e61b62b61d067f16760acf182b2526399b6db9599d57b76dd365e9ad43b2fb0b3bc6de8bfeefb25fb54b9e10860cae41b10f1af12ecf1b0d4b20258fcf8bd5dab0800e91b6fc4914372038c1c13f13ad6fcc23ac160c58e79a8cbf82b3a5f29de8580a8ed847cd17ea9b94a11379bc59b3458c83e3b6b42", 0xa6, 0x2}]}) write$cgroup_subtree(r3, &(0x7f0000000600)={[{0x0, 'cpuacct'}, {0x2b, 'memory'}, {0x2b, 'net_cls'}, {0x2b, 'rlimit'}, {0x2d, 'net'}, {0x2d, 'net'}, {0x2d, 'cpuset'}, {0x2d, 'memory'}, {0x2b, 'net'}, {0x2b, 'cpuset'}]}, 0x49) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) syz_emit_ethernet(0x7a, &(0x7f00000002c0)=ANY=[@ANYRESHEX=r0], 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r4 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000003d80)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@assoc={0x18, 0x117, 0x4, 0x10}], 0x18, 0x20040040}], 0x1, 0x2004c044) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r4) 2.105147966s ago: executing program 2 (id=3921): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x34, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0xc, 0x1, [0xffffffff, 0x0]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x50}, 0x0) 1.94893113s ago: executing program 3 (id=3922): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000079b560ea", @ANYRES32, @ANYRES16=r0], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0xc}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="640000000206030000000000000000000000000005000100070000000900020073797a310000000014000780050015000000000008001240000000000500050002000000050004000000000016000300686173683a6e65742c706f"], 0x64}}, 0x0) sendmsg(r3, &(0x7f0000000000)={0x0, 0x46, &(0x7f00000000c0), 0x1}, 0x40000) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001340)={@cgroup, 0xffffffffffffffff, 0x2a}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000477b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'geneve0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=@newlink={0x108, 0x10, 0x401, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_LINKINFO={0xd8, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc8, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0xb, 0x7}}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x8100}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x2, 0xc}}, @IFLA_VLAN_EGRESS_QOS={0x58, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xd, 0x6}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xff, 0x7}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4, 0x100}}, @IFLA_VLAN_QOS_MAPPING={0x54, 0x1, {0x2, 0xce10}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x1ff, 0x9}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x283, 0x13}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x4bf4, 0x200}}]}, @IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_INGRESS_QOS={0x34, 0x4, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xffffffffffffffd3, 0x1, {0x3, 0x5}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x6, 0x9}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0xffff, 0xffff7fff}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x10000, 0x9}}]}]}}}, @IFLA_LINK={0x8, 0x5, r6}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x108}}, 0x0) read(r4, &(0x7f0000000080)=""/4, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000003e0007010300000000000000027c00000400428011000100686d"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000daa000000a0000000c0002006e6c383032313100"], 0x20}}, 0x0) recvmmsg(r8, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/189, 0xbd}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x3}}], 0x7, 0x0, 0x0) r9 = socket$netlink(0x10, 0x3, 0x10) r10 = socket$inet_tcp(0x2, 0x1, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000001480)={[{0x2d, 'devices'}, {0x2d, 'net_cls'}, {0x2d, 'freezer'}, {0x0, 'cpuacct'}, {0x2b, 'hugetlb'}, {0x2b, 'net_prio'}]}, 0x37) setsockopt$inet_tcp_TLS_RX(r10, 0x11a, 0x2, &(0x7f0000000380)=@gcm_128={{0x303}, "b8290da20068bb6c", "a4f3ef31dbc75ec24ed3129224b54d09", "04e74a54", "d9c7e962ac9d68e3"}, 0x28) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000006800)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="15060000f2ff01000000010000003000018014000400ff010000000000000000000000000001060005004e220000060001000a000000080006000100"], 0x44}, 0x5}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000feefffff0000000003000000850000005500000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$MPTCP_PM_CMD_GET_LIMITS(r8, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r11, 0x4, 0x70bd26, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x2000c0c0}, 0x800) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xe4, r11, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x30, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xb9}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1c}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x34, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x29}}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_ADDR={0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @remote}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4000015}, 0x50) 1.933735437s ago: executing program 0 (id=3923): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000080)={0x0, 0x4, 0xca0, 0xfffa}, 0x8) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e21, 0xd, @loopback, 0xc}], 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000000c0)={0x7, 0x202, 0x2, 0x1000}, 0x10) sendto$inet6(r0, &(0x7f0000000340)='0', 0xffe0, 0x4000854, &(0x7f0000000300)={0xa, 0x4e21, 0xbe7, @loopback={0x4000000000000000}, 0x800000c0}, 0x1c) 1.827568749s ago: executing program 2 (id=3924): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x34, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_CQM={0x18, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0xc, 0x1, [0xffffffff, 0x0]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x50}, 0x0) (fail_nth: 2) 1.716503822s ago: executing program 0 (id=3925): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000200000000000000000000000850000004100000095000000000000004be98911ed5a3cf4451d51e400827eef4df9eb3fd52b8f0a456c3a6cfd127868ad3fe3f9a9b946c97f9fc091e4c3f4b0a0d7ed298717a480c48868562f04005972b6a5265519fee4cb1b8b93f0b164770fd40c7a8060ce72beff7cda177e28a1a97b2c8c56a3f15b2f7a9b7ae2cf52d08555d3c3315e95095217bff8c9441a45fd00000000000000979ed4e35d21d13d428af521c553b9420385390207dc1634aee0244045e5c380e6090329d37b29a56c16d5c7bee160b91246bd2c205047bd92581165c774b1fd46072c161f1d33e6d5c1a5db7a714e3ed5468408f279bd9f98ec3c5ffd79cd37810f03000000b65d147fa05253a600adfb03775847b220369339529d434f3190c81c3dd501a780cfaaaa916c8a33ee4b52d18e160428893f33d206d3a7195e7f69c831099bdc940000aa2c2e61509bf6c58b100000000000000000000000005e3210346531c1eb14fbec6eb35d6f3e3853512c6bf186bd8b75d17aeeaa07"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x0, 0x2c, 0x0, @remote, @local}}}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'team0\x00', 0x1000}) 1.18539239s ago: executing program 0 (id=3926): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000180000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000006d00000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000180)="fffffffffffffffe000000000005", 0x0, 0x7fe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.164593012s ago: executing program 2 (id=3927): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0xd0}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x2, 0x300}, {0x6e, 0x0, 0xd}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.064010095s ago: executing program 1 (id=3928): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x5}, 0x50) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xb, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9}, [@generic={0x73, 0x1, 0x1, 0x36}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000fa0000000000000000010000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f00000001c0)=""/222, 0x41100, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff97}, 0x78) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000500)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) ioctl$BTRFS_IOC_SYNC(r1, 0x9408, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0xc}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r0, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)="82", 0x1}, {&(0x7f0000000140)='\x00', 0x1}], 0x2}}], 0x1, 0x4404c880) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r4, 0x11, 0x1, &(0x7f00000006c0), 0x4) r5 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r5, 0x638) setsockopt$inet_int(r5, 0x0, 0x1, &(0x7f0000000180)=0x1008006, 0x4) setsockopt$inet_int(r4, 0x0, 0x22, &(0x7f0000000000)=0x6, 0x4) sendto$inet6(r0, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) 1.063569422s ago: executing program 4 (id=3929): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000f00)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000003800)=ANY=[@ANYBLOB="3c0200001600090127"], 0x23c}, 0x1, 0x0, 0x0, 0x40800}, 0x20044010) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) r2 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000000c0)={0x200c}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r3) sendmsg$NL802154_CMD_DEL_SEC_KEY(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)={0x30, r4, 0x1, 0xffffffff, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_KEY={0x10, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0xc, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000050}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wpan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000680)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_TX_POWER(r3, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000700)={&(0x7f00000007c0)={0x74, r4, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_TX_POWER={0x8, 0xb, 0x6}, @NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000003}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0x4}, @NL802154_ATTR_TX_POWER={0x8, 0xb, 0xe11}]}, 0x74}}, 0x810) socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r4, 0x811, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x24}, 0x1, 0x0, 0x0, 0x24010000}, 0x4010) r8 = socket$can_bcm(0x1d, 0x2, 0x2) r9 = accept(r8, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1e, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x59, '\x00', 0x0, 0x24}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000003c0)={'syztnl1\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x700, 0x700, 0x6, 0x2e, {{0x25, 0x4, 0x0, 0x27, 0x94, 0x67, 0x0, 0x7f, 0x2f, 0x0, @multicast1, @loopback, {[@timestamp_prespec={0x44, 0xc, 0x3a, 0x3, 0xb, [{@rand_addr=0x64010100, 0x3d}]}, @ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0x34, 0xfc, 0x1, 0x2, [{@loopback, 0x9}, {@multicast1, 0x9}, {@local, 0x7}, {@broadcast, 0x2}, {@multicast2, 0x4}, {@loopback, 0x8}]}, @end, @end, @rr={0x7, 0x13, 0x1c, [@dev={0xac, 0x14, 0x14, 0x43}, @empty, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x16}]}, @rr={0x7, 0x27, 0x26, [@broadcast, @rand_addr=0x4, @dev={0xac, 0x14, 0x14, 0xa}, @rand_addr=0x64010100, @multicast1, @dev={0xac, 0x14, 0x14, 0x41}, @loopback, @remote, @remote]}]}}}}}) socketpair(0x5, 0x80000, 0x9, &(0x7f0000000500)) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f0000000840)={{{@in=@broadcast, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}, 0x0, @in6=@loopback}}, &(0x7f00000006c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r9, 0x29, 0x23, &(0x7f0000000540)={{{@in=@rand_addr=0x64010102, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e23, 0x2, 0x4e22, 0x0, 0xa, 0x0, 0xe0, 0x32, r10, r11}, {0x4, 0x101, 0x0, 0x5, 0xffffffffffff9db9, 0x1, 0x0, 0x6}, {0xffffffffffffffff, 0x8, 0x8, 0x1}, 0x0, 0x0, 0x2, 0x1}, {{@in=@rand_addr=0x64010100, 0x4d2, 0x3c}, 0xa, @in6=@loopback, 0x34ff, 0x0, 0x2, 0x4, 0x9, 0x4, 0x200}}, 0xe8) 896.407727ms ago: executing program 0 (id=3930): r0 = socket$inet6(0xa, 0x3, 0x3c) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f0000000640)=ANY=[@ANYBLOB="0002020100000000ff020000000000000000000000000001990c0ed829c0026ad715fe8fc55a4f785f1736a470eebea6b7022b129e0f40736026c99ae126df547bbcb75e169a1decd55a7b"], 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES8], 0x48) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="19000000040000000400"/20, @ANYRES32=0x1, @ANYBLOB="00000000040000000000000000cbd3f5303e3f324689ed79da891aabed09402b8046cb5afbfbfa5f578df76e403473d35d25b8a9c1d221bfc94e92c7a573f8f3c28563fa8187c326f61681035dfc9934b4b8a0ff6e7faeaec86ef0f8a947aa7c", @ANYRES32=0x0, @ANYRES32=0xffffffffffffffff], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000048f7a98efc9d24990400efffffff00006d2c7490de062da19a955c25b1c3d38095356aa296e31b9f4059e5039bb14429eabba762df2c2ef883176669a08d3a0b76044e2bbb5d986eb69d5b75f9a1a5c5fb65fd99e7104123898c7edd1c83d05a5d02aef88290f9d6d4891dee85647f39c546a1105bb7846b5efd2c33178fe329613599e6997889c06f9df5d49fc07299759c7427254d5d6d8fa85639f690665dd296a30d2389b9e2c5f4c8", @ANYRES16=r2, @ANYRES16=0x0], &(0x7f00000001c0)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000001640), 0x2, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = socket$inet6(0xa, 0x80000, 0x2) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x41, &(0x7f0000000240)=0x152, 0x4) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r7) ioctl$IOCTL_GET_NCIDEV_IDX(r4, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_DEV_UP(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0xffffffffffffffff, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x840) ioctl$SIOCGETNODEID(0xffffffffffffffff, 0x89e1, 0x0) r10 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000480)='cpuacct.usage_all\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x2000002, 0x13, r10, 0x10000) mmap(&(0x7f00005d5000/0x2000)=nil, 0x2000, 0x3, 0x28011, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffffce) write$nci(r6, &(0x7f0000000280)=ANY=[], 0x11) setsockopt$inet6_int(r5, 0x29, 0xd1, &(0x7f0000000000)=0xb2, 0x4) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="d0000000120067fb27bd7000ffdbdf2500000000", @ANYRES32, @ANYRESOCT, @ANYBLOB="0400140008001d000200000008002e", @ANYRESDEC=r9, @ANYRESHEX=r3], 0xd0}, 0x1, 0x0, 0x0, 0x4000800}, 0x4800) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={r1, 0x0, &(0x7f0000000100)}, 0x20) sendmmsg$inet6(r5, &(0x7f00000002c0)=[{{&(0x7f0000000b00)={0xa, 0x4e23, 0x7, @local}, 0x1c, 0x0}}], 0x1, 0x24000000) recvmmsg(r5, &(0x7f0000000300)=[{{0x0, 0x0, 0x0, 0xfcb8, &(0x7f0000000580)=""/159, 0x9f}, 0xdb31}], 0x1, 0x40002102, 0x0) socket$kcm(0xa, 0x2, 0x0) 881.784932ms ago: executing program 3 (id=3931): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10) sendto$inet(r0, &(0x7f0000000240)="040cbc", 0x3, 0x20008005, &(0x7f0000000040)={0x2, 0x4e20, @remote}, 0x10) shutdown(r0, 0x1) recvmmsg(r0, &(0x7f0000000000)=[{{0x0, 0x0, 0x0}, 0x800}], 0x1, 0x1, 0x0) 836.397455ms ago: executing program 2 (id=3932): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$nci(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="4000040100001893766f9586c587db0cd7bfdec365b650ea62b64f1a458b72c4ef354c0c731060c6eae563ba7f0ce4617b75ef149980c0d5200ae6089fb37bffbc42a9059d2fa68d0d1075d73756ff87cd4fea4c39f307f73061a28f26dd5d3ef29106dcfe4a4b94c8ed4cfaded526ef7887dc362b00d465714895734da00f9b81577e3d08d0a0c5d60d283ee8be4c87"], 0x6) ioctl$NILFS_IOCTL_GET_SUINFO(r0, 0x80186e84, &(0x7f00000004c0)={&(0x7f0000000380)=[{0x79dd, 0x4, 0x1}, {0x9, 0x0, 0x1}, {0x277, 0xfffffff7, 0x1}, {0xfffffffffffffffd, 0x4}, {0x2868, 0x4, 0x2}, {0xffff, 0x7fffffff, 0x1}, {0x9, 0x9804, 0x1}, {0x5, 0x8}, {0x6, 0x5}, {0x5, 0x8, 0x1}], 0xa, 0x10, 0x4, 0x178a}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r3 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r3, &(0x7f0000000300)="ab", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @local}, 0x10) sendmsg$inet_sctp(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f00000000c0)='\f', 0x1}], 0x1, &(0x7f0000001480)=ANY=[@ANYBLOB="20000000000000008400000002000000040041007f00000000000000", @ANYRES32=0x0, @ANYBLOB="18"], 0x38, 0x4048811}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x5b) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f00000003c0)="96e6e14d06cd2cd1dc6969313336a9017d94", 0x12}, {&(0x7f0000000400)="499b7fee4035c5b8beb1f70453870f0783c185665f5661dc54c5a1a1ad65e127a695fb29eb758e857595e5277fdfcd8246da633a7d6ed7e05fe75f4f36c670e755ca5142914fdc83650da6c01c7a06ebf495fbe36b151a4c207d9347308484a5891ad7c14310bd", 0x67}, {&(0x7f0000000640)="7caba4f81ffec1c44c4691773da226d91a54e9721f1f4c8f4d4f19a73292612c8ad72d40ac83e55148f6700815e6d140cfab03adc719caee1f3feed087bc616c3bc19a510350d0befe495457b7d16c139c6e6850f1e32a661bd7cc91e333472aae3e3eb8815a38aa8fea91788c44336c8437a86f885f3546456df377a81b43b22f543cad111ff0", 0x87}], 0x3, 0x0, 0x0, 0x40088c0}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/74, 0x4a}, {&(0x7f0000000980)=""/83, 0x53}], 0x2}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000180)='ns/cgroup\x00') ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90b", 0x11}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000002900)={&(0x7f0000000840)=@un=@abs={0x1, 0x0, 0x4e21}, 0x80, &(0x7f0000002740)=[{&(0x7f0000001640)="070689ae14d1637a3b4a02d226c08cc7175f51bbb633f30cea012ac54d1d67912e47aea6ba1f1ebae05df055e1b647bc6596dae6a8db6b5f6e228481269c6a70295cc3e69428831aa7c4903351b1e69700f56bf961fbf14225feba7de1a0c254c2db6fae002bcc7530f9d731bc08dea7a4a0caed7a0ede70217998f10e9304b5b7b04049e9a46e8a52698119055d05e34996edb0d5698e9f3f462089350bd0bb002b1e0b48adda32263d9fa4da239d78d24479cc60d8ce0507b5a289bef837b44c36678e526e482c7e6a65da37c12fcfd44310125d6a3f9713f5959ef782528b35186c7fa041880a5623c2be62928632164436b220df4afff9140f035ac6a44768e9d620c181d7932342b61147f0f7f209cb43e5040f65e2c722c0ab154a042cca70a2a78c7becb26a80156d9adcefdd8d8e26ca328f01af00f3f1d6ce00ff1ee8daf21a4b9995219aac02b862c9952f07d39d68677f4d295b4977bf7e00019115578aa81e56cd49dd88924a47e3606869e1b30f470390b601a6e36138c8dee9ac23198fc685e8ea78f2921ecc28b1792f8beba12c6fb99cea023be8e6ac994ab8ab17c615ed44d1c4894799093d607f8cdaedcd1dabf2cdcde343bb28583deece4c35c01edf9d3898733307e06ed27625c83f0cc74ba149dfd658ac17ee71e15a917b22bd4f186c8fae2bfaaf2076f8cb86ebebd3bae9d09c93578d9cd2644a112d90552e42754d99eacda853c0f48799a0c96071e8cf73e85bd69d4c4be53ac0de03666a690acefeec3add5bf2879c2645a1d13dc8e9601354d273199d9e484514627213421ee43ce3a4da957e050f87213544d791c6d3001ef25c9010649c369082b13acafa89745d1b9e800bc818f0661340dc1163b84a084ddf67af758eb017876d2e66be7014f2fbc5178085447f860ac16a32e5560cfd73b8ba3698dbd6f3717fcaaf8961617b368d9acd44994023a579c1072f6acf7e062839cc92225afb89eef8e92123c6a414ffc40700e18e993aafcefc4fbeb23165429be5238927651229b136d6f3b261ef5d0a1dd1ba774741508c4cee57b2af37610680db7723e9923499aded0f0e3b3731b0394b378f8af9f02dfc487d023c748ca18a7541bd002f1ccfba144dde4d350d5e7b1aba7dd1f161d1aa001ec3938b3260ad7ebdb593c44113c5d24084d6123506a0d0b48c7cc682525d4117f94be6fea13ac56ef85d42f6c6ae24ea15b72f3a4c87026d68797686c1a0adc1ac340931e884379289920ea0bbc9c4cd386075e8bb568d021cd7e2bafc3015be6405c8cac5179e6e1e71a0565a00537f020eb6d68250669faf735cd9ff18d8e4aad83bb58d9b5e59f1caccc3d08f510df261c94e0b9a35fb030d0ad0f289a022c9aa064dc8a2f0ac05a8280035b7e7c7b1444f316a4d5e531512063e986ad3c1f6ee49d60aa3688a658f0d573ed01db3e1f948409f6700685111b7b0e08b7bbbf251f7608aed281a84c44a18cfca35e0f0354455fa73019a09fd0df7677003f42436fa4dfbcf5c754bf8f4afb0ea178fccef8d3b52d7a64944a17e98fcfc966ed3db64af086aebe2e21cd2f4c5c7aadb02c6f339bf95c15e0fc2beb4df95220c45eb547b8532c2c34c6ce0e1f0cc6eabaee611642470215ed72a644b68a52ad8220bd48f85599ed3167f49f5fc1b1552a208e05e48cb26259053b678e721d3549df56b46e6e6ed9c30312496a4f9a24c42c676bbc056b44ec0040ba9d533479c153f4131fe8128e5138b7b3936b0fab514c56f1dcd4ee77033106992331a0ef3c425fd0968032834478792d1ed22cc343c2d7be3a34e3da8ad0b09cf5e6e3aed32e822820c318a5b64dbffb09901af42600750bb678acfb7b3be7419141f89e8125678df3a1efd28ff1b27be2d3e64b6551394046bcd8ad4bc8c4980fb9f41c93f045194bc2e4eca32d7d51846e90ba4a90b0c14e853a27a6cdb0dfff10d44ad18765394c434d67e5f3ede8d6ff3e3005a7bf9b2f7a0ed3f943ecdb28cf0ea313e3a187112a22ed6f29c6c77113ae5aeae3540da30560e2b50dd029b533e330e9e880781980e391e83d24a7c270c0be90bcd2fb8cee9545516a7b7e53651bb4e804bf75f3ff8e83de1cfa5c7729a017ffc8b27fc878b8345bcf545786a4c6f5ebadc8f35346bbc05e2d366c393879911027afb7f5acea3d7a8a36091e9c607770c77e3097e01a82f7379cfd95eaf7c2c4efb362e1c412c8e686facf1393a2379ec6654195e5736d55fdbbfaad0fce63b2c6187e22c9972133a065abf2900ff5ba59fe99fa8d357f064cae38850185223c38844f0fbbc96a0dbea87b5a4c1a4fef5a16b9702116d263fb7f4ddca26ee35e35ccc4d08c5cee07c6c3546fd73e8083754c8f5825415383888ed7e9ca380b721cc756b49b9eb737770346974a7a9b98a13e448451b38f04822d2c863fd1a35d592c2c617596d48e041872912491951d55f49b4eb91ada1c1f789a7b2a4fd6a3492b01bd06057bf68451b0d6c9d72238ad11bad56265e99c505eb41937f9f11679b3ad8005b914c59994c4ee466db37066ec1e266476bd408cc3a058b8b12493d8332a35f334f69347e23a50da64b926c8f2c34af44274019e4a9e3a234ef383e5b84216845c869e5c86ef3c4def0ab602a6bf0e655ceba9accd748e2f5343b8820828cede57b05fb6d9a42f68b05840be60a51218517fb7bdb9a21b753030505465cd221d2c820e5b4d008fc540e008b5b3b066c06edcefca32b6384622a3d1bcc5933c30d29d1c58208e91dde6dc0bb7260319997831e4a4d887a52804b53c49727cd9ce796a4cc5522c3d5a8ab32ac282786faeed8cc87bfcef61df64a73ccce124054d8d042df8fa916989cd63ba44d03c2bdfe37495bd4bd2c47524b2159cbac4b036552af77c7a13e80c68e3d9a6e1cd2e63a79141fa415735af050e705352790ccbb9c817cc0b2705647da939534e2729b47703138d945953f0e25481d948cb4c0328ae3365f5c14301292aa15ce90b98d254bab3d4b8c017a5ef0f2265caac5be892c765efb5ec10ee96d41b26b2a018e9614ee7fca46f9f272b8547f411427934e13806a28cdd45cdbccef6b5a5fbb2a58a727fca55ea104e28f3b61133e68a0de1928d45663556383bdcfdc056b01071afd8d9ca90a59026f01304800635cee30375f09d2032c3bf77e41f42f2e2ade0a0ed55cc032eceac4de8e8e7876304bc9ce5439bd05cc6905fe82c895c49595691009cacd0d45b91953f80819b84c7ba971afba903d32d4f10bd5343d13f2673b569ad1498f043c9afc64d05d35332b53835a55a6cd28bc734125474eea12217a5d5e780568641554b10e254550b3d3f307d87654e6b232b132b01a3941e3da1fcc4fe921a1ef94cf24fa454fa690141e72a544899a71685695f661e83f100c2a5d35439800e94d2033aac5e50f8934deff486da26f549f3e0424e4ab76c46cba8f2d64140b70084b130b4bef7cc800f2c28cf06a992280f58ef066cd0324bd6e99b4f5ac9e454b98bf45f05f9258e68320f9fb36eb01e507f30c17535185e1052bb33ba3f4ba803ffc848751014ffca62af48a2cc92e41f8c46ae9ca7fe3363998cbf864208a2e93431a4e21c887a2be3bd58bd3b62a2326d90e6b694b51e4ffc8bcfc430a90b22044cf6c5c0ab0d9fde022eff30c65ade7cca88cf7e3302103200a19239deb1f07e70df45a8e3feaf2bc3ded221b0101eb90555c29080eb10a3c63ad34802e057ed38b7bc68444492dce43168a5f21b6220dbe6961228dcb8e3291495afdf462b83e9a2c88780bcca9acd9f6f509573027b3c8dea857abd1a50f3821b238af62c48622b8715f37f6f69ec58cc0283c829bf528d9dba809ed4c9dffd87c6b138070e8b44c1092c2adeae5f7b0536eac2fb8da72b11a6121eefb729fc3422fdd749d5c724e2c7be5d3f58696db087850964d2e68dee60c2ba8a4ce269ae8cece11d034267d27321fc150616c215bb9830eeb632020b922d0a2a04cd87f962db89a2557220fcec53a811b5ed18fff704688316138ff9b86e9bae8d33ce322e0f6298b755a2003272ff9f05859c71eef07f11d89afa2b8f024a9fbfb860afb67d51b54e3986f147584b723b9f6f4eb66551f105407c98fb8ec809fc7a08ca68f9cbbb286dd1b9e954ee04ee888381782ba68a3de85e9169a9a85290725df5f5a1eace236d90e2f5b2a9ed97d858c08656a619574a05bfa553a56c24687e62db0bc0ba6953a78806cbc285ff2e18972eed46a1666499d8b219eed0a1f2890b13dbccd62629f57c1a495ffee43df413396ce1c79c2411ec4f0e8a06322eaaae779809ca95879575aaf0d1e6a30be91330b4ec3a0c19af3814bf08e5b045719c0a1041ccd315380b3120853c299470f6a9712c08d316e766153a73fadcf997583baf08684b6e88900eb8390e4dd5d69ac5121efeef55f25a0e65d6891bb50bee7a81d9b3538d7d06b3f93e2e5d1875ac1258bfbf5634e01bb665a8380e0b539ff7b187563e0c164d33f92e960c2b794990c3c83885b13d4ffceb752015902abd603a2c150b1d3e07856858c4166f547fb615b0a3c389202163d0c35db3d2ab90d366ae93421f067e03e9e6825065d11464e66de1965fe9c9a0d374a5bf13c3b8667508da9b193d21597ed4799e4161e99086ee3812b4147af6c763b0e26659279e3f993a29b7ab27efce6df3e28aeabd224fb1b91d23255ff649c5abc6a093bfd468cbfab550daa8644f9da7452b5ab886dd0bcf640e36ee1d40103c5615d8a3e480bb01d007f9af146279cc643aba2edd4503db4ec95cf962c93275e0b7746377b63f22315738658bfa8aecafeddab786bb609fe565891f23ce1332fbd501e877abfb05317721dc6f5e875e2516fb5a945034ad79cdf5ceabcf97bbc9ca6d9748f36c8f9e37b17fc2ec8a7aa5a20209bdef4c04aff548bd09cff8088c871f0afd07cb0eed4a7a7789af530eed131162062567b3d3cea7f20ccbe3e2fc59203a1e30a1965f7809d31e9ee8633e32a53be40d0f46b2e9aaa6db01c164fbec37579b8b451195a3970a2d90b50b893b26df7e4448e0843f77508b953a925c60fdc5b8e30a1b1cc4ab2c2bc8cfc4c9ef47c2ad1b1a325f5f299cc253204fa9ce266e9443b321f9697a41277d3ef47a4a391200d6484725e1f448bd9e78abeb1ed921b6d70fa962e44f07fa34bfe581d9daa51863e03b3be09f5d2484e03b321189d4d7d87843a52d60ca3fb8fa3cd77ccbab59a3b4de2c28dd4716d3595457bc7f2709acc8800c026e0476e4cde581a06532b967e24be58081bfd5a975963fb1908c9b9792af822d0c0cb637fe551102332163acc71143dd5630dd21d7510a40b319139d8ba5bffa0bebeb3b61f01e65a2b10de67927479cc806be83befdf358f0057600220a53e0f1300f23d5e7d4506bed7d5c3f189ac5c4fadaf0ee68ee34dbfa462ce79b0f8abd8b3a72178b082d7562bc26d4907b069e5c0f907e8ed88da7ae37b5e5a54b8c70830b96dcbe811bb7c6f5728bc5d60dd471189b2e116ad371c741aa10720ed119d4071b826b36d5cbfb6178902ccc98444541bfd076862599af1dd45ea59c0698f3acc23c25668cda00b1d3a7ec41dc0b7e0a4ff55052a010b03c14a594d615c7f1a980afbd9f01eb4c7c1d781759690bd0ddb96abeacf603ece8e88a23a31df60dba608615840a7917480c3788051b4c3fcad96aea2a12eaaadd5eb1f89875a9c58f64800c77f5ab4769583af563b5b8b7bb82e73bca7c0", 0x1000}, {&(0x7f0000002640)="a66076f090c8ae3390e64a00562bde4c204d1ffacadfaf0073c527ee35b58f5386b1c53053d5e9a2e0fdb8c0f96d22fadd0cb69a78cca472e6503e4286793935dbd340884d9a", 0x46}, {&(0x7f00000026c0)="3bcb17dc98bbb36fca89ef6334b84dd0bc8aac87353424a8421797d080201cd96b75c81b2e01b9a8a94b18621a56931bddecc249b74ee6b93acf177b4600e1174aa55cde846ba2806bdf4b5a35b46cd01e5f39ceb6e5465059145cc2d22fb49447faa8bb22196846bcb86da6e7590223c8acc6823a2237bb6eafb9860f6058", 0x7f}], 0x3, &(0x7f0000002780)=ANY=[@ANYBLOB="b800000000000000070100000d0000002aa9bb8370def40efc05fdca57be8ce823cde1175bcc0a8d8c8d7b8e72cb4f421e84707d1ca3f9c896878dc2faec643a6a65b97e0c8e22458df3e1630920e558761970f0ba95ef9b9461a70718f0a2c3f18ba6fab4390b5659377f5b92e737986e9657a0c84f4c0c08b883099f5e705b1833f9bdd3150998026327f5ab4e01916a5e0af81532ee73e67e302f02674ec388bf907000000000000000130100000c000000c419757abc30c0eb38fc3c4008c905d27fd7c2ffcafdd524a65495ee2138b92f1bb53e0d0d02aeba2ca3d35ce196aaf431c5303cba6f67a9c90ae7591128d63608863951ab39883734feda2a5e5f41c2e5b6068f0af7ebfccad3617fccec00242000000000000000ff000000ffffffff3efcbee15690287b73a68f42712f00"/319], 0x148}, 0x44) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r6, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000140)=0xb9) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r8, r7, 0x25, 0x0, @void}, 0x10) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f00000006c0)={0x0, 0xbc, &(0x7f0000000600)=[@in6={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5}, @in6={0xa, 0x4e20, 0x9, @mcast2, 0x6}, @in={0x2, 0x4ea4, @private=0xa010101}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e21, 0xfff, @empty, 0x7}, @in={0x2, 0xce24, @multicast1}, @in6={0xa, 0x4e24, 0x0, @dev={0xfe, 0x80, '\x00', 0x28}, 0x200}, @in6={0xa, 0x4e23, 0x2, @private0, 0x10}]}, &(0x7f0000000700)=0x10) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[], 0x0) 767.640582ms ago: executing program 1 (id=3933): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xfffffcec, &(0x7f00000000c0), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e80)}, 0xa7944c0aecf9920d) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r8) syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) 698.999134ms ago: executing program 3 (id=3934): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r0, 0x5) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0xf00}}, 0x1c) 652.530636ms ago: executing program 4 (id=3935): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r0, &(0x7f0000001300)=[{&(0x7f0000001340)=""/4097, 0x1001}], 0x1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89ff, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_rxnfc={0x32, 0x9, 0x10000000, {0x12, @ah_ip4_spec={@dev={0xac, 0x14, 0x14, 0x38}, @multicast1, 0x1, 0x9}, {0x0, @local, 0x6, 0x401, [0x2, 0x3]}, @esp_ip6_spec={@private2, @ipv4={'\x00', '\xff\xff', @loopback}, 0x0, 0x2}, {0x0, @multicast, 0x1b1d, 0xc000, [0x200, 0x80]}, 0x3, 0x2}}}) close(0x3) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r5}, &(0x7f0000000280), &(0x7f0000000240)=r3}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@fallback=r0, 0xf, 0x1, 0x9, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)={@fallback=r1, r6, 0x16, 0x0, r1, @void, @value=r0, @void, @void, r7}, 0x20) write$cgroup_int(r1, &(0x7f0000000140), 0xfffffdef) close(r0) 594.806545ms ago: executing program 1 (id=3936): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)=@generic={&(0x7f0000000040)='./file0\x00', 0x0, 0x8}, 0x18) (async) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f00000001c0)={r0, &(0x7f00000000c0)='/dev/virtual_nci\x00', 0x4000, &(0x7f0000000100)={@align=0x8, {0x8000, 0xf73, 0xf4, 0x2}}, 0xd, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x5}) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x8001, 0xd, 0x1000, 0x20562, r1, 0x7, '\x00', 0x0, r2, 0x5, 0x1, 0x5, 0x4}, 0x50) (async) sendmsg$BATADV_CMD_TP_METER_CANCEL(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x104001}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x44, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_VLANID={0x6, 0x28, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x3}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x20004010) (async) sendmsg$TIPC_NL_KEY_FLUSH(r2, &(0x7f0000000600)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000400)={0x184, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x150, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x100, 0x3, "fc68fa7a666058756eb33fc613de33beb0d7db6bb2a9bb77089af25352084ed144d1ef7b4d018253e955340e0dcae04d7a847cf8d17e66d7e8bbaaabb993c654d2c113a90a5670615145a4452e72e467773e2d127dcb312f345fa1a8e16803c98b492a03eb9f1f1a4092d23565ef6376e24c6d5a6144587797d3ada9490586a04eea813ec9b9e7beb73e56015104fff5f7378b897b17b69120fccb20d39fcc7164a555ef15ae3aaef90e437e9762db849612cf8ec57575e0946e1315ce236a03ee922af6ffe276553d683dad4e84b415c505570c0517b68c172274d0a4ad3a2c933b2c9aa33b103337d4a9b92283224dbd834029b7f6a68aba44c5de"}, @TIPC_NLA_NODE_KEY={0x47, 0x4, {'gcm(aes)\x00', 0x1f, "7ec3c3fbc0503363e6f4d5aafc524ea71e9ccc5a9e4ad99ddab7b63e00c311"}}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xf42}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_PUBL={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x7c46}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x84004}, 0x4844) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000680), r2) sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x64, r3, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_SECRET={0x18, 0x4, [0x5, 0x8, 0x4, 0xfffffc00, 0x7]}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_SECRETLEN={0x5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x35}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000001a80)=0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001ac0)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@private0}}, &(0x7f0000001bc0)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001c00)={0x0, 0x0, 0x0}, &(0x7f0000001c40)=0xc) r9 = getpid() getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001c80)={{{@in=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@remote}}, &(0x7f0000001d80)=0xe8) (async) r11 = getgid() r12 = getgid() ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000001dc0)=0x0) (async) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000001e00)={0x0, 0x0, 0x0}, &(0x7f0000001e40)=0xc) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000001e80)=0x0) r16 = getuid() (async) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000001ec0)={0x0, 0x0, 0x0}, &(0x7f0000001f00)=0xc) (async) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000001f40)=0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001f80)={{{@in=@local, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@private}, 0x0, @in=@multicast1}}, &(0x7f0000002080)=0xe8) (async) r21 = getgid() sendmsg$unix(r2, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f00000007c0)="e31f487e8f224d54dcc52f9c3aacbf50e10ba62452265cab4e9c536539a3400b72b89c31ac3d6ed3309900ce8048748b15283658e954666857700755c69af52155da74ace6f5dd30cbff270d47586bf299794ba7d5c65e156177126591329d1a9e9e7a5e30447cca1cbe54c4ffa359eb21a1770e9827032522ced25ba6a51f8db6c3f76fd1e09e3d89e5fc687bd18334090deb11718279799bdd3f0b4c78bf54c37586f290345d76ec6af17cab129c8c7da63e84a9cbb05cf1ab09798a037ab18be5a8bdf0bd1335ab72b3a45ba54010e28e779e8f1b5de6072a21c9aab3274e91979cf39cff8cb245086ba2e5b007af9835", 0xf2}, {&(0x7f00000008c0)="35dbe9e21b49be0261cf5a7193004c87523817348574ec1d9ab2f840a0a288a84718f4de9709f57b45463dbff2affd04d1e91fa60eed86c91f9816b66f0aead8cad93a2ecee3da6b5bff2bc916ec477258bb6430791e9c5af74e4bc87f5e2e424866910c0870d03c843600493a30fd16b7a55e2c4cb455dc88a9594ed4cf516babffa616ab79885a56fad14a9d1e19ca45076b9285411a497929b52f722f9e4b7f59b40f621d47098e1d83fb33eae0f1200c08d057c3b815a0c38b0c0ffcc017eaf0cb840c236664b2ccc6c45e2ce8bc9cbd4acfaaa9cd2f14f0b35fd0b39dbd0e2cb8a042b81e382c386bb086a499d4b040a25165ce508378d64ee902e907982b2e3f656ab32c3b7138b5b69155d2f4f59566f59086799ae67c515cda95a8b1824fb1bb956283cb52f9aa5d0fa1f971196eaea7952beef95fd2ef478998b0a740c0b4220b464f09c3a30892bab33aae0b20dd617800a0fb8ba000efe9049c447958090474dd97cb2fe9326b10feee51909d43563ca5ab7dfbd5180bf05f82237263f3fa7fb1eef91c941b11ea067c8fda7f2f3f1779f9d1cfe110f981f6086e30ad5fdb99da07b43f9a7e8fa41f169428b024b4367065a07481b7fc47dac0a650356e80e3bc55ebb2bb6129876d2d0493b40d8ad9d0220abd9eed673c6dc50fbfc1df18a1064f724ea1a6775640847e5b4bb69d9cab33f0bb6142799c98151c4d2adc8090711bc943cc9ac370f57a3cf5a11aa956e75f3fd7feb65bf516fe9da4528612fe09117d1498083704988666c5b8fa236e39be280c63dc38d4ad3114ce0075d9c85fd5a121ad6386e37c34af33f205bc8dad2b0010723c3e1515037089f502f9aa370202cbe51293ef368cee7c918c8f7960fa327e2729d30e99a63569847bda5f3120f0c339950bbbee63530c920902e7067b0d91324a8b1cd5de476914adfe22f1e555d0faab26e6c868602995ddd9fa3535fe028b63fdeed3615efababd2d2507ade9d775cbf22c44f1784bae61ba343899de940c0a36f9d8d9d8033acbb803622b79058ee98b8655370a172a53655abb50c99b03d119a6f58b04d7105a19bbe4b4c20d3e5c76647c8a352956fa33434986bc8dced9a9bf300d642cc12627ccbd4b120b9dc21588ddd29a5bef2131bccc38256ec8f7d9eaa15594937d583cdb8d71eb61771362dc6e81e2557151dba719e24d786f976670eb145fdd7358706fbae99d39c629ce93e709f906f0eb928024d1e97e1d41ec2998e70e3e2e4d22f2fc2c4d2c28853975070ac0a3182b11064d2b80c3b2801ea36b95a314c1b41448370f3fb19ac5053e5684ea67477526fec3ed70f6d0ea952a820de2b9339a51b6910164e835f674fcdc24f1fb3d10f9d2d084a8bff081bc51af6864db3fa9e16c2332b672b01df53c7568b3573379e232fd33fa5b15886a818ec368b77606ec4061708f641a937538bd89b4b5fcc5918920852943c53ba4502423da6b97d6ddf099343977eef76017ec35a019394b00f7efc708b0f905ff824ded915c3b08c3380b3f87c715404d196f20b0e0491bf5e70f7d2d4ca3f1b0faf28acf0c31f1e24cc2e3251a1332075cea270a01f81caf58cff9c09bf0211fe49284ae4b8c03ea9c91a2e68186544685affeacc73851bb5bb02538b008615ae6a61cd8c019f1f470dcef4c2d2738649ad71bc9961a7d42c2743720b2edd8da1a41c70ee06a40205d01c5b8550964dacbb6718a7346c314b2b1c47f8c1208040da2118e7677186f2bf3c148e254fb3caab50375f6e44291e8e731c4e9bd3b39cb1bbcd1c805319cd3175204f5063c6e33eaefedfd955000227560731ac71781489a1b846e7229eb98360a5c9f0eb867e8429c6f88cc520b168977c8458225f038f1c538dbe4f24e622368cc979a848b54ba5704bcb0a0627f88d5db8a992ee643a574f7c13b62d6da9cd28b6ba81a552d8428b3260664342bd27f70f4f3bdf138694f54cc281fe96ca3e1055e5e05a9fcb62cdf9e6dbebfb6d4b710af79603fe8da43912a20752d49cc9b86b0c46b3ec86888714911f4990d522968bbc58ea84faf37f93cee8aedfcab1170e6dbbb6cc2243aceffcbfdc0442feb44d597f68e72b2c5afb8c068b510defef0a8124b7d0b1863b5a6a1881ebd567384fa63729ea840591736aaf98bc8f726e25eaec279904f0624183d2b305fc08848d5e09b66f041cca92098e7079223da49a8103b145e6d8c17c17f6cfcbc1ddfc94c20cb091751a677ae32aebe2e493fe97863776266a1a41d6c54c6244b961ec3e21f04061a18220f7bc29de0c4ef1839f51e0f67a4cc5a29f386ccecf65fc61551a64c6b79505f934afce454ce5f0bf75feb53d4de6d0a688d172817d834ac92fe645d88f7ea47891ba631f6cbf55b7e25efc679af088a24da45165d3dc7fae72aa1746630523895a23af4405cf178447bedcdea9376ba39f1599ee2bdf56cad6008faa0fe46d3865a02b59951e6156dcb2ade7b3d705f8de80a7cc4653617aff8096c322427f023ce9895f9faada3a1ab33c70d76c30af031b4ecbbff0018d8d03789dcbb585de68f595d89312478de513aba661d62cb40f0e3ac99b856a3675bb01549b670fb028fdaef97ef7d65c21e485c75bf1ac69c5cf1c396a65f0d28a6b39c427e23726d239df0993c9d9a14ca1e8e38f00a0520a5cbc3bf55256232010d9f5801c050c99b1d71652201bc6524090e35ad16bfe85f9c08fadd4528517984dc8cc5a4a6e54c80658a3b4101442c83efb1424fee0439bb09b17fa0d1e61854d60a1f23ff4c5f3d1bf0f90f52659044f7a1eb59065e9c066f2012db616c3738df0554e3cb866111420b869efacb0b66b2f7562b2671f419c16c6e08f7c4e62b69c65581018aad5d38c69100bcc7736448359aac983a35c231a34c24155e6639dc16bdaebc47debca2e9671070feb48ca44b01f6265db18d19a2b81c684e7648c82c19e31184015898bd78b7474b79a62e20611925a1a318f8acee62025f2591e704b61832fc47557c8b8ecd426cd7682d2d9284488aaa4ecd4f59c4e670f465857f79bdb426b88cd255e22f6e0b433d21fec58dd7124808192e8202cb0985ef132586538e6e1a0d5b36441d2fa0b4f1e7432d6ac1123912a5b1215905e36431890aca645e69c7d79ccda097dac60427bb7ad67a4cf3d22b291250c025a30cddaf71f14aec515a805b3d801ed2c0588a0dbe725e4b599e8a291b3f3230f92f68efa9e19eb5411825108d61ca871cb4ada418cee0a5dccfc3ba758d8be8e769e8ca7988d2413b7529028e94c468914c3424708d78e8aea17d9e5fded4bdd106af2ca292d47d815f67276b88ce89337854c3069c7970f98f7e1dfef38f663f55e6d85248513df33a3911f3599203ad93ec9f5dc8c10864b134117b8ba6a612a46145e985f06ad8e308d8fe74d2a238aaaecca2e145fea40965258bac8597c9bb5986d86ec18f66ec37a008abe7c4ea51e265d2404df0eb5fdda401965146d654513465679fd7e4af2aabe14fbb6dcf01f2697a14cf8503348a96f2f203cadbd4a480bd3a2743e81044904c140d2549ad1a135d87b0334cee637b3983a8704c453516d362184498d90415645c40765c7c1e1a31f8cfa2effd21d68f2d33b0a0708ab7c43bce2c0419ebb4b485e0f0792b608ab5d28e31de42e44a1569f6319fca2c39785358fe49c0e38824fdd99fc938b8a682ceb946719a21d396747f93705ee21a18879e031e57c744aefeb057daa49d1b73ffe18c72b66cdd5d176ff06ae770035c0c8509e720531d798cfca55a9e48ad47dfac4d1c66fdaa911bdc20188072dbe686f3ca00fda2229e42f3d1106fea79e7f29363337ee5e48e6bad47ea7b38e71ceb724a3740db6932cfd8be1e3f817ec6e9b02a82337c7905a6362b61358672e338c8f53d8f06e07921600e0e18f5a2454a12398cf02a72124edf16ab39c0409ab0161e4d5a4999bf56b349243d2d79433d242a7eaa7eb536be6223da8d0629e49657396ac699ef772708f9b5c72c048d3e88c1ff3042fe0474aa84fd56dbd17c00bedf8c5e9d22ca343cb68a2ad7eaabd69eb19dd4eaffc7572dd2ce322762882083fa5e97aaae3560fc9c471d03fae9f82d7ad3e2113dd239e797c0c36e17a346411c019cb9fa712280013c9e0ce091d5f434aa64bfb2fc4d4aceab0acaeb3f1b5d2dad838d69335fa510996d4478785ff7ed597e1aa0162ea93326f6483cc2392f879d6c90d83e206f5bdad71a96b0ddf4d6fb6c5257f4d875ea627f856b04b654880d8b0b7bedd7496ed61001295428376dffa2b5928dffb82aca679fce1006da7826c390331efa13c9688e9f9280e7a1017e2bfe4b2f119d899d767192e0e31509d9a8566005f22b3125cdf7803eb41b5b6df55c8be27bf1e3cd5947e93fb58171d243c18f12129af431186938592c330acdefdad6a673a488fcc040aa4cc41b378ba1e94e5c08ce8a4fed4c585b58c372f8806e3adc68109c0dd2d4c736b7253293be96c6c2b32a60c2214d24e932771f5ee6e6cf6368541fcb68d88433ead43ef48dede4afd6ec130664b14db9f861cec7ce5723ddb3f3156e7c875c001663154521c3c89fc68584d7c412bb3ba3c6a23e094aeef0ad11da434ada77a335e7dbf74e89cbe3f17ecf89ab2ccc4ab00471ee0b359c97caf862ef49ece8b047f2376aa2c554d481d0c99ab4e186c0a4690ef70ba71f9ecc41fd45a176bb7ef331d8425994301a08d0bbc91ff5377c910d983c56225c063b1e8d66ab3fdab907aa59eb74d6d5ad4389fffcc3fc8d3451ee0d61fdb6d4ddf228452df25803e96f4b80641789992d5abdc9c5293a84e871ee99e10956200cbe2ba818551631efb2912e389170e661e461c66439d76206bf792463d6bc9b3a6d3727b79ef2c924a811037dfb09b1039f1fdf4aa353835bd29c7112de8db43bdda9ba452ec7396e3df3c066727d8c84da4f3b33727771552d9036f7575e9502875d464746dbb5017cbfc73ef703bb1070ae4e784f2a6c4c97699140b60086192ebf2ada53966ce7a7ddb1f57c7469fc3dda92cf33c16448a7354cb68443db827eb5f7c0e2f1a3c0f02c077b88e4e6400e281cd56038269972ca2c4595b089098ff3333a4e8af9eed1191b2348d210334faaf49e68d59303f074a9fca00663d5666e54679b910d940fca15d1f230d5cef1bb91d4cd84d9ea8a71caab6262b8abcae35a4037bc1b67fe7ac84238695c1238ef517610d654e60b0dff23951d536152c82f20ac22161788304c682465ceadd461693f20d64cf657b2dff257d2b024a8281b9f8a4ea04876092712fc2de9bd0968f8a79286229232afec41d4ac5af494765c0d073aad297b6024f48e1d21482ce72067946ac5e8789b1dae25c6672465907ab751d45e5620d65e1f2e9ab05c0541c68e8ba150654976a5804ca0521def52490e5790c27aabbc7a6d794ce2a108028dbcd29d2c4686926a10c576d49352e86c66afd7db5c804dc17ace60947a875f7cde671ad5aaf242082659e569da2cb1993d8a5185dbf628de4cc1f5dbe5a5300809482252b1fe1dc1207912cfa20fef00324a8802cd1c63b32340937dc17b86ac7a356e38ac7496b61f6495709730c656fcb5ea905b9064f974f96bca96eb52c5f31c395767069692491ff943c0d61a8f5b9824bfbc42d817f67cf1ff0ae172ee45d90f37113710eb31691c3aa7e9b2814ebec476d52460e87db1ba0d3e565bda96e46a406da39fc3fab129588e80539ebe5a5d8e6df97c1919", 0x1000}, {&(0x7f00000018c0)="064344da1e0ad52f30f292e93dace3d68e05c087f456c50f8d580adc18fed8242d6c2b85bc85c8e6f00ae2b4d1cc0f4e6aff4e4ad397889ea9064ed1611381874442a061bc911c2473c5128e787a557ac23ab139d075d3027d88a337859bc2e2a6b5be80cdffee992c1042de628f9c775a9a9cf0eafaece342de059849055f52ddca2cc4606b7122749748a848d4c99c0cb4aec1fb052f5d0ac590b9fff174c8bf412464bfd248ee80cf3a60997b5d4031043fb960842ace66311b678579f4c7357c67ee5ce0710f4a2e", 0xca}, {&(0x7f00000019c0)="58359ccaee3cb22502f577358cff52239bc52e73973a28912512aa81e324837d9b041c6007867b86b9fb82c99def08e86080d62cf0ea93bf94a754e620d86f71eb68fb722f5ee4656cab1da6391aa4e56a95a0e0f6fe681a7b7857413d454bb1c558ccb9a3c9388df633f161502fd743eeee587b511fb6de3e5d", 0x7a}], 0x4, &(0x7f00000020c0)=[@cred={{0x1c, 0x1, 0x2, {r5, r6, r8}}}, @cred={{0x1c, 0x1, 0x2, {r9, r10, r11}}}, @rights={{0x18, 0x1, 0x1, [r0, r1]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01, r12}}}, @cred={{0x1c, 0x1, 0x2, {r13, 0xee00, r14}}}, @rights={{0x10}}, @cred={{0x1c, 0x1, 0x2, {r15, r16, r18}}}, @cred={{0x1c, 0x1, 0x2, {r19, r20, r21}}}], 0xe8, 0x4c010}, 0x0) (async) syz_open_procfs$namespace(0x0, &(0x7f0000002200)='ns/net\x00') (async) r22 = gettid() sendmsg$netlink(r2, &(0x7f00000025c0)={&(0x7f0000002240)=@proc={0x10, 0x0, 0x25dfdbfd, 0x200}, 0xc, &(0x7f0000002540)=[{&(0x7f0000002280)={0x2a8, 0x38, 0x400, 0x70bd2b, 0x25dfdbfe, "", [@nested={0xff, 0x101, 0x0, 0x1, [@nested={0x4, 0x168}, @generic="ef6719bad21c3d4141ea266103e9de05aa0757d674562a048daae2aac61296bd16f145677c8542102b81cb9e839dac09276a363e76467614da2997a0476d2dfdc28f76", @generic, @generic="a9d9bd1436dd269df39e91a243b12720ffb561199642a6b3ebd84854", @nested={0x4, 0x28}, @nested={0x4, 0x111}, @generic="0519187a003e8409fc8a0943736ec362b072b890b3eb4203cf281dc765b1471414480ea56659807b18cc733fcaafb6a8a6700fe1c191d6a1830b7b2804bf16350db18792a602a3ffe14b6bbf792e5d8586394ebc3e145db59dd1a58333f3f39dda831404a203b7e60ee4697ea3307e166a71c935634d9017077941b598fa0482ca062246ee6dbfd7dec088fd860e06db"]}, @typed={0x8, 0xd, 0x0, 0x0, @uid=r10}, @nested={0xf4, 0x9, 0x0, 0x1, [@typed={0x8, 0x43, 0x0, 0x0, @uid=r10}, @nested={0x4, 0x60}, @generic="a84dfcb380fe3bae70c209dc1f4c73d207befd161707fcd17ed7e154d8a48b73bf01f1309051c1fb9a8527a7c5590d38a28bc49c8fe76b2228c6297b02606fbd31dd2f4af0bbee088d94c71c27722211ee31148fa549ceebd389ebcbf91d7dcb8a1a71b0c95d2703cf86625d5d63b6999eefde124b193d765205e92827a717cd884e92e898481e3b96c2061926d2729a6969c4276c64a2cf016244346a793518c4adce2236e4bc73adf4f21dc7b91fd73a63c45d02957abfd56b4ad4ba160c1c5545bf643a54b501cc60a53a5c8996ac135845396bd4148cbbee74050b5f6c01", @nested={0x4, 0x59}]}, @typed={0x8, 0x2e, 0x0, 0x0, @fd=r1}, @generic="4aa4d45f18ee592f16c622e937221584e719b41aca61b293a29ed79569dfc1de19928e95c826bb5429ce83eb82bdce14ef6e04c1ef5de63ba0834c7db45b3cd7549820eb55a010a62725704e86090805f2cb2f2a8766aec9b5d3380f30caf0bfe011928675c4144d25c5b15d4b8a848d1930750810d58efc8859f89f7712b1f4aa438f6b7fe967abb11358919106565baa"]}, 0x2a8}], 0x1, &(0x7f0000002580)=[@cred={{0x1c, 0x1, 0x2, {r22, r6, r14}}}, @cred={{0x1c, 0x1, 0x2, {r7, r17, r12}}}], 0x40}, 0x24040000) (async) sendmsg$BATADV_CMD_TP_METER(r2, &(0x7f0000002700)={&(0x7f0000002600)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002640)={0x58, 0x0, 0x100, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @multicast}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x6}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x3}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2a}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}]}, 0x58}}, 0x804c000) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000002740)={0x0, r2, 0x4, 0xd91b, 0xfffffffffffffffc, 0x7}) 465.81074ms ago: executing program 3 (id=3937): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002a00)=ANY=[], 0x24}}, 0x4008030) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r1, 0x0, 0x12, 0x0, 0x50) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x3342957c) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fddbdf250300000008000100000000001c0007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018008000100", @ANYRES32=0xffffffffffffffff, @ANYBLOB="340007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c0042020a3e60d8", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r5], 0x6c}, 0x1, 0x0, 0x0, 0x4004850}, 0x10) ioctl$sock_FIOGETOWN(r4, 0x8903, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f00000004c0)) getgid() ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000005c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="8802000008e644f480919fd60c032a52be3cabeda75f6a0a3df67e523838d711c5c0658aab22de234d9435df0b30acc1d7e8d5934cd57b9d7eeb54d8eceb9882a05bfb670e709dfdc04b988377c240d2248370e1afc7b7b91922a603b1a074acc854db1f24166f1d1dfd15098f5f8939c297f48644b4a022ff59c74247c1feb927a83b66627c4590db66594d5cca2b199430b50a4e2e00e22e1967f3101f7c913b00", @ANYRES16=0x0], 0x288}, 0x1, 0x0, 0x0, 0x20000040}, 0xc085) openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, 0x0) sendmsg$NL80211_CMD_STOP_SCHED_SCAN(0xffffffffffffffff, 0x0, 0x400c000) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r9, &(0x7f0000000200)={0x0, 0xffffffffffffff80, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYRESHEX=r7, @ANYRESHEX=r6, @ANYRES32], 0x64}}, 0x4000000) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002440)=ANY=[@ANYBLOB="34000000090605000a00000000000000000000000900020073797a300000000005000100060000000c00078006000440"], 0x34}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r7, 0x6, 0x1, 0x0, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000040)={'tunl0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)={{{@in=@loopback, @in6=@private1}}, {{@in=@local}, 0x0, @in6}}, &(0x7f0000000700)=0xe8) 388.554829ms ago: executing program 4 (id=3938): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x60, 0x10, 0x401, 0x400000, 0x3, {0x0, 0x0, 0x0, 0x0, 0xe59bca127d83b0fa, 0xc574450d1af3b5a4}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0x14, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_TO_UCAST={0x5, 0x1c, 0x4}, @IFLA_BRPORT_BCAST_FLOOD={0x5, 0x1e, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x60}, 0x1, 0xffffffa1, 0x0, 0x20044010}, 0x4040) 368.128737ms ago: executing program 2 (id=3939): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x4c}}, 0x40) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000280)=0x4) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x3) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r1, &(0x7f0000000180)=[{&(0x7f00000007c0)="00214717a70700", 0x7}], 0x1, 0x803, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x64}, 0x1, 0x0, 0x0, 0x48810}, 0x4000010) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)={0x2, 0x4e24, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="100000000000000029000000070000001c000000000000000000000008000000", @ANYRES32], 0x30}}], 0x1, 0xc0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB], 0x2c}}, 0x20000804) recvmmsg(r3, &(0x7f0000007700), 0x4000267, 0xfc0, 0x0) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000b00), 0xffffffffffffffff) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) shutdown(r5, 0x1) syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x5, 0x18, 0x1000, 0x0, 0xbe85}}}}}}}, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000240)={0x28, r4, 0x9, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) 215.733373ms ago: executing program 0 (id=3940): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x201, 0xfff4, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x40, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}]}]}], {0x14}}, 0xd0}}, 0x10) 213.219365ms ago: executing program 1 (id=3941): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="f7", 0xf4240}], 0x1}], 0x1, 0xf0ff) accept$nfc_llcp(r1, 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f00000000c0)={0x300, 0x80000000, 0x1, 0x200, 0x9}) 99.895321ms ago: executing program 3 (id=3942): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_opts(r1, 0x0, 0x7, &(0x7f0000000000)=""/3, &(0x7f0000000040)=0x3) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x7}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x15, 0x13, &(0x7f0000000140)=ANY=[@ANYBLOB="18110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000000800007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000185a00000a0000000000000000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7910e0008000000b7030000040000008500000006000000"], &(0x7f0000000200)='syzkaller\x00', 0x5, 0x8e, &(0x7f00000003c0)=""/142, 0x0, 0xb, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x5, 0x5}, 0x8, 0x10, &(0x7f00000004c0)={0x2, 0x8, 0x9, 0x7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x5, &(0x7f0000000500)=[0x1, 0x1], &(0x7f0000000540)=[{0x1, 0x3, 0x6, 0x8}, {0x1, 0x4, 0x4, 0x6}, {0x3, 0x1, 0x6, 0xc}, {0x0, 0x3, 0xf, 0x2}, {0x2, 0x3, 0x3, 0xa}], 0x10, 0x6}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={r2, 0x0, 0x34, 0x0, &(0x7f00000006c0)="5eb62788ecd1fe7f42e4aef38559af2d395eb652c9f8b99a2dd70318b3f673a0903c71503aae9e9e010d095dd94bf0f8891180ce", &(0x7f0000000700), 0xa0, 0x0, 0xab, 0x80, &(0x7f0000000740)="24f2319e8da38ac1031aa8085e7b1f73bc5e2b04052f2ac22afc13d8ba595fda24cd5ab55e73a13c964e2d5d896de90be54fb6255d25ee329a8e4b1607f29abd27b7adc2ed30bf69a3b0630fe2a39af9b74558c3311e55f8991854dc866615442574cad5dbff6ae003c970e14e58d1e1be7c61cba92a49d0110989a24ee4908c7ffd406faac66ace0a40a1a56d5c8c0acdf1931485671cae03467246f523393d92766c44ede51de998bb55", &(0x7f0000000800)="b2aa2f37526cd6fb8f82581b6f1d9d90f6dffb3a71c5781adec5960424401c6cd7f67e0e96a9db7a529d3c70d6edad4028d72b7681958e097e02a58681239115d826fa5129f5c4f79dff426b9bcd12a95faf94fc94080e6833be6f22d25977449b869abfd4f1d63ce8126f8af945ed213aac68413429bdc164877e914a95f41d", 0x3, 0x0, 0x8}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'geneve0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r7, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x4c0c0}, 0x0) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x5c, 0x10, 0x401, 0x70bd28, 0x1, {0x0, 0x0, 0x0, 0x0, 0x8, 0x10000}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_ID={0x6, 0x1, 0x2}, @IFLA_VLAN_PROTOCOL={0x6, 0x5, 0x88a8}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$int_in(r8, 0x5452, &(0x7f0000000000)=0xf) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r8, 0x84, 0x6b, &(0x7f0000000380)=[@in6={0xa, 0x0, 0x0, @remote, 0x9}], 0x1c) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000300)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="1800000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB="8c"], 0x20) setsockopt(r8, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001cc0), 0xffffffffffffffff) syz_emit_ethernet(0x6e, &(0x7f00000005c0)=ANY=[@ANYBLOB="0180c2000003aa2aaaaaaaaa86dd6080000000383afffe800eff0000000000000000000000bbff02000000000000000000000000000102009078000005dc608cb02b00002fff00000000040000000000000000000001fe80000000000000000000"], 0x0) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(r9, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001dc0)={&(0x7f0000001d00)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="0d0027bd7000fddbdf2526000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x20000804}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ_RESET(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x20, 0x15, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x44004}, 0x44) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000040)={'gretap0\x00', &(0x7f0000000000)={'gretap0\x00', 0x0, 0x1, 0x40, 0xfffffffa, 0x4, {{0x7, 0x4, 0x2, 0x31, 0x1c, 0x68, 0x0, 0x5, 0x29, 0x0, @multicast1, @private=0xa010101, {[@ra={0x94, 0x4, 0x1}, @end]}}}}}) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) socket$nl_route(0x10, 0x3, 0x0) 99.631329ms ago: executing program 4 (id=3943): sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES16, @ANYRESOCT], 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000080), 0x2, 0x0) r2 = openat$cgroup_pressure(r0, &(0x7f0000000400)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000440)={'full', 0x20, 0x2, 0x20, 0x100}, 0x2f) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000c40), 0x12) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup.net/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) pread64(r4, &(0x7f0000000300)=""/181, 0xb5, 0x2) 27.153334ms ago: executing program 0 (id=3944): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, 0x0, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x1000, 0x0, 0x7d, 0x200001ff, 0x1, 0x1}, 0x1c) recvmmsg$unix(r2, &(0x7f0000004280)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000940)=""/4096, 0x1000}], 0x1}}], 0x1, 0x40002180, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1, 0x0, 0x0, 0x4000000}}], 0x400000000000181, 0x9200000000000000) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r1, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000400)='\x00', 0x1}], 0x1}}], 0x1, 0x81) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000009c0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r0], 0x1000f) 0s ago: executing program 2 (id=3945): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='cdg', 0x3) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) shutdown(r0, 0x1) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x8a) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x32600) kernel console output (not intermixed with test programs): [ 417.546079][T16962] tipc: Resetting bearer [ 417.581943][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 417.612717][T16963] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3262'. [ 417.703173][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 417.718996][T16962] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 417.770060][ T5741] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 417.830144][ T5828] tipc: Node number set to 134418688 [ 418.103561][T16980] netlink: 'syz.3.3269': attribute type 333 has an invalid length. [ 418.301967][T16994] netlink: 63763 bytes leftover after parsing attributes in process `syz.0.3270'. [ 418.531266][ T5741] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 418.897172][T16980] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 419.068407][T17006] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3273'. [ 419.417793][T17024] 8021q: VLANs not supported on sit0 [ 419.529687][T17030] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 419.541303][T17029] netlink: 'syz.2.3280': attribute type 1 has an invalid length. [ 419.551597][T17029] netlink: 248 bytes leftover after parsing attributes in process `syz.2.3280'. [ 419.744179][T17035] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3281'. [ 419.754512][T17034] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 419.787092][T17034] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 419.797922][T17034] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 419.810289][T17034] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 419.822441][T17034] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 419.837595][T17034] veth1_macvtap: left promiscuous mode [ 419.844651][T17034] veth0_macvtap: left promiscuous mode [ 419.852436][T17034] veth0_macvtap: entered promiscuous mode [ 419.859398][T17034] veth1_macvtap: entered promiscuous mode [ 419.865459][T17034] veth1_macvtap: entered allmulticast mode [ 419.878068][T17034] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 419.886724][T17034] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 419.896099][T17034] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 419.905695][T17034] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 419.920065][T17034] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 420.030831][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.041250][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.070955][ T126] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.083120][ T126] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 420.668692][T17059] netlink: 'syz.3.3290': attribute type 1 has an invalid length. [ 420.684887][T17059] netlink: 248 bytes leftover after parsing attributes in process `syz.3.3290'. [ 420.928121][T17067] Bluetooth: MGMT ver 1.23 [ 421.072927][T17072] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3295'. [ 421.084408][T17072] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3295'. [ 421.353521][T17085] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3301'. [ 421.441450][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 421.508091][T17086] A link change request failed with some changes committed already. Interface syzkaller0 may have been left with an inconsistent configuration, please check. [ 421.724044][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 421.949385][T17100] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3305'. [ 422.005702][T17100] syzkaller1: entered promiscuous mode [ 422.019948][T17100] syzkaller1: entered allmulticast mode [ 422.254149][T17106] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 422.509053][T17121] netlink: 180 bytes leftover after parsing attributes in process `syz.4.3313'. [ 422.842009][T17138] tipc: Resetting bearer [ 422.865833][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 422.908085][T17143] IPVS: rr: FWM 3 0x00000003 - no destination available [ 423.010253][ T5743] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 423.080438][ T57] batadv1: left promiscuous mode [ 423.481500][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 423.503520][ T5828] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 424.699184][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 426.624420][T17155] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 426.636150][T17186] netlink: 'syz.4.3332': attribute type 1 has an invalid length. [ 426.645216][T17186] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3332'. [ 426.947990][T17197] Timeout policy `syz0' can only be used by L3 protocol number 245 [ 427.546701][T17211] netlink: 'syz.4.3341': attribute type 12 has an invalid length. [ 427.646464][T17211] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 427.808666][T17222] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3344'. [ 428.219418][T17239] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3348'. [ 428.405171][T17244] netlink: 'syz.0.3350': attribute type 1 has an invalid length. [ 428.476319][T17244] bond3: (slave geneve2): making interface the new active one [ 428.486889][T17244] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 428.519690][ T12] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 428.551935][ T12] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 428.629764][ T12] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 428.653614][ T12] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 428.923045][T17254] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3353'. [ 428.955490][T17254] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3353'. [ 428.968683][T17254] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3353'. [ 429.036799][T17242] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 429.088921][T17254] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3353'. [ 429.134636][T17254] bridge_slave_1: left allmulticast mode [ 429.143990][T17254] bridge_slave_1: left promiscuous mode [ 429.167260][T17254] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.197868][T17254] bridge_slave_0: left allmulticast mode [ 429.205427][T17254] bridge_slave_0: left promiscuous mode [ 429.211429][T17254] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.372310][T17269] netlink: 'syz.4.3357': attribute type 14 has an invalid length. [ 429.385442][T17269] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3357'. [ 429.420436][T17269] netlink: 'syz.4.3357': attribute type 14 has an invalid length. [ 429.436447][T17269] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3357'. [ 429.817735][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 429.924792][T17288] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3361'. [ 429.961784][T17288] macvtap1: entered promiscuous mode [ 429.982104][T17288] dummy0: entered promiscuous mode [ 430.006764][T17288] macvtap1: entered allmulticast mode [ 430.029293][T17288] dummy0: entered allmulticast mode [ 430.450308][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 430.458978][T17312] FAULT_INJECTION: forcing a failure. [ 430.458978][T17312] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 430.477938][T17312] CPU: 0 UID: 0 PID: 17312 Comm: syz.4.3366 Not tainted syzkaller #0 PREEMPT(full) [ 430.477968][T17312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 430.477982][T17312] Call Trace: [ 430.477990][T17312] [ 430.477998][T17312] dump_stack_lvl+0xe8/0x150 [ 430.478038][T17312] should_fail_ex+0x40c/0x560 [ 430.478066][T17312] _copy_from_user+0x2d/0xb0 [ 430.478097][T17312] ___sys_sendmsg+0x1c6/0x360 [ 430.478120][T17312] ? __lock_acquire+0x683/0x2cf0 [ 430.478152][T17312] ? __pfx____sys_sendmsg+0x10/0x10 [ 430.478211][T17312] ? __fget_files+0x2a/0x420 [ 430.478238][T17312] ? __fget_files+0x3a2/0x420 [ 430.478277][T17312] __x64_sys_sendmsg+0x1b1/0x290 [ 430.478305][T17312] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 430.478348][T17312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.478373][T17312] do_syscall_64+0x174/0x580 [ 430.478404][T17312] ? trace_irq_disable+0x3b/0x140 [ 430.478430][T17312] ? clear_bhb_loop+0x70/0xc0 [ 430.478456][T17312] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.478478][T17312] RIP: 0033:0x7f1eb299e0d9 [ 430.478499][T17312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 430.478517][T17312] RSP: 002b:00007f1eb3791028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 430.478540][T17312] RAX: ffffffffffffffda RBX: 00007f1eb2c25fa0 RCX: 00007f1eb299e0d9 [ 430.478556][T17312] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 430.478570][T17312] RBP: 00007f1eb3791090 R08: 0000000000000000 R09: 0000000000000000 [ 430.478583][T17312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 430.478595][T17312] R13: 00007f1eb2c26038 R14: 00007f1eb2c25fa0 R15: 00007fff05327e88 [ 430.478628][T17312] [ 431.368951][T17334] FAULT_INJECTION: forcing a failure. [ 431.368951][T17334] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 431.394178][T17334] CPU: 0 UID: 0 PID: 17334 Comm: syz.2.3374 Not tainted syzkaller #0 PREEMPT(full) [ 431.394207][T17334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 431.394219][T17334] Call Trace: [ 431.394228][T17334] [ 431.394238][T17334] dump_stack_lvl+0xe8/0x150 [ 431.394271][T17334] should_fail_ex+0x40c/0x560 [ 431.394298][T17334] _copy_from_user+0x2d/0xb0 [ 431.394327][T17334] bpf_prog_test_run_xdp+0xe12/0x11d0 [ 431.394379][T17334] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 431.394411][T17334] ? __fget_files+0x2a/0x420 [ 431.394442][T17334] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 431.394468][T17334] bpf_prog_test_run+0x2c5/0x340 [ 431.394498][T17334] __sys_bpf+0xa22/0xd90 [ 431.394532][T17334] ? __pfx___sys_bpf+0x10/0x10 [ 431.394568][T17334] ? __fget_files+0x2a/0x420 [ 431.394612][T17334] ? ksys_write+0x242/0x270 [ 431.394646][T17334] ? __pfx_ksys_write+0x10/0x10 [ 431.394681][T17334] __x64_sys_bpf+0xba/0xd0 [ 431.394706][T17334] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.394729][T17334] do_syscall_64+0x174/0x580 [ 431.394759][T17334] ? trace_irq_disable+0x3b/0x140 [ 431.394785][T17334] ? clear_bhb_loop+0x70/0xc0 [ 431.394812][T17334] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.394833][T17334] RIP: 0033:0x7f2906d9e0d9 [ 431.394851][T17334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.394870][T17334] RSP: 002b:00007f2907b83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 431.394892][T17334] RAX: ffffffffffffffda RBX: 00007f2907025fa0 RCX: 00007f2906d9e0d9 [ 431.394907][T17334] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 431.394920][T17334] RBP: 00007f2907b83090 R08: 0000000000000000 R09: 0000000000000000 [ 431.394933][T17334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 431.394944][T17334] R13: 00007f2907026038 R14: 00007f2907025fa0 R15: 00007ffe8c640988 [ 431.394976][T17334] [ 431.928257][T17349] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3379'. [ 433.055897][T17361] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.068730][T17361] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.291879][T17361] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.303230][T17361] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.463386][T17361] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.483879][T17361] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.589153][T17387] 8021q: adding VLAN 0 to HW filter on device bond3 [ 433.608313][T17387] macvtap1: left promiscuous mode [ 433.661075][T17361] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 433.676764][T17361] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.980179][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 433.991519][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.001064][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.040005][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.050947][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.060430][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.077568][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.087090][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.096615][T17396] ip_tunnel_core: Dead loop on virtual device geneve0 (net 37), fix it urgently! [ 434.290717][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 435.537668][T17426] net_ratelimit: 1953 callbacks suppressed [ 435.537691][T17426] macvtap1: mtu less than device minimum [ 435.736727][T17433] mac80211_hwsim hwsim24 syzkaller0: left allmulticast mode [ 435.806449][T17437] FAULT_INJECTION: forcing a failure. [ 435.806449][T17437] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.824223][T17437] CPU: 1 UID: 0 PID: 17437 Comm: syz.2.3403 Not tainted syzkaller #0 PREEMPT(full) [ 435.824252][T17437] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 435.824264][T17437] Call Trace: [ 435.824273][T17437] [ 435.824282][T17437] dump_stack_lvl+0xe8/0x150 [ 435.824316][T17437] should_fail_ex+0x40c/0x560 [ 435.824344][T17437] _copy_to_user+0x31/0xb0 [ 435.824374][T17437] bpf_test_finish+0x4ea/0x690 [ 435.824409][T17437] ? __pfx_bpf_test_finish+0x10/0x10 [ 435.824448][T17437] bpf_prog_test_run_skb+0x11fe/0x2230 [ 435.824504][T17437] ? __fget_files+0x3a2/0x420 [ 435.824532][T17437] ? __fget_files+0x2a/0x420 [ 435.824564][T17437] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 435.824590][T17437] bpf_prog_test_run+0x2c5/0x340 [ 435.824623][T17437] __sys_bpf+0xa22/0xd90 [ 435.824657][T17437] ? __pfx___sys_bpf+0x10/0x10 [ 435.824694][T17437] ? __fget_files+0x2a/0x420 [ 435.824737][T17437] ? ksys_write+0x242/0x270 [ 435.824769][T17437] ? __pfx_ksys_write+0x10/0x10 [ 435.824806][T17437] __x64_sys_bpf+0xba/0xd0 [ 435.824830][T17437] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.824854][T17437] do_syscall_64+0x174/0x580 [ 435.824886][T17437] ? trace_irq_disable+0x3b/0x140 [ 435.824911][T17437] ? clear_bhb_loop+0x70/0xc0 [ 435.824938][T17437] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.824960][T17437] RIP: 0033:0x7f2906d9e0d9 [ 435.824980][T17437] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.824999][T17437] RSP: 002b:00007f2907b83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 435.825023][T17437] RAX: ffffffffffffffda RBX: 00007f2907025fa0 RCX: 00007f2906d9e0d9 [ 435.825039][T17437] RDX: 0000000000000050 RSI: 00002000000001c0 RDI: 000000000000000a [ 435.825053][T17437] RBP: 00007f2907b83090 R08: 0000000000000000 R09: 0000000000000000 [ 435.825065][T17437] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.825078][T17437] R13: 00007f2907026038 R14: 00007f2907025fa0 R15: 00007ffe8c640988 [ 435.825113][T17437] [ 436.489244][T17453] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 436.512720][T17457] IPv6: NLM_F_CREATE should be specified when creating new route [ 436.696454][T17463] veth1_to_bond: entered promiscuous mode [ 436.707809][T17463] veth1_to_bond: entered allmulticast mode [ 437.217730][T17482] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3418'. [ 437.335038][T17486] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 437.486131][T17492] tipc: Enabling of bearer rejected, already enabled [ 437.504964][T17492] mac80211_hwsim hwsim24 syzkaller0: entered promiscuous mode [ 437.513222][T17492] mac80211_hwsim hwsim24 syzkaller0: entered allmulticast mode [ 437.612241][T17498] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3423'. [ 437.972917][T17511] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3427'. [ 438.265686][T17523] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3431'. [ 438.275161][T17523] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3431'. [ 438.422972][T17529] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.497663][T17531] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3433'. [ 438.716645][T17531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3433'. [ 438.723870][T17538] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 438.732067][T17538] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 438.798377][T17537] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3435'. [ 438.823938][T17537] nbd: must specify a size in bytes for the device [ 439.082490][T17554] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3440'. [ 439.220058][T17556] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3441'. [ 439.508344][T17570] team0: Port device vlan3 added [ 439.546708][T17578] sctp: [Deprecated]: syz.3.3447 (pid 17578) Use of int in maxseg socket option. [ 439.546708][T17578] Use struct sctp_assoc_value instead [ 439.654738][T17584] FAULT_INJECTION: forcing a failure. [ 439.654738][T17584] name failslab, interval 1, probability 0, space 0, times 0 [ 439.694272][T17584] CPU: 1 UID: 0 PID: 17584 Comm: syz.0.3448 Not tainted syzkaller #0 PREEMPT(full) [ 439.694301][T17584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 439.694314][T17584] Call Trace: [ 439.694323][T17584] [ 439.694331][T17584] dump_stack_lvl+0xe8/0x150 [ 439.694365][T17584] should_fail_ex+0x40c/0x560 [ 439.694392][T17584] should_failslab+0xa8/0x100 [ 439.694424][T17584] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 439.694449][T17584] ? skb_clone+0x212/0x3a0 [ 439.694471][T17584] ? skb_clone+0x212/0x3a0 [ 439.694502][T17584] skb_clone+0x212/0x3a0 [ 439.694528][T17584] __netlink_deliver_tap+0x413/0x860 [ 439.694566][T17584] ? netlink_deliver_tap+0x2e/0x1b0 [ 439.694593][T17584] netlink_deliver_tap+0x19c/0x1b0 [ 439.694619][T17584] netlink_unicast+0x77f/0x940 [ 439.694652][T17584] netlink_sendmsg+0x813/0xb40 [ 439.694687][T17584] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.694717][T17584] ? aa_sock_msg_perm+0xf1/0x1b0 [ 439.694753][T17584] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.694777][T17584] sock_sendmsg_nosec+0x13a/0x180 [ 439.694809][T17584] ____sys_sendmsg+0x54e/0x850 [ 439.694838][T17584] ? __pfx_____sys_sendmsg+0x10/0x10 [ 439.694872][T17584] ? import_iovec+0x73/0xa0 [ 439.694903][T17584] ___sys_sendmsg+0x2a5/0x360 [ 439.694926][T17584] ? __lock_acquire+0x683/0x2cf0 [ 439.694958][T17584] ? __pfx____sys_sendmsg+0x10/0x10 [ 439.695020][T17584] ? __fget_files+0x2a/0x420 [ 439.695045][T17584] ? __fget_files+0x3a2/0x420 [ 439.695081][T17584] __x64_sys_sendmsg+0x1b1/0x290 [ 439.695108][T17584] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 439.695151][T17584] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.695183][T17584] do_syscall_64+0x174/0x580 [ 439.695212][T17584] ? trace_irq_disable+0x3b/0x140 [ 439.695237][T17584] ? clear_bhb_loop+0x70/0xc0 [ 439.695262][T17584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.695283][T17584] RIP: 0033:0x7fc22019e0d9 [ 439.695305][T17584] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 439.695323][T17584] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 439.695345][T17584] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 439.695359][T17584] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 439.695372][T17584] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 439.695385][T17584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 439.695397][T17584] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 439.695431][T17584] [ 440.603831][T17609] FAULT_INJECTION: forcing a failure. [ 440.603831][T17609] name failslab, interval 1, probability 0, space 0, times 0 [ 440.668221][T17607] mac80211_hwsim hwsim11 syzkaller0: entered promiscuous mode [ 440.682100][T17609] CPU: 0 UID: 0 PID: 17609 Comm: syz.0.3456 Not tainted syzkaller #0 PREEMPT(full) [ 440.682128][T17609] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 440.682142][T17609] Call Trace: [ 440.682150][T17609] [ 440.682160][T17609] dump_stack_lvl+0xe8/0x150 [ 440.682194][T17609] should_fail_ex+0x40c/0x560 [ 440.682222][T17609] should_failslab+0xa8/0x100 [ 440.682255][T17609] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 440.682283][T17609] ? ip6_default_advmss+0x80/0x3b0 [ 440.682309][T17609] ? __alloc_skb+0x1d7/0x7a0 [ 440.682327][T17609] ? __alloc_skb+0x1d7/0x7a0 [ 440.682354][T17609] __alloc_skb+0x1d7/0x7a0 [ 440.682378][T17609] tcp_stream_alloc_skb+0x3f/0x580 [ 440.682407][T17609] ? __asan_memset+0x22/0x50 [ 440.682433][T17609] tcp_connect+0x1639/0x54e0 [ 440.682507][T17609] ? __pfx_tcp_connect+0x10/0x10 [ 440.682534][T17609] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 440.682562][T17609] ? lockdep_hardirqs_on+0x7a/0x110 [ 440.682599][T17609] ? ktime_get_with_offset+0x93/0x2d0 [ 440.682623][T17609] ? seqcount_lockdep_reader_access+0xea/0x100 [ 440.682658][T17609] ? __asan_memset+0x22/0x50 [ 440.682694][T17609] ? __pfx_tcp_fastopen_defer_connect+0x10/0x10 [ 440.682737][T17609] ? inet6_hash_connect+0xeb/0x170 [ 440.682775][T17609] tcp_v6_connect+0x14ed/0x1cf0 [ 440.682822][T17609] ? __pfx_tcp_v6_connect+0x10/0x10 [ 440.682850][T17609] ? __pfx_tomoyo_check_inet_address+0x10/0x10 [ 440.682895][T17609] __inet_stream_connect+0x258/0xe00 [ 440.682929][T17609] ? do_raw_spin_lock+0x12b/0x2f0 [ 440.682950][T17609] ? lock_sock_nested+0x6a/0x100 [ 440.682981][T17609] ? __pfx___inet_stream_connect+0x10/0x10 [ 440.683010][T17609] ? inet_stream_connect+0x51/0xa0 [ 440.683036][T17609] ? __local_bh_enable_ip+0xd0/0x130 [ 440.683063][T17609] inet_stream_connect+0x66/0xa0 [ 440.683091][T17609] __sys_connect+0x323/0x460 [ 440.683127][T17609] ? __pfx___sys_connect+0x10/0x10 [ 440.683173][T17609] ? __pfx_ksys_write+0x10/0x10 [ 440.683210][T17609] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.683234][T17609] __x64_sys_connect+0x7a/0x90 [ 440.683268][T17609] do_syscall_64+0x174/0x580 [ 440.683298][T17609] ? trace_irq_disable+0x3b/0x140 [ 440.683323][T17609] ? clear_bhb_loop+0x70/0xc0 [ 440.683349][T17609] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.683371][T17609] RIP: 0033:0x7fc22019e0d9 [ 440.683391][T17609] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 440.683409][T17609] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 440.683430][T17609] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 440.683446][T17609] RDX: 000000000000001c RSI: 0000200000000140 RDI: 0000000000000003 [ 440.683459][T17609] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 440.683472][T17609] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 440.683484][T17609] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 440.683518][T17609] [ 440.986084][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 441.455412][T17640] FAULT_INJECTION: forcing a failure. [ 441.455412][T17640] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 441.474656][T17642] netlink: 'syz.2.3465': attribute type 4 has an invalid length. [ 441.489413][T17640] CPU: 1 UID: 0 PID: 17640 Comm: syz.0.3467 Not tainted syzkaller #0 PREEMPT(full) [ 441.489441][T17640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 441.489454][T17640] Call Trace: [ 441.489463][T17640] [ 441.489472][T17640] dump_stack_lvl+0xe8/0x150 [ 441.489509][T17640] should_fail_ex+0x40c/0x560 [ 441.489535][T17640] _copy_from_iter+0x1d3/0x1660 [ 441.489557][T17640] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 441.489585][T17640] ? rcu_is_watching+0x15/0xb0 [ 441.489616][T17640] ? trace_kmem_cache_alloc+0x29/0xe0 [ 441.489642][T17640] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 441.489666][T17640] ? __pfx__copy_from_iter+0x10/0x10 [ 441.489690][T17640] ? __alloc_skb+0x276/0x7a0 [ 441.489709][T17640] ? __alloc_skb+0x276/0x7a0 [ 441.489734][T17640] ? netlink_sendmsg+0x650/0xb40 [ 441.489759][T17640] ? skb_put+0x112/0x210 [ 441.489782][T17640] netlink_sendmsg+0x6c0/0xb40 [ 441.489816][T17640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.489846][T17640] ? aa_sock_msg_perm+0xf1/0x1b0 [ 441.489882][T17640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.489906][T17640] sock_sendmsg_nosec+0x13a/0x180 [ 441.489938][T17640] ____sys_sendmsg+0x54e/0x850 [ 441.489975][T17640] ? __pfx_____sys_sendmsg+0x10/0x10 [ 441.490007][T17640] ? import_iovec+0x73/0xa0 [ 441.490038][T17640] ___sys_sendmsg+0x2a5/0x360 [ 441.490061][T17640] ? __lock_acquire+0x683/0x2cf0 [ 441.490092][T17640] ? __pfx____sys_sendmsg+0x10/0x10 [ 441.490153][T17640] ? __fget_files+0x2a/0x420 [ 441.490179][T17640] ? __fget_files+0x3a2/0x420 [ 441.490215][T17640] __x64_sys_sendmsg+0x1b1/0x290 [ 441.490242][T17640] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 441.490284][T17640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.490308][T17640] do_syscall_64+0x174/0x580 [ 441.490339][T17640] ? trace_irq_disable+0x3b/0x140 [ 441.490365][T17640] ? clear_bhb_loop+0x70/0xc0 [ 441.490391][T17640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.490413][T17640] RIP: 0033:0x7fc22019e0d9 [ 441.490433][T17640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.490451][T17640] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 441.490474][T17640] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 441.490489][T17640] RDX: 0000000000048000 RSI: 00002000000002c0 RDI: 0000000000000005 [ 441.490503][T17640] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 441.490516][T17640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.490528][T17640] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 441.490561][T17640] [ 441.996951][T17649] bridge0: port 1(bridge_slave_0) entered disabled state [ 442.643467][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 443.046122][T17688] __nla_validate_parse: 7 callbacks suppressed [ 443.046144][T17688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3483'. [ 443.149640][T17693] syzkaller0: left allmulticast mode [ 443.340748][ C1] TC_ACT_REPEAT abuse ? [ 443.441718][ C1] TC_ACT_REPEAT abuse ? [ 443.544422][ C1] TC_ACT_REPEAT abuse ? [ 443.596558][T17707] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3490'. [ 443.646639][ C1] TC_ACT_REPEAT abuse ? [ 443.691592][T17712] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3491'. [ 443.702861][T17713] FAULT_INJECTION: forcing a failure. [ 443.702861][T17713] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 443.719258][T17706] mac80211_hwsim hwsim24 syzkaller0: left promiscuous mode [ 443.731005][T17713] CPU: 1 UID: 0 PID: 17713 Comm: syz.3.3492 Not tainted syzkaller #0 PREEMPT(full) [ 443.731034][T17713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 443.731047][T17713] Call Trace: [ 443.731055][T17713] [ 443.731064][T17713] dump_stack_lvl+0xe8/0x150 [ 443.731098][T17713] should_fail_ex+0x40c/0x560 [ 443.731125][T17713] _copy_from_iter+0x1d3/0x1660 [ 443.731148][T17713] ? kmem_cache_alloc_node_noprof+0x1d1/0x610 [ 443.731176][T17713] ? rcu_is_watching+0x15/0xb0 [ 443.731206][T17713] ? trace_kmem_cache_alloc+0x29/0xe0 [ 443.731232][T17713] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 443.731263][T17713] ? __pfx__copy_from_iter+0x10/0x10 [ 443.731286][T17713] ? __alloc_skb+0x276/0x7a0 [ 443.731305][T17713] ? __alloc_skb+0x276/0x7a0 [ 443.731330][T17713] ? netlink_sendmsg+0x650/0xb40 [ 443.731354][T17713] ? skb_put+0x112/0x210 [ 443.731377][T17713] netlink_sendmsg+0x6c0/0xb40 [ 443.731412][T17713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.731441][T17713] ? aa_sock_msg_perm+0xf1/0x1b0 [ 443.731477][T17713] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.731499][T17713] sock_sendmsg_nosec+0x13a/0x180 [ 443.731531][T17713] ____sys_sendmsg+0x54e/0x850 [ 443.731560][T17713] ? __pfx_____sys_sendmsg+0x10/0x10 [ 443.731592][T17713] ? import_iovec+0x73/0xa0 [ 443.731623][T17713] ___sys_sendmsg+0x2a5/0x360 [ 443.731645][T17713] ? __lock_acquire+0x683/0x2cf0 [ 443.731676][T17713] ? __pfx____sys_sendmsg+0x10/0x10 [ 443.731735][T17713] ? __fget_files+0x2a/0x420 [ 443.731760][T17713] ? __fget_files+0x3a2/0x420 [ 443.731796][T17713] __x64_sys_sendmsg+0x1b1/0x290 [ 443.731823][T17713] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 443.731865][T17713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.731889][T17713] do_syscall_64+0x174/0x580 [ 443.731924][T17713] ? trace_irq_disable+0x3b/0x140 [ 443.731949][T17713] ? clear_bhb_loop+0x70/0xc0 [ 443.731975][T17713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.731996][T17713] RIP: 0033:0x7f959239e0d9 [ 443.732016][T17713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.732034][T17713] RSP: 002b:00007f95931b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.732057][T17713] RAX: ffffffffffffffda RBX: 00007f9592625fa0 RCX: 00007f959239e0d9 [ 443.732072][T17713] RDX: 0000000020000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 443.732086][T17713] RBP: 00007f95931b5090 R08: 0000000000000000 R09: 0000000000000000 [ 443.732099][T17713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.732111][T17713] R13: 00007f9592626038 R14: 00007f9592625fa0 R15: 00007fffa0275bb8 [ 443.732142][T17713] [ 444.010364][ C1] TC_ACT_REPEAT abuse ? [ 444.056196][ C1] TC_ACT_REPEAT abuse ? [ 444.108659][T17706] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 444.158596][ C1] TC_ACT_REPEAT abuse ? [ 444.260957][ C1] TC_ACT_REPEAT abuse ? [ 444.363391][ C1] TC_ACT_REPEAT abuse ? [ 444.431445][T17720] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3495'. [ 444.465793][ C1] TC_ACT_REPEAT abuse ? [ 445.012485][T17736] ip6gre2: entered promiscuous mode [ 445.030256][T17736] ip6gre2: entered allmulticast mode [ 445.257999][T17739] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3502'. [ 445.422926][T17743] netlink: 'syz.3.3504': attribute type 13 has an invalid length. [ 445.438573][T17745] FAULT_INJECTION: forcing a failure. [ 445.438573][T17745] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.466178][T17747] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 445.508523][T17745] CPU: 0 UID: 0 PID: 17745 Comm: syz.0.3505 Not tainted syzkaller #0 PREEMPT(full) [ 445.508554][T17745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 445.508567][T17745] Call Trace: [ 445.508576][T17745] [ 445.508610][T17745] dump_stack_lvl+0xe8/0x150 [ 445.508645][T17745] should_fail_ex+0x40c/0x560 [ 445.508671][T17745] _copy_from_user+0x2d/0xb0 [ 445.508700][T17745] __copy_msghdr+0x390/0x590 [ 445.508728][T17745] ___sys_sendmsg+0x213/0x360 [ 445.508750][T17745] ? __lock_acquire+0x683/0x2cf0 [ 445.508782][T17745] ? __pfx____sys_sendmsg+0x10/0x10 [ 445.508812][T17745] ? kstrtouint+0x6e/0xe0 [ 445.508860][T17745] ? __fget_files+0x2a/0x420 [ 445.508887][T17745] ? __fget_files+0x3a2/0x420 [ 445.508923][T17745] __sys_sendmmsg+0x273/0x4d0 [ 445.508953][T17745] ? __pfx___sys_sendmmsg+0x10/0x10 [ 445.508985][T17745] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 445.509030][T17745] ? ksys_write+0x242/0x270 [ 445.509062][T17745] ? __pfx_ksys_write+0x10/0x10 [ 445.509098][T17745] __x64_sys_sendmmsg+0xa0/0xc0 [ 445.509122][T17745] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.509145][T17745] do_syscall_64+0x174/0x580 [ 445.509176][T17745] ? trace_irq_disable+0x3b/0x140 [ 445.509201][T17745] ? clear_bhb_loop+0x70/0xc0 [ 445.509228][T17745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.509250][T17745] RIP: 0033:0x7fc22019e0d9 [ 445.509270][T17745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.509289][T17745] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 445.509312][T17745] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 445.509327][T17745] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 000000000000000c [ 445.509341][T17745] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 445.509354][T17745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 445.509366][T17745] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 445.509397][T17745] [ 445.810493][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 446.289781][ T5743] bond_slave_0: entered promiscuous mode [ 446.297514][ T5743] bond_slave_1: entered promiscuous mode [ 446.327484][T17753] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3508'. [ 446.367642][ T24] bond_slave_0: left promiscuous mode [ 446.373199][ T24] bond_slave_1: left promiscuous mode [ 446.423965][T17764] IPVS: set_ctl: invalid protocol: 148 224.0.0.2:20004 [ 446.903556][T17778] netlink: 'syz.3.3515': attribute type 10 has an invalid length. [ 447.248187][ T5612] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 447.264503][ T5612] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 447.281510][ T5612] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 447.295793][ T5612] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 447.304019][ T5612] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 447.313549][T17794] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3517'. [ 447.335681][T17795] trusted_key: syz.2.3516 sent an empty control message without MSG_MORE. [ 448.018649][T17806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3520'. [ 448.019690][T17812] batadv_slave_1: entered promiscuous mode [ 448.092463][T17817] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3520'. [ 448.213420][T17806] bond0: (slave bond_slave_1): Releasing backup interface [ 448.356993][ C1] net_ratelimit: 39 callbacks suppressed [ 448.357013][ C1] TC_ACT_REPEAT abuse ? [ 448.416351][ T7530] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.459374][ C1] TC_ACT_REPEAT abuse ? [ 448.561753][ C1] TC_ACT_REPEAT abuse ? [ 448.664151][ C1] TC_ACT_REPEAT abuse ? [ 448.720748][T17807] batadv_slave_1: left promiscuous mode [ 448.766574][ C1] TC_ACT_REPEAT abuse ? [ 448.825414][ T7530] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.868983][ C1] TC_ACT_REPEAT abuse ? [ 448.971422][ C1] TC_ACT_REPEAT abuse ? [ 449.073764][ C1] TC_ACT_REPEAT abuse ? [ 449.097764][ T7530] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.166017][T17837] mac80211_hwsim hwsim8 syzkaller0: Caught tx_queue_len zero misconfig [ 449.176232][ C1] TC_ACT_REPEAT abuse ? [ 449.278564][ C1] TC_ACT_REPEAT abuse ? [ 449.346190][ T7530] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.417836][ T5612] Bluetooth: hci0: command tx timeout [ 449.449209][T17845] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3529'. [ 450.252519][ T7530] bridge_slave_1: left allmulticast mode [ 450.276557][ T7530] bridge_slave_1: left promiscuous mode [ 450.302454][ T7530] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.382005][ T7530] bridge_slave_0: left allmulticast mode [ 450.412112][ T7530] bridge_slave_0: left promiscuous mode [ 450.430399][ T7530] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.948847][ T5612] block nbd5: Receive control failed (result -32) [ 451.215514][ T7530] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 451.249247][ T7530] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 451.283171][ T7530] bond0 (unregistering): Released all slaves [ 451.318524][T17869] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3537'. [ 451.434096][T17906] netlink: 120 bytes leftover after parsing attributes in process `syz.2.3544'. [ 451.509563][ T5612] Bluetooth: hci0: command tx timeout [ 451.549776][T17788] bridge0: port 1(bridge_slave_0) entered blocking state [ 451.563037][T17788] bridge0: port 1(bridge_slave_0) entered disabled state [ 451.579702][T17788] bridge_slave_0: entered allmulticast mode [ 451.595078][T17788] bridge_slave_0: entered promiscuous mode [ 451.614138][T17906] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3544'. [ 451.644312][T17788] bridge0: port 2(bridge_slave_1) entered blocking state [ 451.651991][T17788] bridge0: port 2(bridge_slave_1) entered disabled state [ 451.659892][T17788] bridge_slave_1: entered allmulticast mode [ 451.667476][T17788] bridge_slave_1: entered promiscuous mode [ 451.751423][ T5270] 8021q: adding VLAN 0 to HW filter on device eth1 [ 451.824719][T17788] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 451.923259][T17788] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 452.029272][ T7530] hsr_slave_0: left promiscuous mode [ 452.044076][ T7530] hsr_slave_1: left promiscuous mode [ 452.058028][ T7530] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 452.066762][ T7530] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 452.075617][ T7530] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.083326][ T7530] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.105264][ T7530] veth1_macvtap: left promiscuous mode [ 452.112991][ T7530] veth0_macvtap: left promiscuous mode [ 452.118868][T17929] netlink: 'syz.3.3549': attribute type 1 has an invalid length. [ 452.129766][ T7530] veth1_vlan: left promiscuous mode [ 452.142230][ T7530] veth0_vlan: left promiscuous mode [ 452.154003][T17929] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3549'. [ 452.180789][T17929] netlink: 'syz.3.3549': attribute type 1 has an invalid length. [ 452.674426][ T7530] team0 (unregistering): Port device team_slave_1 removed [ 452.717994][ T7530] team0 (unregistering): Port device team_slave_0 removed [ 452.873360][T17920] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3547'. [ 452.882902][T17923] netlink: 140 bytes leftover after parsing attributes in process `syz.2.3546'. [ 452.894798][T17788] team0: Port device team_slave_0 added [ 453.008599][T17788] team0: Port device team_slave_1 added [ 453.157286][T17788] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 453.173578][T17788] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 453.251888][T17788] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 453.298193][T17788] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 453.323895][T17788] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 453.374611][ C1] net_ratelimit: 41 callbacks suppressed [ 453.374629][ C1] TC_ACT_REPEAT abuse ? [ 453.464654][T17788] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 453.477001][ C1] TC_ACT_REPEAT abuse ? [ 453.520523][T17966] FAULT_INJECTION: forcing a failure. [ 453.520523][T17966] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 453.565898][T17951] veth0_to_bond: entered allmulticast mode [ 453.577265][ T5612] Bluetooth: hci0: command tx timeout [ 453.580155][ C1] TC_ACT_REPEAT abuse ? [ 453.587275][T17966] CPU: 1 UID: 0 PID: 17966 Comm: syz.3.3559 Not tainted syzkaller #0 PREEMPT(full) [ 453.587302][T17966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 453.587315][T17966] Call Trace: [ 453.587324][T17966] [ 453.587333][T17966] dump_stack_lvl+0xe8/0x150 [ 453.587366][T17966] should_fail_ex+0x40c/0x560 [ 453.587394][T17966] _copy_to_user+0x31/0xb0 [ 453.587424][T17966] simple_read_from_buffer+0xe1/0x170 [ 453.587464][T17966] proc_fail_nth_read+0x1bb/0x230 [ 453.587497][T17966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 453.587529][T17966] ? rw_verify_area+0x24a/0x4c0 [ 453.587560][T17966] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 453.587587][T17966] vfs_read+0x213/0xa80 [ 453.587621][T17966] ? __pfx___mutex_lock+0x10/0x10 [ 453.587652][T17966] ? __pfx_vfs_read+0x10/0x10 [ 453.587683][T17966] ? __fget_files+0x2a/0x420 [ 453.587714][T17966] ? __fget_files+0x3a2/0x420 [ 453.587739][T17966] ? __fget_files+0x2a/0x420 [ 453.587774][T17966] ksys_read+0x150/0x270 [ 453.587808][T17966] ? __pfx_ksys_read+0x10/0x10 [ 453.587866][T17966] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.587891][T17966] do_syscall_64+0x174/0x580 [ 453.587944][T17966] ? trace_irq_disable+0x3b/0x140 [ 453.587971][T17966] ? clear_bhb_loop+0x70/0xc0 [ 453.587998][T17966] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 453.588021][T17966] RIP: 0033:0x7f959235e90e [ 453.588042][T17966] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 453.588060][T17966] RSP: 002b:00007f95931b4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 453.588084][T17966] RAX: ffffffffffffffda RBX: 00007f95931b56c0 RCX: 00007f959235e90e [ 453.588100][T17966] RDX: 000000000000000f RSI: 00007f95931b50a0 RDI: 0000000000000004 [ 453.588113][T17966] RBP: 00007f95931b5090 R08: 0000000000000000 R09: 0000000000000000 [ 453.588127][T17966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 453.588139][T17966] R13: 00007f9592626038 R14: 00007f9592625fa0 R15: 00007fffa0275bb8 [ 453.588174][T17966] [ 453.795850][ C1] TC_ACT_REPEAT abuse ? [ 453.886527][ C1] TC_ACT_REPEAT abuse ? [ 453.968211][T17788] hsr_slave_0: entered promiscuous mode [ 453.974896][T17788] hsr_slave_1: entered promiscuous mode [ 453.981323][T17788] debugfs: 'hsr0' already exists in 'hsr' [ 453.987110][T17788] Cannot create hsr debugfs directory [ 453.992836][ C1] TC_ACT_REPEAT abuse ? [ 454.093349][ C1] TC_ACT_REPEAT abuse ? [ 454.193756][ C1] TC_ACT_REPEAT abuse ? [ 454.296113][ C1] TC_ACT_REPEAT abuse ? [ 454.388125][T17993] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3564'. [ 454.398562][ C1] TC_ACT_REPEAT abuse ? [ 455.170407][ T5270] 8021q: adding VLAN 0 to HW filter on device eth2 [ 455.297175][T18009] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3567'. [ 455.362676][T18009] FAULT_INJECTION: forcing a failure. [ 455.362676][T18009] name failslab, interval 1, probability 0, space 0, times 0 [ 455.381900][T18009] CPU: 0 UID: 0 PID: 18009 Comm: syz.0.3567 Not tainted syzkaller #0 PREEMPT(full) [ 455.381927][T18009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 455.381940][T18009] Call Trace: [ 455.381948][T18009] [ 455.381956][T18009] dump_stack_lvl+0xe8/0x150 [ 455.381989][T18009] should_fail_ex+0x40c/0x560 [ 455.382016][T18009] should_failslab+0xa8/0x100 [ 455.382045][T18009] __kmalloc_cache_noprof+0xa8/0x660 [ 455.382072][T18009] ? netlbl_mgmt_add_common+0x57/0x1260 [ 455.382092][T18009] ? netlbl_mgmt_add_common+0x57/0x1260 [ 455.382121][T18009] netlbl_mgmt_add_common+0x57/0x1260 [ 455.382143][T18009] ? rcu_is_watching+0x15/0xb0 [ 455.382173][T18009] ? apparmor_current_getlsmprop_subj+0xce/0x150 [ 455.382206][T18009] netlbl_mgmt_adddef+0x28b/0x330 [ 455.382231][T18009] ? __pfx_netlbl_mgmt_adddef+0x10/0x10 [ 455.382257][T18009] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 455.382289][T18009] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 455.382326][T18009] genl_family_rcv_msg_doit+0x233/0x340 [ 455.382362][T18009] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 455.382404][T18009] ? bpf_lsm_capable+0x9/0x20 [ 455.382427][T18009] ? security_capable+0x7e/0x2c0 [ 455.382459][T18009] genl_rcv_msg+0x614/0x7a0 [ 455.382495][T18009] ? __pfx_genl_rcv_msg+0x10/0x10 [ 455.382522][T18009] ? __pfx_netlbl_mgmt_adddef+0x10/0x10 [ 455.382575][T18009] netlink_rcv_skb+0x226/0x4a0 [ 455.382601][T18009] ? __pfx_genl_rcv_msg+0x10/0x10 [ 455.382632][T18009] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 455.382673][T18009] ? down_read+0x2be/0x330 [ 455.382710][T18009] genl_rcv+0x28/0x40 [ 455.382735][T18009] netlink_unicast+0x7bb/0x940 [ 455.382766][T18009] netlink_sendmsg+0x813/0xb40 [ 455.382823][T18009] ? __pfx_netlink_sendmsg+0x10/0x10 [ 455.382865][T18009] ? aa_sock_msg_perm+0xf1/0x1b0 [ 455.382898][T18009] ? __pfx_netlink_sendmsg+0x10/0x10 [ 455.382920][T18009] sock_sendmsg_nosec+0x13a/0x180 [ 455.382951][T18009] ____sys_sendmsg+0x54e/0x850 [ 455.382979][T18009] ? __pfx_____sys_sendmsg+0x10/0x10 [ 455.383010][T18009] ? import_iovec+0x73/0xa0 [ 455.383057][T18009] ___sys_sendmsg+0x2a5/0x360 [ 455.383079][T18009] ? __lock_acquire+0x683/0x2cf0 [ 455.383111][T18009] ? __pfx____sys_sendmsg+0x10/0x10 [ 455.383171][T18009] ? __fget_files+0x2a/0x420 [ 455.383197][T18009] ? __fget_files+0x3a2/0x420 [ 455.383234][T18009] __x64_sys_sendmsg+0x1b1/0x290 [ 455.383261][T18009] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 455.383306][T18009] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.383330][T18009] do_syscall_64+0x174/0x580 [ 455.383360][T18009] ? trace_irq_disable+0x3b/0x140 [ 455.383385][T18009] ? clear_bhb_loop+0x70/0xc0 [ 455.383412][T18009] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 455.383433][T18009] RIP: 0033:0x7fc22019e0d9 [ 455.383453][T18009] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 455.383471][T18009] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 455.383493][T18009] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 455.383507][T18009] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000006 [ 455.383520][T18009] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 455.383533][T18009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 455.383545][T18009] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 455.383579][T18009] [ 455.731163][ T5612] Bluetooth: hci0: command tx timeout [ 455.930166][T18002] tipc: Resetting bearer [ 456.586860][T18040] FAULT_INJECTION: forcing a failure. [ 456.586860][T18040] name failslab, interval 1, probability 0, space 0, times 0 [ 456.637182][T18040] CPU: 0 UID: 0 PID: 18040 Comm: syz.3.3573 Not tainted syzkaller #0 PREEMPT(full) [ 456.637210][T18040] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 456.637223][T18040] Call Trace: [ 456.637232][T18040] [ 456.637241][T18040] dump_stack_lvl+0xe8/0x150 [ 456.637275][T18040] should_fail_ex+0x40c/0x560 [ 456.637303][T18040] should_failslab+0xa8/0x100 [ 456.637335][T18040] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 456.637361][T18040] ? skb_clone+0x212/0x3a0 [ 456.637383][T18040] ? skb_clone+0x212/0x3a0 [ 456.637414][T18040] skb_clone+0x212/0x3a0 [ 456.637441][T18040] __netlink_deliver_tap+0x413/0x860 [ 456.637479][T18040] ? netlink_deliver_tap+0x2e/0x1b0 [ 456.637505][T18040] netlink_deliver_tap+0x19c/0x1b0 [ 456.637530][T18040] netlink_unicast+0x77f/0x940 [ 456.637563][T18040] netlink_sendmsg+0x813/0xb40 [ 456.637599][T18040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.637630][T18040] ? aa_sock_msg_perm+0xf1/0x1b0 [ 456.637666][T18040] ? __pfx_netlink_sendmsg+0x10/0x10 [ 456.637690][T18040] sock_sendmsg_nosec+0x13a/0x180 [ 456.637738][T18040] ____sys_sendmsg+0x54e/0x850 [ 456.637768][T18040] ? __pfx_____sys_sendmsg+0x10/0x10 [ 456.637807][T18040] ? import_iovec+0x73/0xa0 [ 456.637862][T18040] ___sys_sendmsg+0x2a5/0x360 [ 456.637885][T18040] ? __lock_acquire+0x683/0x2cf0 [ 456.637918][T18040] ? __pfx____sys_sendmsg+0x10/0x10 [ 456.637983][T18040] ? __fget_files+0x2a/0x420 [ 456.638009][T18040] ? __fget_files+0x3a2/0x420 [ 456.638047][T18040] __x64_sys_sendmsg+0x1b1/0x290 [ 456.638075][T18040] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 456.638120][T18040] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.638145][T18040] do_syscall_64+0x174/0x580 [ 456.638176][T18040] ? trace_irq_disable+0x3b/0x140 [ 456.638203][T18040] ? clear_bhb_loop+0x70/0xc0 [ 456.638231][T18040] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 456.638253][T18040] RIP: 0033:0x7f959239e0d9 [ 456.638275][T18040] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 456.638295][T18040] RSP: 002b:00007f95931b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 456.638318][T18040] RAX: ffffffffffffffda RBX: 00007f9592625fa0 RCX: 00007f959239e0d9 [ 456.638333][T18040] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 456.638347][T18040] RBP: 00007f95931b5090 R08: 0000000000000000 R09: 0000000000000000 [ 456.638360][T18040] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 456.638372][T18040] R13: 00007f9592626038 R14: 00007f9592625fa0 R15: 00007fffa0275bb8 [ 456.638407][T18040] [ 456.653074][T18043] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3572'. [ 456.996025][T17788] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 457.058159][T17788] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 457.094796][T17788] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 457.155727][T17788] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 457.193494][T17788] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 457.245020][T17788] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 457.273278][T17788] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 457.314754][T17788] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 457.692458][T17788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 457.786706][T17788] 8021q: adding VLAN 0 to HW filter on device team0 [ 457.826275][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.833648][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 457.875493][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 457.882769][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.024181][T18082] netlink: 200 bytes leftover after parsing attributes in process `syz.0.3581'. [ 458.340425][T18099] FAULT_INJECTION: forcing a failure. [ 458.340425][T18099] name failslab, interval 1, probability 0, space 0, times 0 [ 458.392075][T18099] CPU: 0 UID: 0 PID: 18099 Comm: syz.0.3585 Not tainted syzkaller #0 PREEMPT(full) [ 458.392105][T18099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 458.392118][T18099] Call Trace: [ 458.392127][T18099] [ 458.392136][T18099] dump_stack_lvl+0xe8/0x150 [ 458.392184][T18099] should_fail_ex+0x40c/0x560 [ 458.392231][T18099] should_failslab+0xa8/0x100 [ 458.392264][T18099] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 458.392289][T18099] ? local_lock_release+0x9c/0x160 [ 458.392324][T18099] ? __alloc_skb+0x1d7/0x7a0 [ 458.392341][T18099] ? __alloc_skb+0x1d7/0x7a0 [ 458.392369][T18099] __alloc_skb+0x1d7/0x7a0 [ 458.392394][T18099] ctrl_getfamily+0x3d0/0x5c0 [ 458.392429][T18099] ? __pfx_ctrl_getfamily+0x10/0x10 [ 458.392472][T18099] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 458.392511][T18099] genl_family_rcv_msg_doit+0x233/0x340 [ 458.392556][T18099] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 458.392598][T18099] ? __dev_queue_xmit+0x29b/0x3820 [ 458.392634][T18099] genl_rcv_msg+0x614/0x7a0 [ 458.392671][T18099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.392701][T18099] ? __pfx_ctrl_getfamily+0x10/0x10 [ 458.392730][T18099] ? __pfx_ref_tracker_free+0x10/0x10 [ 458.392766][T18099] netlink_rcv_skb+0x226/0x4a0 [ 458.392792][T18099] ? __pfx_genl_rcv_msg+0x10/0x10 [ 458.392843][T18099] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 458.392883][T18099] ? down_read+0x2be/0x330 [ 458.392909][T18099] genl_rcv+0x28/0x40 [ 458.392937][T18099] netlink_unicast+0x7bb/0x940 [ 458.392973][T18099] netlink_sendmsg+0x813/0xb40 [ 458.393010][T18099] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.393040][T18099] ? aa_sock_msg_perm+0xf1/0x1b0 [ 458.393079][T18099] ? __pfx_netlink_sendmsg+0x10/0x10 [ 458.393103][T18099] sock_sendmsg_nosec+0x13a/0x180 [ 458.393140][T18099] __sys_sendto+0x408/0x5a0 [ 458.393169][T18099] ? __pfx___sys_sendto+0x10/0x10 [ 458.393222][T18099] ? do_user_addr_fault+0xc4a/0x1340 [ 458.393258][T18099] __x64_sys_sendto+0xde/0x100 [ 458.393281][T18099] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.393305][T18099] do_syscall_64+0x174/0x580 [ 458.393334][T18099] ? trace_irq_disable+0x3b/0x140 [ 458.393361][T18099] ? clear_bhb_loop+0x70/0xc0 [ 458.393388][T18099] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 458.393410][T18099] RIP: 0033:0x7fc22015e90e [ 458.393431][T18099] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 458.393449][T18099] RSP: 002b:00007fc221020e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 458.393472][T18099] RAX: ffffffffffffffda RBX: 00007fc2210226c0 RCX: 00007fc22015e90e [ 458.393489][T18099] RDX: 0000000000000020 RSI: 00007fc221021000 RDI: 0000000000000007 [ 458.393503][T18099] RBP: 0000000000000000 R08: 00007fc221020f04 R09: 000000000000000c [ 458.393516][T18099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 458.393529][T18099] R13: 00007fc221020f58 R14: 00007fc221021000 R15: 0000000000000000 [ 458.393583][T18099] [ 459.098880][T18120] FAULT_INJECTION: forcing a failure. [ 459.098880][T18120] name failslab, interval 1, probability 0, space 0, times 0 [ 459.143016][T18120] CPU: 0 UID: 0 PID: 18120 Comm: syz.2.3591 Not tainted syzkaller #0 PREEMPT(full) [ 459.143046][T18120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 459.143059][T18120] Call Trace: [ 459.143068][T18120] [ 459.143077][T18120] dump_stack_lvl+0xe8/0x150 [ 459.143112][T18120] should_fail_ex+0x40c/0x560 [ 459.143140][T18120] should_failslab+0xa8/0x100 [ 459.143172][T18120] __kmalloc_noprof+0xfe/0x720 [ 459.143196][T18120] ? __kasan_kmalloc+0x93/0xb0 [ 459.143224][T18120] ? nla_strdup+0x9d/0x140 [ 459.143247][T18120] ? nla_strdup+0x9d/0x140 [ 459.143278][T18120] nla_strdup+0x9d/0x140 [ 459.143305][T18120] nf_tables_newtable+0x49a/0x1990 [ 459.143358][T18120] nfnetlink_rcv+0x1288/0x28c0 [ 459.143415][T18120] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 459.143455][T18120] ? ref_tracker_free+0x689/0x830 [ 459.143516][T18120] ? skb_clone+0x246/0x3a0 [ 459.143544][T18120] ? __netlink_deliver_tap+0x811/0x860 [ 459.143579][T18120] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.143603][T18120] ? netlink_deliver_tap+0x2e/0x1b0 [ 459.143633][T18120] netlink_unicast+0x7bb/0x940 [ 459.143668][T18120] netlink_sendmsg+0x813/0xb40 [ 459.143703][T18120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.143733][T18120] ? aa_sock_msg_perm+0xf1/0x1b0 [ 459.143770][T18120] ? __pfx_netlink_sendmsg+0x10/0x10 [ 459.143793][T18120] sock_sendmsg_nosec+0x13a/0x180 [ 459.143825][T18120] ____sys_sendmsg+0x54e/0x850 [ 459.143854][T18120] ? __pfx_____sys_sendmsg+0x10/0x10 [ 459.143887][T18120] ? import_iovec+0x73/0xa0 [ 459.143919][T18120] ___sys_sendmsg+0x2a5/0x360 [ 459.143941][T18120] ? __lock_acquire+0x683/0x2cf0 [ 459.143973][T18120] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.144035][T18120] ? __fget_files+0x2a/0x420 [ 459.144060][T18120] ? __fget_files+0x3a2/0x420 [ 459.144098][T18120] __x64_sys_sendmsg+0x1b1/0x290 [ 459.144124][T18120] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 459.144167][T18120] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.144190][T18120] do_syscall_64+0x174/0x580 [ 459.144220][T18120] ? trace_irq_disable+0x3b/0x140 [ 459.144245][T18120] ? clear_bhb_loop+0x70/0xc0 [ 459.144271][T18120] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.144292][T18120] RIP: 0033:0x7f2906d9e0d9 [ 459.144312][T18120] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 459.144330][T18120] RSP: 002b:00007f2907b83028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 459.144352][T18120] RAX: ffffffffffffffda RBX: 00007f2907025fa0 RCX: 00007f2906d9e0d9 [ 459.144367][T18120] RDX: 0000000000000000 RSI: 000020000000c2c0 RDI: 0000000000000003 [ 459.144379][T18120] RBP: 00007f2907b83090 R08: 0000000000000000 R09: 0000000000000000 [ 459.144391][T18120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 459.144403][T18120] R13: 00007f2907026038 R14: 00007f2907025fa0 R15: 00007ffe8c640988 [ 459.144436][T18120] [ 459.504037][T18129] FAULT_INJECTION: forcing a failure. [ 459.504037][T18129] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 459.517291][T18129] CPU: 0 UID: 0 PID: 18129 Comm: syz.3.3592 Not tainted syzkaller #0 PREEMPT(full) [ 459.517321][T18129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 459.517334][T18129] Call Trace: [ 459.517343][T18129] [ 459.517352][T18129] dump_stack_lvl+0xe8/0x150 [ 459.517388][T18129] should_fail_ex+0x40c/0x560 [ 459.517416][T18129] _copy_from_user+0x2d/0xb0 [ 459.517445][T18129] __copy_msghdr+0x390/0x590 [ 459.517483][T18129] ___sys_sendmsg+0x213/0x360 [ 459.517507][T18129] ? __lock_acquire+0x683/0x2cf0 [ 459.517538][T18129] ? __pfx____sys_sendmsg+0x10/0x10 [ 459.517599][T18129] ? __fget_files+0x2a/0x420 [ 459.517626][T18129] ? __fget_files+0x3a2/0x420 [ 459.517663][T18129] __x64_sys_sendmsg+0x1b1/0x290 [ 459.517690][T18129] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 459.517733][T18129] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.517757][T18129] do_syscall_64+0x174/0x580 [ 459.517793][T18129] ? trace_irq_disable+0x3b/0x140 [ 459.517818][T18129] ? clear_bhb_loop+0x70/0xc0 [ 459.517863][T18129] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 459.517884][T18129] RIP: 0033:0x7f959239e0d9 [ 459.517905][T18129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 459.517923][T18129] RSP: 002b:00007f95931b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 459.517946][T18129] RAX: ffffffffffffffda RBX: 00007f9592625fa0 RCX: 00007f959239e0d9 [ 459.517962][T18129] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 459.517976][T18129] RBP: 00007f95931b5090 R08: 0000000000000000 R09: 0000000000000000 [ 459.517989][T18129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 459.518001][T18129] R13: 00007f9592626038 R14: 00007f9592625fa0 R15: 00007fffa0275bb8 [ 459.518035][T18129] [ 459.989415][T18135] ip6gre2: entered promiscuous mode [ 460.017307][T18143] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 460.062580][T18135] ip6gre2: entered allmulticast mode [ 460.155416][T17788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 460.339316][T18150] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3596'. [ 460.391057][T17788] veth0_vlan: entered promiscuous mode [ 460.431813][T18159] mac80211_hwsim hwsim24 syzkaller0: left allmulticast mode [ 460.453399][T17788] veth1_vlan: entered promiscuous mode [ 460.531856][ C0] net_ratelimit: 12 callbacks suppressed [ 460.531875][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 460.595825][T17788] veth0_macvtap: entered promiscuous mode [ 460.644455][T17788] veth1_macvtap: entered promiscuous mode [ 460.728146][T17788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 460.773842][ T57] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 460.799114][ T57] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 460.808405][ T5741] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 460.825010][T18170] netlink: 116 bytes leftover after parsing attributes in process `syz.0.3601'. [ 460.863212][T17788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 460.888810][T18170] vxcan0: tx drop: invalid da for name 0x00000000000000c8 [ 460.931959][T18175] FAULT_INJECTION: forcing a failure. [ 460.931959][T18175] name failslab, interval 1, probability 0, space 0, times 0 [ 460.944865][ T7530] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.954363][ T7530] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 460.963842][T18175] CPU: 0 UID: 0 PID: 18175 Comm: syz.3.3603 Not tainted syzkaller #0 PREEMPT(full) [ 460.963869][T18175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 460.963882][T18175] Call Trace: [ 460.963890][T18175] [ 460.963899][T18175] dump_stack_lvl+0xe8/0x150 [ 460.963932][T18175] should_fail_ex+0x40c/0x560 [ 460.963960][T18175] should_failslab+0xa8/0x100 [ 460.963992][T18175] __kmalloc_cache_noprof+0xa8/0x660 [ 460.964018][T18175] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 460.964045][T18175] ? __kmalloc_cache_noprof+0x150/0x660 [ 460.964070][T18175] ? sctp_add_bind_addr+0x8c/0x370 [ 460.964095][T18175] ? sctp_add_bind_addr+0x8c/0x370 [ 460.964129][T18175] sctp_add_bind_addr+0x8c/0x370 [ 460.964161][T18175] sctp_copy_local_addr_list+0x31a/0x4e0 [ 460.964192][T18175] ? sctp_copy_local_addr_list+0xa3/0x4e0 [ 460.964221][T18175] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 460.964251][T18175] ? sctp_v6_is_any+0x64/0x80 [ 460.964281][T18175] ? sctp_copy_one_addr+0x93/0x360 [ 460.964311][T18175] sctp_bind_addr_copy+0xb3/0x3c0 [ 460.964354][T18175] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 460.964390][T18175] sctp_connect_new_asoc+0x2ff/0x6b0 [ 460.964446][T18175] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 460.964488][T18175] ? sctp_inet6_send_verify+0x23a/0x300 [ 460.964516][T18175] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 460.964553][T18175] __sctp_connect+0x5cb/0xdc0 [ 460.964601][T18175] ? __pfx___sctp_connect+0x10/0x10 [ 460.964633][T18175] ? sctp_setsockopt+0x21c/0x12c0 [ 460.964666][T18175] ? security_sctp_bind_connect+0x7e/0x2c0 [ 460.964698][T18175] ? __sctp_setsockopt_connectx+0xc7/0x190 [ 460.964729][T18175] sctp_setsockopt+0x70b/0x12c0 [ 460.964760][T18175] ? sock_common_setsockopt+0x36/0xc0 [ 460.964791][T18175] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 460.964824][T18175] do_sock_setsockopt+0x17c/0x1b0 [ 460.964854][T18175] __x64_sys_setsockopt+0x13d/0x1b0 [ 460.964880][T18175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.964905][T18175] do_syscall_64+0x174/0x580 [ 460.964936][T18175] ? trace_irq_disable+0x3b/0x140 [ 460.964963][T18175] ? clear_bhb_loop+0x70/0xc0 [ 460.964990][T18175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 460.965012][T18175] RIP: 0033:0x7f959239e0d9 [ 460.965033][T18175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 460.965051][T18175] RSP: 002b:00007f95931b5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 460.965073][T18175] RAX: ffffffffffffffda RBX: 00007f9592625fa0 RCX: 00007f959239e0d9 [ 460.965089][T18175] RDX: 000000000000006e RSI: 0000000000000084 RDI: 0000000000000003 [ 460.965101][T18175] RBP: 00007f95931b5090 R08: 000000000000001c R09: 0000000000000000 [ 460.965115][T18175] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000002 [ 460.965129][T18175] R13: 00007f9592626038 R14: 00007f9592625fa0 R15: 00007fffa0275bb8 [ 460.965165][T18175] [ 460.976931][ T7530] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.592117][ T155] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 461.650668][ T29] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 461.704588][ T1098] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.723047][ T1098] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.730921][ T29] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 461.782069][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 461.791481][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 461.799165][T18195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3610'. [ 462.001207][T18202] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3614'. [ 462.104402][T18202] netlink: 'syz.2.3614': attribute type 3 has an invalid length. [ 462.264093][ T5616] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 462.278767][ T5616] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 462.299143][ T5616] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 462.309152][ T5616] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 462.319410][ T5616] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 463.672431][ T5608] syz_tun (unregistering): left allmulticast mode [ 463.829356][T18234] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 463.848400][T18236] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3621'. [ 463.871172][T18236] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3621'. [ 463.918671][T18236] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3621'. [ 464.273122][T18254] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3627'. [ 464.338496][T18250] mac80211_hwsim hwsim11 syzkaller0: left promiscuous mode [ 464.357914][T18250] mac80211_hwsim hwsim11 syzkaller0: left allmulticast mode [ 464.377963][T18254] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3627'. [ 464.449709][ T5616] Bluetooth: hci3: command tx timeout [ 464.473709][T18261] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3628'. [ 464.487379][T18260] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 464.586496][ T48] vlan2: left allmulticast mode [ 464.612049][ T48] geneve0: left allmulticast mode [ 464.638307][ T48] vlan2: left promiscuous mode [ 464.652043][ T48] geneve0: left promiscuous mode [ 464.668914][ T48] bridge0: port 4(vlan2) entered disabled state [ 464.689765][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 464.701710][T18263] FAULT_INJECTION: forcing a failure. [ 464.701710][T18263] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 464.715492][T18263] CPU: 1 UID: 0 PID: 18263 Comm: syz.1.3629 Not tainted syzkaller #0 PREEMPT(full) [ 464.715520][T18263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 464.715540][T18263] Call Trace: [ 464.715547][T18263] [ 464.715555][T18263] dump_stack_lvl+0xe8/0x150 [ 464.715585][T18263] should_fail_ex+0x40c/0x560 [ 464.715607][T18263] _copy_to_user+0x31/0xb0 [ 464.715643][T18263] bpf_test_finish+0x52e/0x690 [ 464.715670][T18263] ? __pfx_bpf_test_finish+0x10/0x10 [ 464.715699][T18263] bpf_prog_test_run_skb+0x11fe/0x2230 [ 464.715736][T18263] ? __fget_files+0x3a2/0x420 [ 464.715760][T18263] ? __fget_files+0x2a/0x420 [ 464.715786][T18263] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 464.715809][T18263] bpf_prog_test_run+0x2c5/0x340 [ 464.715840][T18263] __sys_bpf+0xa22/0xd90 [ 464.715871][T18263] ? __pfx___sys_bpf+0x10/0x10 [ 464.715905][T18263] ? __fget_files+0x2a/0x420 [ 464.715945][T18263] ? ksys_write+0x242/0x270 [ 464.715976][T18263] ? __pfx_ksys_write+0x10/0x10 [ 464.716009][T18263] __x64_sys_bpf+0xba/0xd0 [ 464.716032][T18263] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.716054][T18263] do_syscall_64+0x174/0x580 [ 464.716082][T18263] ? trace_irq_disable+0x3b/0x140 [ 464.716106][T18263] ? clear_bhb_loop+0x70/0xc0 [ 464.716130][T18263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.716150][T18263] RIP: 0033:0x7f6a1f39e0d9 [ 464.716169][T18263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 464.716203][T18263] RSP: 002b:00007f6a201a9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 464.716226][T18263] RAX: ffffffffffffffda RBX: 00007f6a1f625fa0 RCX: 00007f6a1f39e0d9 [ 464.716241][T18263] RDX: 0000000000000050 RSI: 00002000000001c0 RDI: 000000000000000a [ 464.716254][T18263] RBP: 00007f6a201a9090 R08: 0000000000000000 R09: 0000000000000000 [ 464.716267][T18263] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 464.716279][T18263] R13: 00007f6a1f626038 R14: 00007f6a1f625fa0 R15: 00007ffd96284fe8 [ 464.716311][T18263] [ 464.718417][ T48] team0: left allmulticast mode [ 464.938320][ T48] team_slave_0: left allmulticast mode [ 464.943957][ T48] team_slave_1: left allmulticast mode [ 464.960311][ T48] team0: left promiscuous mode [ 464.965169][ T48] team_slave_0: left promiscuous mode [ 464.980714][ T48] team_slave_1: left promiscuous mode [ 464.989810][ T48] bridge1: left promiscuous mode [ 464.999608][ T48] bridge2: left promiscuous mode [ 465.010894][ T48] bridge3: left promiscuous mode [ 465.028242][ T48] bridge4: left promiscuous mode [ 465.037428][ T48] bridge5: left promiscuous mode [ 465.051036][ T48] bridge0: port 3(team0) entered disabled state [ 465.073952][ T48] bridge_slave_1: left allmulticast mode [ 465.090054][ T48] bridge_slave_1: left promiscuous mode [ 465.099987][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.126820][ T48] bridge_slave_0: left allmulticast mode [ 465.139571][ T48] bridge_slave_0: left promiscuous mode [ 465.159273][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.216046][ T48] erspan0 (unregistering): left promiscuous mode [ 466.242989][ T48] gretap0 (unregistering): left promiscuous mode [ 466.457699][ T48] team0: Port device bridge1 removed [ 466.469089][ T48] team0: Port device bridge2 removed [ 466.482782][ T48] team0: Port device bridge3 removed [ 466.494779][ T48] team0: Port device bridge4 removed [ 466.508133][ T48] team0: Port device bridge5 removed [ 466.538780][ T48] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 466.542337][ T5616] Bluetooth: hci3: command tx timeout [ 466.555423][ T48] bond0 (unregistering): Released all slaves [ 466.567146][ T48] bond1 (unregistering): Released all slaves [ 466.584840][ T48] bond2 (unregistering): Released all slaves [ 466.846114][ T48] tipc: Disabling bearer [ 466.882038][ T48] tipc: Left network mode [ 466.903538][T18296] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 466.949048][T18296] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 467.004590][ T48] IPVS: stopping master sync thread 12021 ... [ 467.043416][T18307] netlink: 'syz.1.3638': attribute type 1 has an invalid length. [ 467.093946][T18300] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3638'. [ 467.144528][T18303] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 467.669056][T18331] IPv6: NLM_F_CREATE should be specified when creating new route [ 467.690780][T18331] IPv6: NLM_F_REPLACE set, but no existing node found! [ 467.705286][ T48] hsr_slave_0: left promiscuous mode [ 467.744907][ T48] hsr_slave_1: left promiscuous mode [ 467.784445][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 467.816388][ T48] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 467.854573][ T48] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 467.868436][ T48] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 467.909361][ T48] veth1_macvtap: left allmulticast mode [ 467.920976][ T48] veth1_macvtap: left promiscuous mode [ 467.926844][ T48] veth0_macvtap: left promiscuous mode [ 468.285442][ T48] team0 (unregistering): Port device team_slave_1 removed [ 468.313277][ T48] team0 (unregistering): Port device team_slave_0 removed [ 468.481565][T18358] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 468.492075][ T5270] 8021q: adding VLAN 0 to HW filter on device eth1 [ 468.516751][T18343] bond4: (slave team0): Releasing backup interface [ 468.537412][T18343] team0 (unregistering): left promiscuous mode [ 468.549618][T18343] team_slave_0: left promiscuous mode [ 468.555525][T18343] team_slave_1: left promiscuous mode [ 468.561720][T18343] bridge1: left promiscuous mode [ 468.567196][T18343] bridge2: left promiscuous mode [ 468.573244][T18343] team0 (unregistering): left allmulticast mode [ 468.580976][T18343] team_slave_0: left allmulticast mode [ 468.591522][T18343] team_slave_1: left allmulticast mode [ 468.599981][T18343] bridge1: left allmulticast mode [ 468.606231][T18343] bridge2: left allmulticast mode [ 468.620791][ T5616] Bluetooth: hci3: command tx timeout [ 468.635904][T18343] team0 (unregistering): Port device team_slave_0 removed [ 468.671055][T18343] team0 (unregistering): Port device team_slave_1 removed [ 468.691809][T18343] team0 (unregistering): Port device bridge1 removed [ 468.712544][T18343] team0 (unregistering): Port device bridge2 removed [ 468.757413][T18359] mac80211_hwsim hwsim24 syzkaller0: entered promiscuous mode [ 468.778336][T18359] mac80211_hwsim hwsim24 syzkaller0: entered allmulticast mode [ 469.121007][T18380] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3652'. [ 469.371676][T18395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3653'. [ 469.457270][ T48] IPVS: stop unused estimator thread 0... [ 469.478413][T18365] tipc: Resetting bearer [ 469.547491][T18216] bridge0: port 1(bridge_slave_0) entered blocking state [ 469.566180][T18216] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.575836][T18216] bridge_slave_0: entered allmulticast mode [ 469.589420][T18216] bridge_slave_0: entered promiscuous mode [ 469.609821][T18216] bridge0: port 2(bridge_slave_1) entered blocking state [ 469.618027][T18216] bridge0: port 2(bridge_slave_1) entered disabled state [ 469.631475][T18216] bridge_slave_1: entered allmulticast mode [ 469.646304][T18216] bridge_slave_1: entered promiscuous mode [ 469.806206][T18216] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 469.842770][T18216] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 469.926634][ T5270] 8021q: adding VLAN 0 to HW filter on device eth2 [ 469.955595][T18216] team0: Port device team_slave_0 added [ 469.975128][T18216] team0: Port device team_slave_1 added [ 470.136389][T18216] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 470.143556][T18216] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 470.199090][T18216] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 470.234533][T18216] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 470.245558][T18216] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 470.314835][T18216] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 470.535857][T18430] netlink: 'syz.0.3664': attribute type 4 has an invalid length. [ 470.548224][T18430] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3664'. [ 470.601275][T18216] hsr_slave_0: entered promiscuous mode [ 470.622362][T18216] hsr_slave_1: entered promiscuous mode [ 470.638985][T18216] debugfs: 'hsr0' already exists in 'hsr' [ 470.648323][T18216] Cannot create hsr debugfs directory [ 470.689846][ T5616] Bluetooth: hci3: command tx timeout [ 470.802917][T18433] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 471.044398][T18450] netlink: 'syz.4.3668': attribute type 2 has an invalid length. [ 471.355274][T18463] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3671'. [ 472.139704][T18500] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3680'. [ 472.374160][T18496] mac80211_hwsim hwsim24 syzkaller0: left promiscuous mode [ 472.606155][T18511] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3684'. [ 472.687440][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3684'. [ 472.750755][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3684'. [ 472.835593][T18530] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 473.444937][T18216] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 473.465743][T18216] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 473.487915][T18216] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 473.553880][T18216] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 473.585836][T18216] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 473.618324][T18216] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 473.647603][T18216] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 473.725322][T18216] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 473.854721][T18564] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3696'. [ 473.909084][T18561] FAULT_INJECTION: forcing a failure. [ 473.909084][T18561] name failslab, interval 1, probability 0, space 0, times 0 [ 473.963718][T18561] CPU: 1 UID: 0 PID: 18561 Comm: syz.0.3694 Not tainted syzkaller #0 PREEMPT(full) [ 473.963747][T18561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 473.963761][T18561] Call Trace: [ 473.963769][T18561] [ 473.963779][T18561] dump_stack_lvl+0xe8/0x150 [ 473.963815][T18561] should_fail_ex+0x40c/0x560 [ 473.963938][T18561] should_failslab+0xa8/0x100 [ 473.963970][T18561] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 473.963996][T18561] ? skb_clone+0x212/0x3a0 [ 473.964079][T18561] ? skb_clone+0x212/0x3a0 [ 473.964109][T18561] skb_clone+0x212/0x3a0 [ 473.964138][T18561] __netlink_deliver_tap+0x413/0x860 [ 473.964238][T18561] ? netlink_deliver_tap+0x2e/0x1b0 [ 473.964266][T18561] netlink_deliver_tap+0x19c/0x1b0 [ 473.964291][T18561] netlink_sendskb+0x68/0x140 [ 473.964316][T18561] netlink_rcv_skb+0x2a4/0x4a0 [ 473.964341][T18561] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 473.964391][T18561] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 473.964412][T18561] ? lockdep_hardirqs_on+0x7a/0x110 [ 473.964500][T18561] netlink_unicast+0x7bb/0x940 [ 473.964533][T18561] netlink_sendmsg+0x813/0xb40 [ 473.964565][T18561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 473.964594][T18561] ? aa_sock_msg_perm+0xf1/0x1b0 [ 473.964670][T18561] ? __pfx_netlink_sendmsg+0x10/0x10 [ 473.964694][T18561] sock_sendmsg_nosec+0x13a/0x180 [ 473.964753][T18561] ____sys_sendmsg+0x54e/0x850 [ 473.964782][T18561] ? __pfx_____sys_sendmsg+0x10/0x10 [ 473.964816][T18561] ? import_iovec+0x73/0xa0 [ 473.964895][T18561] ___sys_sendmsg+0x2a5/0x360 [ 473.964917][T18561] ? __lock_acquire+0x683/0x2cf0 [ 473.964950][T18561] ? __pfx____sys_sendmsg+0x10/0x10 [ 473.965009][T18561] ? __fget_files+0x2a/0x420 [ 473.965034][T18561] ? __fget_files+0x3a2/0x420 [ 473.965070][T18561] __x64_sys_sendmsg+0x1b1/0x290 [ 473.965097][T18561] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 473.965139][T18561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.965170][T18561] do_syscall_64+0x174/0x580 [ 473.965268][T18561] ? trace_irq_disable+0x3b/0x140 [ 473.965294][T18561] ? clear_bhb_loop+0x70/0xc0 [ 473.965321][T18561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.965343][T18561] RIP: 0033:0x7fc22019e0d9 [ 473.965363][T18561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.965382][T18561] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.965405][T18561] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 473.965421][T18561] RDX: 0000000000004040 RSI: 0000200000000180 RDI: 0000000000000003 [ 473.965434][T18561] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 473.965447][T18561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 473.965460][T18561] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 473.965494][T18561] [ 473.970248][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 474.384166][T18216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 474.483053][T18216] 8021q: adding VLAN 0 to HW filter on device team0 [ 474.516268][T18580] bridge0: port 3(vlan2) entered blocking state [ 474.533478][T18580] bridge0: port 3(vlan2) entered disabled state [ 474.565798][T18580] vlan2: entered allmulticast mode [ 474.579246][T18580] geneve0: entered allmulticast mode [ 474.594813][T18580] vlan2: entered promiscuous mode [ 474.609600][T18580] geneve0: entered promiscuous mode [ 474.679181][T18581] tipc: Resetting bearer [ 474.735116][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.742464][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 474.806571][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 474.813993][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 475.760996][T18622] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3704'. [ 476.155689][T18216] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 476.347706][T18216] veth0_vlan: entered promiscuous mode [ 476.435558][T18216] veth1_vlan: entered promiscuous mode [ 476.503061][T18649] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 476.558049][T18649] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3712'. [ 476.596614][T18649] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3712'. [ 476.599053][T18216] veth0_macvtap: entered promiscuous mode [ 476.677393][T18216] veth1_macvtap: entered promiscuous mode [ 476.751794][T18216] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 476.813604][T18216] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 476.910459][ T155] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.950561][ T1111] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.076688][ T7530] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.134012][ T7530] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.336024][ T126] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.372513][ T126] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.520942][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.547377][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 478.552568][ T5612] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 478.572164][ T5612] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 478.582280][ T5612] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 478.592794][ T5612] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 478.602500][ T5612] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 479.098184][T18735] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 479.613636][T18755] netlink: NAT attribute has 5 unknown bytes [ 479.640634][T18755] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 480.114808][T18771] sctp: [Deprecated]: syz.4.3740 (pid 18771) Use of struct sctp_assoc_value in delayed_ack socket option. [ 480.114808][T18771] Use struct sctp_sack_info instead [ 480.454875][T18782] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3743'. [ 480.693906][ T5616] Bluetooth: hci1: command tx timeout [ 480.727056][T18793] Bluetooth: MGMT ver 1.23 [ 480.772753][T18798] tc_dump_action: action bad kind [ 481.247870][T18714] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.290100][T18714] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.305344][T18714] bridge_slave_0: entered allmulticast mode [ 481.334463][T18714] bridge_slave_0: entered promiscuous mode [ 481.366180][T18714] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.407574][T18714] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.434301][T18714] bridge_slave_1: entered allmulticast mode [ 481.458175][T18714] bridge_slave_1: entered promiscuous mode [ 481.578081][T18714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 481.648827][T18714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 481.798322][T18714] team0: Port device team_slave_0 added [ 481.813559][T18714] team0: Port device team_slave_1 added [ 481.915602][T18714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 481.936401][T18714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.012372][T18714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.029906][T18714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 482.041516][T18714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 482.073054][T18714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 482.152665][T18714] hsr_slave_0: entered promiscuous mode [ 482.159635][T18714] hsr_slave_1: entered promiscuous mode [ 482.166223][T18714] debugfs: 'hsr0' already exists in 'hsr' [ 482.172293][T18714] Cannot create hsr debugfs directory [ 482.213169][T18859] netlink: 'syz.3.3755': attribute type 2 has an invalid length. [ 482.229630][T18859] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3755'. [ 482.523314][T18869] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3757'. [ 482.640883][T18867] 8021q: adding VLAN 0 to HW filter on device bond1 [ 482.772245][ T5616] Bluetooth: hci1: command tx timeout [ 482.830724][T18714] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.948413][T18714] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.083888][T18714] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.177277][T18714] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 483.652202][T18806] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 483.687296][T18714] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 483.788102][T18714] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 483.815944][T18714] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 483.872648][T18714] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 483.908271][T18714] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 483.958645][T18714] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 483.985959][T18714] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 484.046137][T18714] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 484.056644][T18888] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3761'. [ 484.120868][T18888] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3761'. [ 484.480953][T18910] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3764'. [ 484.859501][ T5616] Bluetooth: hci1: command tx timeout [ 484.890591][T18901] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 484.914486][T18901] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 485.064661][T18901] mac80211_hwsim hwsim24 syzkaller0: left allmulticast mode [ 485.077958][T18901] vlan2: left allmulticast mode [ 485.085750][T18901] bond0: left allmulticast mode [ 485.091141][T18901] bond_slave_0: left allmulticast mode [ 485.096704][T18901] bond_slave_1: left allmulticast mode [ 485.115579][T18901] dummy0: left allmulticast mode [ 485.121213][T18901] macvtap1: left allmulticast mode [ 485.189104][ T5270] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 485.210568][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.220034][ T57] netdevsim netdevsim0 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 485.320441][ T57] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.340759][ T57] netdevsim netdevsim0 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 485.542778][ T155] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.577659][ T155] netdevsim netdevsim0 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 485.614591][ T155] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 485.657634][ T155] netdevsim netdevsim0 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 485.715314][T18947] batadv0: entered promiscuous mode [ 485.735307][T18947] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 485.897195][T18714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 485.993280][T18714] 8021q: adding VLAN 0 to HW filter on device team0 [ 486.043892][ T155] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.051510][ T155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 486.105212][ T155] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.112545][ T155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 486.130309][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 486.263205][T18972] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3776'. [ 486.338924][T18972] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3776'. [ 486.414462][T18967] ip_tables: iptables: counters copy to user failed while replacing table [ 486.465697][T18979] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3777'. [ 486.496518][T18967] netlink: 'syz.3.3775': attribute type 1 has an invalid length. [ 486.513727][T18979] ip6tnl1: entered allmulticast mode [ 486.535574][ T7530] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 486.570502][T18969] netlink: 'syz.3.3775': attribute type 1 has an invalid length. [ 486.605944][T18967] syz_tun: entered promiscuous mode [ 486.929851][ T5616] Bluetooth: hci1: command tx timeout [ 487.074430][T19013] syzkaller1: entered promiscuous mode [ 487.097304][T19013] syzkaller1: entered allmulticast mode [ 487.123884][T19007] syzkaller0: entered promiscuous mode [ 487.164860][T19007] syzkaller0: entered allmulticast mode [ 487.186409][T19017] TC_ACT_REPEAT abuse ? [ 487.208928][T19018] syzkaller1: left promiscuous mode [ 487.231488][T19018] syzkaller1: left allmulticast mode [ 487.342138][T19026] netlink: 'syz.3.3782': attribute type 1 has an invalid length. [ 487.385799][T19026] netlink: 232 bytes leftover after parsing attributes in process `syz.3.3782'. [ 487.434802][T19026] netlink: 'syz.3.3782': attribute type 1 has an invalid length. [ 487.657052][T19039] FAULT_INJECTION: forcing a failure. [ 487.657052][T19039] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 487.692405][T19039] CPU: 1 UID: 0 PID: 19039 Comm: syz.0.3787 Not tainted syzkaller #0 PREEMPT(full) [ 487.692433][T19039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 487.692447][T19039] Call Trace: [ 487.692456][T19039] [ 487.692465][T19039] dump_stack_lvl+0xe8/0x150 [ 487.692499][T19039] should_fail_ex+0x40c/0x560 [ 487.692527][T19039] _copy_from_iter+0x1d3/0x1660 [ 487.692559][T19039] ? _copy_from_iter+0x21b/0x1660 [ 487.692593][T19039] ? __pfx__copy_from_iter+0x10/0x10 [ 487.692624][T19039] ? __pfx__copy_from_iter+0x10/0x10 [ 487.692658][T19039] copy_page_from_iter+0x219/0x2d0 [ 487.692688][T19039] skb_copy_datagram_from_iter+0x2f4/0x720 [ 487.692815][T19039] tun_get_user+0x1520/0x4370 [ 487.692955][T19039] ? aa_file_perm+0x18b/0x15f0 [ 487.692980][T19039] ? aa_file_perm+0x4ed/0x15f0 [ 487.692999][T19039] ? __pfx_tun_get_user+0x10/0x10 [ 487.693029][T19039] ? __lock_acquire+0x683/0x2cf0 [ 487.693057][T19039] ? kstrtoull+0x12f/0x1d0 [ 487.693115][T19039] ? ref_tracker_alloc+0x341/0x4b0 [ 487.693160][T19039] ? get_pid_task+0x20/0x1f0 [ 487.693189][T19039] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 487.693214][T19039] ? tun_get+0x1c/0x2f0 [ 487.693242][T19039] ? tun_get+0x1c/0x2f0 [ 487.693274][T19039] ? tun_get+0x1c/0x2f0 [ 487.693301][T19039] ? tun_get+0x1c/0x2f0 [ 487.693332][T19039] tun_chr_write_iter+0x113/0x200 [ 487.693364][T19039] vfs_write+0x612/0xba0 [ 487.693403][T19039] ? __pfx_vfs_write+0x10/0x10 [ 487.693443][T19039] ? __fget_files+0x2a/0x420 [ 487.693479][T19039] ksys_write+0x150/0x270 [ 487.693513][T19039] ? __pfx_ksys_write+0x10/0x10 [ 487.693552][T19039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.693583][T19039] do_syscall_64+0x174/0x580 [ 487.693614][T19039] ? trace_irq_disable+0x3b/0x140 [ 487.693640][T19039] ? clear_bhb_loop+0x70/0xc0 [ 487.693667][T19039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.693688][T19039] RIP: 0033:0x7fc22019e0d9 [ 487.693708][T19039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 487.693725][T19039] RSP: 002b:00007fc221022028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 487.693748][T19039] RAX: ffffffffffffffda RBX: 00007fc220425fa0 RCX: 00007fc22019e0d9 [ 487.693763][T19039] RDX: 000000000000fd6c RSI: 0000200000000280 RDI: 0000000000000003 [ 487.693776][T19039] RBP: 00007fc221022090 R08: 0000000000000000 R09: 0000000000000000 [ 487.693788][T19039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 487.693801][T19039] R13: 00007fc220426038 R14: 00007fc220425fa0 R15: 00007ffd0d8a5ff8 [ 487.693833][T19039] [ 488.339340][T19050] No such timeout policy "syz0" [ 488.403600][T18714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 488.537144][T18714] veth0_vlan: entered promiscuous mode [ 488.658839][T18714] veth1_vlan: entered promiscuous mode [ 488.803937][T18714] veth0_macvtap: entered promiscuous mode [ 488.862821][T18714] veth1_macvtap: entered promiscuous mode [ 489.009468][T18714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 489.135075][T18714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 489.163887][T19038] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 489.418777][T11774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.568810][T19100] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3795'. [ 489.699929][T11774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.742370][T11774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.752726][T11774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 489.844112][T19110] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3798'. [ 490.058295][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.085249][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.140716][T19110] IPVS: Scheduler module ip_vs_sip not found [ 490.181124][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 490.205169][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 490.319300][T19127] mac80211_hwsim hwsim24 syzkaller0: entered promiscuous mode [ 490.327778][T19127] mac80211_hwsim hwsim24 syzkaller0: entered allmulticast mode [ 490.369695][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 490.397186][T19132] tipc: Started in network mode [ 490.402371][T19132] tipc: Node identity , cluster identity 4711 [ 490.408558][T19132] tipc: Failed to obtain node identity [ 490.414732][T19132] tipc: Enabling of bearer rejected, failed to enable media [ 490.537722][T19136] FAULT_INJECTION: forcing a failure. [ 490.537722][T19136] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 490.572229][T19136] CPU: 1 UID: 0 PID: 19136 Comm: syz.2.3805 Not tainted syzkaller #0 PREEMPT(full) [ 490.572258][T19136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 490.572271][T19136] Call Trace: [ 490.572280][T19136] [ 490.572291][T19136] dump_stack_lvl+0xe8/0x150 [ 490.572333][T19136] should_fail_ex+0x40c/0x560 [ 490.572362][T19136] _copy_from_user+0x2d/0xb0 [ 490.572391][T19136] ___sys_sendmsg+0x1c6/0x360 [ 490.572414][T19136] ? __lock_acquire+0x683/0x2cf0 [ 490.572445][T19136] ? __pfx____sys_sendmsg+0x10/0x10 [ 490.572506][T19136] ? __fget_files+0x2a/0x420 [ 490.572532][T19136] ? __fget_files+0x3a2/0x420 [ 490.572569][T19136] __x64_sys_sendmsg+0x1b1/0x290 [ 490.572596][T19136] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 490.572638][T19136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.572662][T19136] do_syscall_64+0x174/0x580 [ 490.572692][T19136] ? trace_irq_disable+0x3b/0x140 [ 490.572717][T19136] ? clear_bhb_loop+0x70/0xc0 [ 490.572742][T19136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 490.572762][T19136] RIP: 0033:0x7f2caa19e0d9 [ 490.572781][T19136] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 490.572799][T19136] RSP: 002b:00007f2cab05e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 490.572821][T19136] RAX: ffffffffffffffda RBX: 00007f2caa425fa0 RCX: 00007f2caa19e0d9 [ 490.572836][T19136] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000003 [ 490.572849][T19136] RBP: 00007f2cab05e090 R08: 0000000000000000 R09: 0000000000000000 [ 490.572862][T19136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 490.572874][T19136] R13: 00007f2caa426038 R14: 00007f2caa425fa0 R15: 00007ffe0ad86fc8 [ 490.572906][T19136] [ 491.130190][T19143] netlink: 'syz.2.3808': attribute type 1 has an invalid length. [ 491.264696][ T5612] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 491.294679][ T5614] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 491.308087][ T5614] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 491.317590][ T5614] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 491.338537][ T5614] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 491.505307][T19154] netlink: 'syz.3.3810': attribute type 22 has an invalid length. [ 491.568065][T19154] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 491.633431][T19158] tipc: Resetting bearer [ 491.964578][T19177] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3814'. [ 492.081704][T19173] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 492.567250][T19193] netlink: 'syz.0.3819': attribute type 10 has an invalid length. [ 492.808284][T19197] IPv6: NLM_F_REPLACE set, but no existing node found! [ 492.991750][T19199] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.084289][T19206] bond0: Error: Cannot enslave bond to itself. [ 493.152174][T19206] bond0: Error: Cannot enslave bond to itself. [ 493.165902][T19147] bridge0: port 1(bridge_slave_0) entered blocking state [ 493.184338][T19147] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.199799][T19147] bridge_slave_0: entered allmulticast mode [ 493.223619][T19147] bridge_slave_0: entered promiscuous mode [ 493.249219][T19147] bridge0: port 2(bridge_slave_1) entered blocking state [ 493.265196][T19147] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.284154][T19147] bridge_slave_1: entered allmulticast mode [ 493.300729][T19147] bridge_slave_1: entered promiscuous mode [ 493.329858][ T5616] Bluetooth: hci5: command 0x0406 tx timeout [ 493.395549][T19147] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 493.409818][ T5612] Bluetooth: hci4: command tx timeout [ 493.420319][T19147] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 493.556505][T19147] team0: Port device team_slave_0 added [ 493.586563][T19147] team0: Port device team_slave_1 added [ 493.701361][T19147] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 493.719309][T19147] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 493.766372][T19147] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 493.819004][T19147] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 493.830432][T19147] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 493.860338][T19147] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 494.057346][T19147] hsr_slave_0: entered promiscuous mode [ 494.074142][T19147] hsr_slave_1: entered promiscuous mode [ 494.093732][T19236] openvswitch: netlink: Message has 8 unknown bytes. [ 494.102666][T19147] debugfs: 'hsr0' already exists in 'hsr' [ 494.109415][T19147] Cannot create hsr debugfs directory [ 494.223840][T19234] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3832'. [ 494.451411][T19245] tipc: Started in network mode [ 494.456806][T19245] tipc: Node identity 0e1f117154fa, cluster identity 4711 [ 494.474604][T19245] tipc: Enabled bearer , priority 0 [ 494.598272][T19245] syzkaller0: entered promiscuous mode [ 494.606145][T19245] syzkaller0: entered allmulticast mode [ 494.615454][T19245] tipc: Resetting bearer [ 494.741118][T19244] tipc: Resetting bearer [ 495.499857][ T5612] Bluetooth: hci4: command tx timeout [ 497.209251][T19244] tipc: Disabling bearer [ 497.324947][T19259] ip6gre1: entered promiscuous mode [ 497.350577][T19259] ip6gre1: entered allmulticast mode [ 497.426668][T19263] macsec1: entered promiscuous mode [ 497.450072][T19263] virt_wifi0: entered promiscuous mode [ 497.472374][ T9882] tipc: Node number set to 1524961649 [ 497.570181][ T5612] Bluetooth: hci4: command tx timeout [ 497.590444][T19274] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3842'. [ 497.650433][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 497.754596][T19147] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 497.789564][T19147] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 497.844941][T11774] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 497.854204][T11774] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 497.869887][ T29] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 498.059781][ T5705] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 498.080620][T19147] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.086528][ T5705] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 498.105964][T19147] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.178844][T19281] netlink: 1347 bytes leftover after parsing attributes in process `syz.0.3844'. [ 498.224700][T19281] netlink: 'syz.0.3844': attribute type 11 has an invalid length. [ 498.233576][T19281] netlink: 140 bytes leftover after parsing attributes in process `syz.0.3844'. [ 498.277915][T19147] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.304131][T19147] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.368256][T19288] bridge0: port 3(vlan2) entered blocking state [ 498.388769][T19288] bridge0: port 3(vlan2) entered disabled state [ 498.410477][T19288] vlan2: entered allmulticast mode [ 498.416705][T19288] geneve0: entered allmulticast mode [ 498.430786][T19288] vlan2: entered promiscuous mode [ 498.439984][T19288] geneve0: entered promiscuous mode [ 498.522949][T19147] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.534853][T19147] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.568369][T19292] mac80211_hwsim hwsim24 syzkaller0: left promiscuous mode [ 498.576070][T19292] mac80211_hwsim hwsim24 syzkaller0: left allmulticast mode [ 498.683663][T19299] mac80211_hwsim hwsim24 syzkaller0: entered promiscuous mode [ 498.693156][T19299] mac80211_hwsim hwsim24 syzkaller0: entered allmulticast mode [ 498.711791][T19299] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3849'. [ 498.942104][T19147] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 498.967511][T19147] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 498.987932][T19147] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 499.010614][T19147] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 499.031568][T19147] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 499.048355][T19147] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 499.058534][T19147] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 499.071899][T19307] FAULT_INJECTION: forcing a failure. [ 499.071899][T19307] name failslab, interval 1, probability 0, space 0, times 0 [ 499.085670][T19307] CPU: 1 UID: 0 PID: 19307 Comm: syz.2.3853 Not tainted syzkaller #0 PREEMPT(full) [ 499.085698][T19307] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 499.085710][T19307] Call Trace: [ 499.085719][T19307] [ 499.085728][T19307] dump_stack_lvl+0xe8/0x150 [ 499.085763][T19307] should_fail_ex+0x40c/0x560 [ 499.085790][T19307] should_failslab+0xa8/0x100 [ 499.085821][T19307] __kmalloc_cache_node_noprof+0xaa/0x630 [ 499.085846][T19307] ? __kmalloc_cache_node_noprof+0x1f2/0x630 [ 499.085871][T19307] ? __alloc_workqueue+0x757/0x2060 [ 499.085897][T19307] ? __alloc_workqueue+0x757/0x2060 [ 499.085930][T19307] __alloc_workqueue+0x757/0x2060 [ 499.085979][T19307] alloc_workqueue_noprof+0xe3/0x210 [ 499.086014][T19307] ? __pfx_alloc_workqueue_noprof+0x10/0x10 [ 499.086051][T19307] ? mutex_init_lockdep+0xdf/0x110 [ 499.086084][T19307] __rds_conn_create+0x130d/0x2250 [ 499.086203][T19307] ? __rds_conn_create+0x2d2/0x2250 [ 499.086238][T19307] ? __pfx___rds_conn_create+0x10/0x10 [ 499.086267][T19307] ? __pfx_rds_message_copy_from_user+0x10/0x10 [ 499.086300][T19307] rds_conn_create_outgoing+0x43/0x60 [ 499.086327][T19307] rds_sendmsg+0xfca/0x20e0 [ 499.086401][T19307] ? __pfx_rds_sendmsg+0x10/0x10 [ 499.086426][T19307] ? aa_sk_perm+0x6d5/0x900 [ 499.086494][T19307] ? __might_fault+0xaf/0x130 [ 499.086517][T19307] ? __pfx_aa_sk_perm+0x10/0x10 [ 499.086549][T19307] ? aa_sock_msg_perm+0xf1/0x1b0 [ 499.086584][T19307] ? __pfx_rds_sendmsg+0x10/0x10 [ 499.086611][T19307] sock_sendmsg_nosec+0x13a/0x180 [ 499.086652][T19307] ____sys_sendmsg+0x54e/0x850 [ 499.086681][T19307] ? __pfx_____sys_sendmsg+0x10/0x10 [ 499.086714][T19307] ? import_iovec+0x73/0xa0 [ 499.086745][T19307] ___sys_sendmsg+0x2a5/0x360 [ 499.086768][T19307] ? __lock_acquire+0x683/0x2cf0 [ 499.086800][T19307] ? __pfx____sys_sendmsg+0x10/0x10 [ 499.086860][T19307] ? __fget_files+0x2a/0x420 [ 499.086886][T19307] ? __fget_files+0x3a2/0x420 [ 499.086923][T19307] __x64_sys_sendmsg+0x1b1/0x290 [ 499.086950][T19307] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 499.086993][T19307] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.087017][T19307] do_syscall_64+0x174/0x580 [ 499.087047][T19307] ? trace_irq_disable+0x3b/0x140 [ 499.087071][T19307] ? clear_bhb_loop+0x70/0xc0 [ 499.087097][T19307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.087118][T19307] RIP: 0033:0x7f2caa19e0d9 [ 499.087138][T19307] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 499.087156][T19307] RSP: 002b:00007f2cab05e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 499.087178][T19307] RAX: ffffffffffffffda RBX: 00007f2caa425fa0 RCX: 00007f2caa19e0d9 [ 499.087192][T19307] RDX: 0000000004000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 499.087206][T19307] RBP: 00007f2cab05e090 R08: 0000000000000000 R09: 0000000000000000 [ 499.087218][T19307] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 499.087230][T19307] R13: 00007f2caa426038 R14: 00007f2caa425fa0 R15: 00007ffe0ad86fc8 [ 499.087262][T19307] [ 499.390806][T19147] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 499.627687][T19147] 8021q: adding VLAN 0 to HW filter on device bond0 [ 499.659734][ T5612] Bluetooth: hci4: command tx timeout [ 499.668157][T19147] 8021q: adding VLAN 0 to HW filter on device team0 [ 499.682141][ T126] bridge0: port 1(bridge_slave_0) entered blocking state [ 499.689374][ T126] bridge0: port 1(bridge_slave_0) entered forwarding state [ 499.708787][T19325] netlink: zone id is out of range [ 499.714330][T19325] netlink: set zone limit has 4 unknown bytes [ 499.762810][ T126] bridge0: port 2(bridge_slave_1) entered blocking state [ 499.770099][ T126] bridge0: port 2(bridge_slave_1) entered forwarding state [ 499.849610][T19330] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3857'. [ 499.887625][T19331] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 500.060744][T19327] netlink: 236 bytes leftover after parsing attributes in process `syz.1.3856'. [ 500.099366][T19340] vlan2: entered promiscuous mode [ 500.105239][T19340] bridge0: entered promiscuous mode [ 500.119671][T19327] netlink: 236 bytes leftover after parsing attributes in process `syz.1.3856'. [ 500.203247][T19347] ip_tables: iptables: counters copy to user failed while replacing table [ 500.416652][T19355] tipc: Resetting bearer [ 500.918238][T19374] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3869'. [ 501.118332][T19372] bridge0: port 3(vlan2) entered blocking state [ 501.124860][T19372] bridge0: port 3(vlan2) entered forwarding state [ 501.141106][T19372] macsec1: left promiscuous mode [ 501.150703][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 501.373044][T19147] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 501.392970][T19381] FAULT_INJECTION: forcing a failure. [ 501.392970][T19381] name failslab, interval 1, probability 0, space 0, times 0 [ 501.429540][T19381] CPU: 1 UID: 0 PID: 19381 Comm: syz.3.3872 Not tainted syzkaller #0 PREEMPT(full) [ 501.429570][T19381] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.429584][T19381] Call Trace: [ 501.429592][T19381] [ 501.429602][T19381] dump_stack_lvl+0xe8/0x150 [ 501.429636][T19381] should_fail_ex+0x40c/0x560 [ 501.429665][T19381] should_failslab+0xa8/0x100 [ 501.429696][T19381] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 501.429721][T19381] ? skb_clone+0x212/0x3a0 [ 501.429748][T19381] ? skb_clone+0x212/0x3a0 [ 501.429778][T19381] skb_clone+0x212/0x3a0 [ 501.429806][T19381] __netlink_deliver_tap+0x413/0x860 [ 501.429844][T19381] ? netlink_deliver_tap+0x2e/0x1b0 [ 501.429871][T19381] netlink_deliver_tap+0x19c/0x1b0 [ 501.429897][T19381] netlink_unicast+0x77f/0x940 [ 501.429930][T19381] netlink_sendmsg+0x813/0xb40 [ 501.429964][T19381] ? __pfx_netlink_sendmsg+0x10/0x10 [ 501.429994][T19381] ? aa_sock_msg_perm+0xf1/0x1b0 [ 501.430030][T19381] ? __pfx_netlink_sendmsg+0x10/0x10 [ 501.430055][T19381] sock_sendmsg_nosec+0x13a/0x180 [ 501.430086][T19381] ____sys_sendmsg+0x54e/0x850 [ 501.430116][T19381] ? __pfx_____sys_sendmsg+0x10/0x10 [ 501.430150][T19381] ? import_iovec+0x73/0xa0 [ 501.430182][T19381] ___sys_sendmsg+0x2a5/0x360 [ 501.430204][T19381] ? __lock_acquire+0x683/0x2cf0 [ 501.430236][T19381] ? __pfx____sys_sendmsg+0x10/0x10 [ 501.430265][T19381] ? kstrtouint+0x6e/0xe0 [ 501.430315][T19381] ? __fget_files+0x2a/0x420 [ 501.430341][T19381] ? __fget_files+0x3a2/0x420 [ 501.430379][T19381] __sys_sendmmsg+0x273/0x4d0 [ 501.430409][T19381] ? __pfx___sys_sendmmsg+0x10/0x10 [ 501.430450][T19381] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 501.430590][T19381] ? ksys_write+0x242/0x270 [ 501.430623][T19381] ? __pfx_ksys_write+0x10/0x10 [ 501.430662][T19381] __x64_sys_sendmmsg+0xa0/0xc0 [ 501.430685][T19381] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.430708][T19381] do_syscall_64+0x174/0x580 [ 501.430740][T19381] ? trace_irq_disable+0x3b/0x140 [ 501.430765][T19381] ? clear_bhb_loop+0x70/0xc0 [ 501.430792][T19381] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.430813][T19381] RIP: 0033:0x7fc2e099e0d9 [ 501.430834][T19381] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.430870][T19381] RSP: 002b:00007fc2e18da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 501.430893][T19381] RAX: ffffffffffffffda RBX: 00007fc2e0c25fa0 RCX: 00007fc2e099e0d9 [ 501.430909][T19381] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 501.430923][T19381] RBP: 00007fc2e18da090 R08: 0000000000000000 R09: 0000000000000000 [ 501.430937][T19381] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.430949][T19381] R13: 00007fc2e0c26038 R14: 00007fc2e0c25fa0 R15: 00007ffebb3c3968 [ 501.430984][T19381] [ 501.505874][ C0] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 501.650337][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 501.895880][T19390] FAULT_INJECTION: forcing a failure. [ 501.895880][T19390] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 501.930608][T19390] CPU: 0 UID: 0 PID: 19390 Comm: syz.3.3875 Not tainted syzkaller #0 PREEMPT(full) [ 501.930636][T19390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 501.930649][T19390] Call Trace: [ 501.930657][T19390] [ 501.930667][T19390] dump_stack_lvl+0xe8/0x150 [ 501.930701][T19390] should_fail_ex+0x40c/0x560 [ 501.930728][T19390] copy_folio_from_iter_atomic+0x45a/0x1a30 [ 501.930756][T19390] ? shmem_allowable_huge_orders+0x325/0x6c0 [ 501.930806][T19390] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 501.930842][T19390] ? shmem_write_begin+0x1d8/0x330 [ 501.930869][T19390] generic_perform_write+0x5c7/0x8f0 [ 501.930916][T19390] ? __pfx_generic_perform_write+0x10/0x10 [ 501.930936][T19390] ? down_write+0x16d/0x200 [ 501.931052][T19390] ? generic_write_checks_count+0x41a/0x520 [ 501.931085][T19390] ? file_update_time_flags+0x3b3/0x4a0 [ 501.931120][T19390] shmem_file_write_iter+0xf8/0x120 [ 501.931145][T19390] vfs_write+0x612/0xba0 [ 501.931184][T19390] ? __pfx_vfs_write+0x10/0x10 [ 501.931216][T19390] ? do_sys_openat2+0x14e/0x200 [ 501.931239][T19390] ? kmem_cache_free+0x182/0x650 [ 501.931264][T19390] ? fd_install+0x94/0x3d0 [ 501.931303][T19390] ksys_write+0x150/0x270 [ 501.931337][T19390] ? __pfx_ksys_write+0x10/0x10 [ 501.931378][T19390] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.931401][T19390] do_syscall_64+0x174/0x580 [ 501.931434][T19390] ? clear_bhb_loop+0x70/0xc0 [ 501.931461][T19390] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.931482][T19390] RIP: 0033:0x7fc2e099e0d9 [ 501.931502][T19390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 501.931520][T19390] RSP: 002b:00007fc2e18da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 501.931542][T19390] RAX: ffffffffffffffda RBX: 00007fc2e0c25fa0 RCX: 00007fc2e099e0d9 [ 501.931557][T19390] RDX: 0000000000032600 RSI: 0000200000000100 RDI: 0000000000000003 [ 501.931570][T19390] RBP: 00007fc2e18da090 R08: 0000000000000000 R09: 0000000000000000 [ 501.931583][T19390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 501.931595][T19390] R13: 00007fc2e0c26038 R14: 00007fc2e0c25fa0 R15: 00007ffebb3c3968 [ 501.931628][T19390] [ 502.688804][T19421] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3883'. [ 502.834330][T19147] veth0_vlan: entered promiscuous mode [ 502.858399][T19424] netlink: 'syz.3.3885': attribute type 1 has an invalid length. [ 502.877913][T19147] veth1_vlan: entered promiscuous mode [ 502.926059][T19424] 8021q: adding VLAN 0 to HW filter on device bond2 [ 502.957588][T19424] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 503.097811][T19147] veth0_macvtap: entered promiscuous mode [ 503.152509][T19147] veth1_macvtap: entered promiscuous mode [ 503.235937][T19147] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 503.280600][T19147] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 503.406077][ T126] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.447269][ T126] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.553128][T11774] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.614112][T19447] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3887'. [ 503.733267][T19445] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 503.776831][T19454] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3890'. [ 503.828390][T19445] bridge0: port 3(vlan2) entered blocking state [ 503.834908][T19445] bridge0: port 3(vlan2) entered forwarding state [ 503.956211][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 504.006628][T11774] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 504.022435][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.047441][T11774] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 504.147368][ T1098] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 504.172703][ T1098] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 504.270223][T19458] Bluetooth: ISO socket layer initialized [ 504.405522][T19458] xt_CT: No such helper "netbios-ns" [ 504.853829][T19486] netlink: 260 bytes leftover after parsing attributes in process `syz.1.3898'. [ 505.485536][T19516] x_tables: unsorted entry at hook 1 [ 505.637451][T19521] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3908'. [ 505.971944][ C0] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 506.598366][T19568] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3919'. [ 506.654598][T19566] xt_hashlimit: size too large, truncated to 1048576 [ 506.883538][T19584] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3922'. [ 506.926217][T19587] FAULT_INJECTION: forcing a failure. [ 506.926217][T19587] name failslab, interval 1, probability 0, space 0, times 0 [ 506.958371][T19584] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3922'. [ 507.004777][T19587] CPU: 1 UID: 0 PID: 19587 Comm: syz.2.3924 Not tainted syzkaller #0 PREEMPT(full) [ 507.004808][T19587] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 507.004821][T19587] Call Trace: [ 507.004830][T19587] [ 507.004840][T19587] dump_stack_lvl+0xe8/0x150 [ 507.004875][T19587] should_fail_ex+0x40c/0x560 [ 507.004904][T19587] should_failslab+0xa8/0x100 [ 507.004937][T19587] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 507.004963][T19587] ? local_lock_release+0x9c/0x160 [ 507.004997][T19587] ? __alloc_skb+0x1d7/0x7a0 [ 507.005016][T19587] ? __alloc_skb+0x1d7/0x7a0 [ 507.005043][T19587] __alloc_skb+0x1d7/0x7a0 [ 507.005068][T19587] netlink_sendmsg+0x5d4/0xb40 [ 507.005105][T19587] ? __pfx_netlink_sendmsg+0x10/0x10 [ 507.005135][T19587] ? aa_sock_msg_perm+0xf1/0x1b0 [ 507.005173][T19587] ? __pfx_netlink_sendmsg+0x10/0x10 [ 507.005198][T19587] sock_sendmsg_nosec+0x13a/0x180 [ 507.005231][T19587] ____sys_sendmsg+0x54e/0x850 [ 507.005262][T19587] ? __pfx_____sys_sendmsg+0x10/0x10 [ 507.005296][T19587] ? import_iovec+0x73/0xa0 [ 507.005329][T19587] ___sys_sendmsg+0x2a5/0x360 [ 507.005351][T19587] ? __lock_acquire+0x683/0x2cf0 [ 507.005384][T19587] ? __pfx____sys_sendmsg+0x10/0x10 [ 507.005446][T19587] ? __fget_files+0x2a/0x420 [ 507.005473][T19587] ? __fget_files+0x3a2/0x420 [ 507.005519][T19587] __x64_sys_sendmsg+0x1b1/0x290 [ 507.005547][T19587] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 507.005595][T19587] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.005620][T19587] do_syscall_64+0x174/0x580 [ 507.005652][T19587] ? trace_irq_disable+0x3b/0x140 [ 507.005678][T19587] ? clear_bhb_loop+0x70/0xc0 [ 507.005705][T19587] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 507.005727][T19587] RIP: 0033:0x7f2caa19e0d9 [ 507.005748][T19587] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.005768][T19587] RSP: 002b:00007f2cab05e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 507.005791][T19587] RAX: ffffffffffffffda RBX: 00007f2caa425fa0 RCX: 00007f2caa19e0d9 [ 507.005807][T19587] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 507.005820][T19587] RBP: 00007f2cab05e090 R08: 0000000000000000 R09: 0000000000000000 [ 507.005834][T19587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.005846][T19587] R13: 00007f2caa426038 R14: 00007f2caa425fa0 R15: 00007ffe0ad86fc8 [ 507.005880][T19587] [ 507.999584][T19620] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3930'. [ 508.234465][T19646] block nbd0: reconnected socket [ 508.251200][T19646] nbd: socks must be embedded in a SOCK_ITEM attr [ 508.325946][ T5612] block nbd0: Receive control failed (result -32) [ 508.470957][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 508.649157][T19660] [ 508.651567][T19660] ====================================================== [ 508.658618][T19660] WARNING: possible circular locking dependency detected [ 508.665678][T19660] syzkaller #0 Not tainted [ 508.670168][T19660] ------------------------------------------------------ [ 508.677212][T19660] syz.4.3943/19660 is trying to acquire lock: [ 508.683326][T19660] ffff88801c294210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_permission+0x7f/0x430 [ 508.693963][T19660] [ 508.693963][T19660] but task is already holding lock: [ 508.701366][T19660] ffffffff8e9e75f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 508.711528][T19660] [ 508.711528][T19660] which lock already depends on the new lock. [ 508.711528][T19660] [ 508.721956][T19660] [ 508.721956][T19660] the existing dependency chain (in reverse order) is: [ 508.730987][T19660] [ 508.730987][T19660] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 508.738749][T19660] cpus_read_lock+0x42/0x160 [ 508.743881][T19660] static_key_slow_inc+0x12/0x30 [ 508.749374][T19660] nbd_genl_reconfigure+0x1301/0x1e80 [ 508.755430][T19660] genl_family_rcv_msg_doit+0x233/0x340 [ 508.761542][T19660] genl_rcv_msg+0x614/0x7a0 [ 508.766607][T19660] netlink_rcv_skb+0x226/0x4a0 [ 508.771920][T19660] genl_rcv+0x28/0x40 [ 508.776451][T19660] netlink_unicast+0x7bb/0x940 [ 508.781750][T19660] netlink_sendmsg+0x813/0xb40 [ 508.787057][T19660] sock_sendmsg_nosec+0x13a/0x180 [ 508.792627][T19660] ____sys_sendmsg+0x54e/0x850 [ 508.797930][T19660] ___sys_sendmsg+0x2a5/0x360 [ 508.803141][T19660] __x64_sys_sendmsg+0x1b1/0x290 [ 508.808660][T19660] do_syscall_64+0x174/0x580 [ 508.813819][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.820267][T19660] [ 508.820267][T19660] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 508.827938][T19660] __mutex_lock+0x19d/0x1550 [ 508.833078][T19660] nbd_queue_rq+0x373/0x1150 [ 508.838220][T19660] blk_mq_dispatch_rq_list+0x499/0x1990 [ 508.844441][T19660] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 508.851355][T19660] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 508.857896][T19660] blk_mq_run_work_fn+0x16c/0x300 [ 508.863471][T19660] process_scheduled_works+0xa8e/0x14e0 [ 508.869554][T19660] worker_thread+0xa47/0xfb0 [ 508.874689][T19660] kthread+0x388/0x470 [ 508.879305][T19660] ret_from_fork+0x514/0xb70 [ 508.884440][T19660] ret_from_fork_asm+0x1a/0x30 [ 508.889751][T19660] [ 508.889751][T19660] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 508.896988][T19660] __mutex_lock+0x19d/0x1550 [ 508.902127][T19660] nbd_queue_rq+0xc1/0x1150 [ 508.907173][T19660] blk_mq_dispatch_rq_list+0x499/0x1990 [ 508.913256][T19660] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 508.920139][T19660] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 508.926657][T19660] blk_mq_run_work_fn+0x16c/0x300 [ 508.932229][T19660] process_scheduled_works+0xa8e/0x14e0 [ 508.938325][T19660] worker_thread+0xa47/0xfb0 [ 508.943453][T19660] kthread+0x388/0x470 [ 508.948108][T19660] ret_from_fork+0x514/0xb70 [ 508.953239][T19660] ret_from_fork_asm+0x1a/0x30 [ 508.958557][T19660] [ 508.958557][T19660] -> #4 (set->srcu){.+.+}-{0:0}: [ 508.965705][T19660] __synchronize_srcu+0xc9/0x2f0 [ 508.971186][T19660] elevator_switch+0x1e8/0x7b0 [ 508.976574][T19660] elevator_change+0x2fa/0x480 [ 508.981879][T19660] elevator_set_default+0x375/0x440 [ 508.987624][T19660] blk_register_queue+0x3f3/0x4e0 [ 508.993258][T19660] __add_disk+0x6cb/0xe30 [ 508.998134][T19660] add_disk_fwnode+0x100/0x3a0 [ 509.003440][T19660] nbd_dev_add+0x733/0xb60 [ 509.008406][T19660] nbd_init+0x15f/0x1e0 [ 509.013178][T19660] do_one_initcall+0x250/0x870 [ 509.018501][T19660] do_initcall_level+0x10a/0x1a0 [ 509.024070][T19660] do_initcalls+0x59/0xa0 [ 509.028952][T19660] kernel_init_freeable+0x29d/0x3e0 [ 509.034691][T19660] kernel_init+0x1d/0x1d0 [ 509.039600][T19660] ret_from_fork+0x514/0xb70 [ 509.044731][T19660] ret_from_fork_asm+0x1a/0x30 [ 509.050039][T19660] [ 509.050039][T19660] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 509.057912][T19660] __mutex_lock+0x19d/0x1550 [ 509.063053][T19660] elevator_change+0x1af/0x480 [ 509.068354][T19660] elevator_set_none+0xb5/0x140 [ 509.073740][T19660] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 509.080095][T19660] nbd_start_device+0x189/0xb30 [ 509.085497][T19660] nbd_genl_connect+0x1597/0x1c10 [ 509.091071][T19660] genl_family_rcv_msg_doit+0x233/0x340 [ 509.097165][T19660] genl_rcv_msg+0x614/0x7a0 [ 509.102212][T19660] netlink_rcv_skb+0x226/0x4a0 [ 509.107510][T19660] genl_rcv+0x28/0x40 [ 509.112035][T19660] netlink_unicast+0x7bb/0x940 [ 509.117337][T19660] netlink_sendmsg+0x813/0xb40 [ 509.122640][T19660] sock_sendmsg_nosec+0x13a/0x180 [ 509.128209][T19660] ____sys_sendmsg+0x54e/0x850 [ 509.133511][T19660] ___sys_sendmsg+0x2a5/0x360 [ 509.138727][T19660] __x64_sys_sendmsg+0x1b1/0x290 [ 509.144198][T19660] do_syscall_64+0x174/0x580 [ 509.149348][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.155795][T19660] [ 509.155795][T19660] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 509.164446][T19660] blk_alloc_queue+0x544/0x690 [ 509.169755][T19660] __blk_mq_alloc_disk+0x194/0x390 [ 509.169919][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 509.175420][T19660] nbd_dev_add+0x494/0xb60 [ 509.187842][T19660] nbd_init+0x15f/0x1e0 [ 509.192555][T19660] do_one_initcall+0x250/0x870 [ 509.197870][T19660] do_initcall_level+0x10a/0x1a0 [ 509.203354][T19660] do_initcalls+0x59/0xa0 [ 509.208245][T19660] kernel_init_freeable+0x29d/0x3e0 [ 509.214004][T19660] kernel_init+0x1d/0x1d0 [ 509.218885][T19660] ret_from_fork+0x514/0xb70 [ 509.224027][T19660] ret_from_fork_asm+0x1a/0x30 [ 509.229349][T19660] [ 509.229349][T19660] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 509.236603][T19660] fs_reclaim_acquire+0x71/0x100 [ 509.242104][T19660] kmem_cache_alloc_noprof+0x64/0x5f0 [ 509.248029][T19660] __kernfs_iattrs+0xdd/0x380 [ 509.253260][T19660] kernfs_iop_setattr+0xe6/0x3f0 [ 509.258746][T19660] notify_change+0xbba/0xea0 [ 509.263878][T19660] do_truncate+0x1c2/0x250 [ 509.268840][T19660] path_openat+0x2fed/0x3830 [ 509.273985][T19660] do_file_open+0x23e/0x4a0 [ 509.279056][T19660] do_sys_openat2+0x115/0x200 [ 509.284295][T19660] __x64_sys_openat+0x138/0x170 [ 509.289696][T19660] do_syscall_64+0x174/0x580 [ 509.294888][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.301332][T19660] [ 509.301332][T19660] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 509.309880][T19660] __lock_acquire+0x1520/0x2cf0 [ 509.315285][T19660] lock_acquire+0x106/0x350 [ 509.320331][T19660] down_read+0x4a/0x330 [ 509.325020][T19660] kernfs_iop_permission+0x7f/0x430 [ 509.330767][T19660] inode_permission+0x3de/0x5f0 [ 509.336189][T19660] cgroup_attach_permissions+0x28e/0x9f0 [ 509.342366][T19660] __cgroup_procs_write+0x24b/0x320 [ 509.348103][T19660] cgroup_threads_write+0x24/0x50 [ 509.353700][T19660] cgroup_file_write+0x331/0x8f0 [ 509.359186][T19660] kernfs_fop_write_iter+0x3a4/0x540 [ 509.365061][T19660] vfs_write+0x612/0xba0 [ 509.369858][T19660] ksys_write+0x150/0x270 [ 509.374735][T19660] do_syscall_64+0x174/0x580 [ 509.379874][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.386330][T19660] [ 509.386330][T19660] other info that might help us debug this: [ 509.386330][T19660] [ 509.396583][T19660] Chain exists of: [ 509.396583][T19660] &root->kernfs_iattr_rwsem --> &nsock->tx_lock --> cpu_hotplug_lock [ 509.396583][T19660] [ 509.410608][T19660] Possible unsafe locking scenario: [ 509.410608][T19660] [ 509.418076][T19660] CPU0 CPU1 [ 509.423456][T19660] ---- ---- [ 509.428837][T19660] rlock(cpu_hotplug_lock); [ 509.433455][T19660] lock(&nsock->tx_lock); [ 509.440412][T19660] lock(cpu_hotplug_lock); [ 509.447484][T19660] rlock(&root->kernfs_iattr_rwsem); [ 509.452886][T19660] [ 509.452886][T19660] *** DEADLOCK *** [ 509.452886][T19660] [ 509.461045][T19660] 5 locks held by syz.4.3943/19660: [ 509.466252][T19660] #0: ffff88807f8340f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 509.475348][T19660] #1: ffff888026108450 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 509.484274][T19660] #2: ffff888067040c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 509.494069][T19660] #3: ffffffff8eb99560 (cgroup_mutex){+.+.}-{4:4}, at: cgroup_kn_lock_live+0x13c/0x230 [ 509.503846][T19660] #4: ffffffff8e9e75f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 509.514428][T19660] [ 509.514428][T19660] stack backtrace: [ 509.520329][T19660] CPU: 0 UID: 0 PID: 19660 Comm: syz.4.3943 Not tainted syzkaller #0 PREEMPT(full) [ 509.520351][T19660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 509.520362][T19660] Call Trace: [ 509.520370][T19660] [ 509.520379][T19660] dump_stack_lvl+0xe8/0x150 [ 509.520411][T19660] print_circular_bug+0x2e1/0x300 [ 509.520441][T19660] check_noncircular+0x12e/0x150 [ 509.520470][T19660] __lock_acquire+0x1520/0x2cf0 [ 509.520496][T19660] ? __lock_acquire+0x683/0x2cf0 [ 509.520524][T19660] ? kernfs_iop_permission+0x7f/0x430 [ 509.520547][T19660] lock_acquire+0x106/0x350 [ 509.520568][T19660] ? kernfs_iop_permission+0x7f/0x430 [ 509.520592][T19660] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 509.520617][T19660] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 509.520641][T19660] down_read+0x4a/0x330 [ 509.520657][T19660] ? kernfs_iop_permission+0x7f/0x430 [ 509.520680][T19660] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 509.520704][T19660] kernfs_iop_permission+0x7f/0x430 [ 509.520728][T19660] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 509.520750][T19660] inode_permission+0x3de/0x5f0 [ 509.520774][T19660] cgroup_attach_permissions+0x28e/0x9f0 [ 509.520799][T19660] __cgroup_procs_write+0x24b/0x320 [ 509.520823][T19660] cgroup_threads_write+0x24/0x50 [ 509.520841][T19660] ? __pfx_cgroup_threads_write+0x10/0x10 [ 509.520857][T19660] cgroup_file_write+0x331/0x8f0 [ 509.520874][T19660] ? kernfs_fop_write_iter+0x22b/0x540 [ 509.520894][T19660] ? __pfx_cgroup_file_write+0x10/0x10 [ 509.520911][T19660] ? __kmalloc_noprof+0x396/0x720 [ 509.520931][T19660] ? vfs_write+0x22b/0xba0 [ 509.520954][T19660] ? __kmalloc_noprof+0x1ad/0x720 [ 509.520977][T19660] ? __pfx_cgroup_file_write+0x10/0x10 [ 509.520991][T19660] kernfs_fop_write_iter+0x3a4/0x540 [ 509.521012][T19660] vfs_write+0x612/0xba0 [ 509.521040][T19660] ? __pfx_vfs_write+0x10/0x10 [ 509.521068][T19660] ? __fget_files+0x2a/0x420 [ 509.521093][T19660] ksys_write+0x150/0x270 [ 509.521119][T19660] ? __pfx_ksys_write+0x10/0x10 [ 509.521147][T19660] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.521165][T19660] do_syscall_64+0x174/0x580 [ 509.521191][T19660] ? trace_irq_disable+0x3b/0x140 [ 509.521211][T19660] ? clear_bhb_loop+0x70/0xc0 [ 509.521231][T19660] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.521248][T19660] RIP: 0033:0x7f4b2459e0d9 [ 509.521265][T19660] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.521281][T19660] RSP: 002b:00007f4b2539d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 509.521299][T19660] RAX: ffffffffffffffda RBX: 00007f4b24825fa0 RCX: 00007f4b2459e0d9 [ 509.521312][T19660] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 0000000000000006 [ 509.521324][T19660] RBP: 00007f4b24635024 R08: 0000000000000000 R09: 0000000000000000 [ 509.521335][T19660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 509.521345][T19660] R13: 00007f4b24826038 R14: 00007f4b24825fa0 R15: 00007ffedee51c48 [ 509.521365][T19660] [ 509.529106][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 513.010939][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 516.210382][ C1] bridge0: received packet on vlan2 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:1) [ 516.852152][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!