last executing test programs: 2.887588474s ago: executing program 3 (id=7234): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3100000000140004800800024000000000080001400000000074000000060a010400000000000000000100000008000b40000000004c0004804800018007000100727400003c0002800800014000000004080002400000000208000140000000110800014000000015080001400000001e080001400000000408000140000000020900010073797a300000000014000000110001"], 0xfc}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000500)=@gcm_128={{0x304}, "e8ffff0700", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_udp_int(r2, 0x11, 0x68, 0x0, &(0x7f0000000100)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendfile(r1, r3, 0x0, 0x5) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x4, 0x5, 0xb0, 0x1ff, 0x10, @mcast1, @private1, 0x8, 0x7800, 0x8, 0x6}}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r7, 0x84, 0x7c, &(0x7f0000000040)="badd8e37a0feecff", 0x8) ioctl$sock_netdev_private(r6, 0x8929, &(0x7f0000000440)="8d557fd094c38f748ec33512ef3a") bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000017c0)=ANY=[@ANYBLOB="18000000000000000000000000db00dfd51fcdb7e72c3da10000008500000088"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="a6ffffff4800000a2cbd7000ffdbdf250a001800", @ANYRES32=r5, @ANYBLOB="07000000080002000c000000cfe9f58fa5f8a1012aad0539c0503d693cb993191dcea8a28854fd27e02b153c80dda5af4323282520f904d1eb283e9ed4d28e24151d0e6dce31a6065b2177821e5450e1abc9ebc77f9a8079b50017"], 0x24}}, 0x40800) r8 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r8, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r10, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r10, &(0x7f0000002d40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002580)=""/17, 0x11}, 0x2}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r10, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r10, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) vmsplice(r9, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) ioctl$sock_inet_tcp_SIOCINQ(r9, 0x541b, &(0x7f0000000680)) 2.487190009s ago: executing program 2 (id=7238): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx\x00'}, 0x58) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) preadv(r1, 0x0, 0x0, 0x5b3d2934, 0xfffffffa) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES16=r4], 0x1c}}, 0x0) write$nci(r1, &(0x7f0000000200)=@NCI_OP_CORE_CONN_CREATE_RSP={0x0, 0x0, 0x2, 0x4, 0x3, {0x1, 0x33, 0xf7, 0x3}}, 0x7) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r5) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r6, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) shutdown(r6, 0x0) sendmsg$alg(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x840}, 0x4040880) sendmsg$nl_route_sched(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000002740)=@newchain={0x12a0, 0x64, 0xf09d2fbf8b68c555, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x8}, {0xfff1, 0xe}, {0x9, 0xfff1}}, [@filter_kind_options=@f_route={{0xa}, {0x40c, 0x2, [@TCA_ROUTE4_POLICE={0x408, 0x5, [@TCA_POLICE_RATE={0x404, 0x2, [0x5, 0x6, 0xffffffc0, 0x0, 0x5, 0x48d5, 0x6, 0x8, 0x8, 0x6, 0xd, 0x8, 0x933, 0x6, 0x1, 0x7, 0x1, 0x872, 0xbf, 0x0, 0x145, 0xfffffffa, 0x2, 0x8, 0x6000000, 0x9, 0xd, 0xc64, 0x3, 0x1c000, 0x2, 0x3, 0x9, 0x8, 0x5, 0x0, 0x8ec, 0x6, 0x6, 0x2, 0x2, 0x4, 0x8, 0x2, 0xbda, 0x7fff, 0x8db, 0xcb56, 0x0, 0x4, 0xb1a, 0x1, 0x8, 0xfd77, 0x1, 0x4, 0xd8fd, 0x80000001, 0x5, 0x8, 0x2, 0x7ff, 0x3, 0x32a, 0x1, 0x8, 0xc, 0x1, 0x5, 0x0, 0x2, 0x2, 0x5, 0x0, 0x1, 0x4, 0xc0, 0xd, 0x2c, 0xe, 0x2, 0x2, 0xe109, 0x80000001, 0x5e, 0xfffffffb, 0x297, 0x3, 0x81, 0x6ee, 0xce8, 0x7fffffff, 0x7, 0xd, 0x42e, 0x9, 0x8, 0x3, 0x8, 0xfffffffc, 0x5, 0x6, 0x3, 0x5, 0x6, 0xd7d8, 0x35, 0x1, 0x8, 0x6, 0x81, 0xb4, 0x80000001, 0x1, 0x3ff, 0xffff33f7, 0x4, 0x6, 0x10000000, 0x5, 0x9, 0x5, 0x7, 0x7, 0x0, 0x52e, 0x5, 0x8, 0x0, 0x0, 0x1, 0x4, 0x4, 0x1, 0x9, 0x1, 0x5, 0x6, 0x8000, 0x10000, 0x4, 0xffff2237, 0x3, 0x400010, 0xe, 0x5, 0x2, 0x8, 0x7, 0x67e, 0x7, 0x200, 0x6, 0x4, 0x5, 0x9, 0x5, 0x39, 0xe71, 0x6, 0x3, 0x9, 0x2, 0x7, 0xf34, 0xb, 0x0, 0x400, 0x7ef4, 0xa, 0x265, 0x80000001, 0x8, 0x48, 0x7, 0x5, 0x46d, 0x8f, 0x8, 0x7, 0x7, 0x8, 0x8, 0x1, 0x6, 0xdb25, 0xb41c, 0x0, 0x5, 0x4, 0x1, 0x9, 0xe, 0x9, 0x1, 0xd5, 0x4, 0x3, 0x9, 0x2, 0x5, 0x4, 0xf1a, 0x7, 0x2, 0x95, 0x5, 0x993, 0x9, 0xe, 0x7, 0x91, 0x4, 0x400, 0x1, 0x1, 0x3, 0x4, 0x1, 0x2, 0x8001, 0x819, 0xb, 0x8, 0x800, 0x7f, 0x9, 0x2, 0x1, 0x0, 0xffffffff, 0x1, 0x2, 0x1, 0x0, 0x0, 0x9, 0x6, 0x2, 0x2, 0x2, 0x1b328f44, 0x4, 0x6, 0x9, 0x1, 0x0, 0x8, 0x1, 0x3, 0xfffffde0, 0x7, 0x4, 0x6, 0x80000001, 0x7]}]}]}}, @filter_kind_options=@f_cgroup={{0xb}, {0xe58, 0x2, [@TCA_CGROUP_ACT={0xe54, 0x1, [@m_pedit={0xe50, 0x1b, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x4, 0x7, 0x5, 0x4, 0x8000000}, 0x9}, [{0x40, 0x9, 0x5, 0x1, 0x0, 0x2}, {0xffffff5c, 0x7, 0x0, 0x8, 0x9, 0x8}, {0x100, 0x100, 0x80, 0xbbd3, 0x0, 0x6}, {0x3, 0x7, 0x252, 0x5, 0x1ff}, {0x9, 0x7, 0xfff, 0x2, 0xd, 0xfffffffe}, {0x9, 0x9, 0x9, 0x9, 0x1, 0x3}, {0xd2, 0x0, 0x5, 0x10000, 0x7, 0x6}, {0xfffffff8, 0x2, 0x100, 0x3, 0x8, 0x1}, {0xffffff98, 0x40, 0x8, 0x5, 0x40, 0x4}, {0x9, 0xe, 0x7f, 0x2, 0x7b, 0x4}, {0xeb9d, 0x31d, 0x2, 0x31, 0x85a5, 0x9}, {0x0, 0x5, 0x31547498, 0x6, 0x2, 0x9}, {0x400, 0xfffff4ad, 0x9, 0x52, 0x419d, 0x3}, {0x5, 0xac8, 0x9, 0x116, 0x80000000, 0x2}, {0x4, 0x2, 0x4, 0x400, 0x101, 0x68571a57}, {0xffffffbb, 0x4, 0x401, 0x642d495a, 0x5, 0x4}, {0x0, 0x6, 0x5, 0x40, 0x7, 0x6}, {0x1, 0xfff, 0x2, 0x6, 0x2, 0xffffffff}, {0x0, 0x3, 0x10000, 0x6d}, {0xf, 0xd, 0x6, 0x7, 0x40, 0x381}, {0x80000001, 0x800, 0x6, 0x40d, 0x8, 0x2}, {0x944, 0x7, 0xfffffffc, 0x401, 0x6, 0x3}, {0x1, 0x0, 0x918, 0xfffffffd, 0x80, 0x200}, {0x9, 0x40, 0xb40, 0x800, 0x4, 0xf}, {0x784, 0x0, 0x42, 0x14d, 0x8c}, {0x8001, 0x6, 0xfffffff6, 0xfffffe00, 0x3, 0x1}, {0x1000, 0x4, 0xffff, 0xffffffff, 0x5, 0x4}, {0x1, 0x9, 0x5d5b, 0x40, 0x4, 0xb765}, {0x7, 0x3, 0x4, 0x4, 0x100, 0x1}, {0x1, 0x5dc, 0x800, 0x1b0, 0xfffffff8, 0x3d2d}, {0x2, 0x8, 0x5, 0x2, 0xb, 0xa8}, {0xc0, 0x22f63e74, 0x9, 0x4, 0xf, 0x6e}, {0x2c89, 0x2, 0x101, 0x5, 0x30, 0x7}, {0x0, 0x0, 0x80, 0x2, 0x61e9, 0x2}, {0x8, 0xffff, 0x8, 0x5, 0x7, 0x4}, {0x7, 0x9, 0x71, 0x3, 0x2, 0x7}, {0x800, 0x8, 0x6, 0x3, 0x1, 0x4}, {0xcf9, 0x4, 0xaad, 0xb0, 0x1, 0xedfb}, {0x7, 0x8, 0x5, 0x7f, 0x6, 0x4}, {0xe, 0x3, 0xf, 0x6061faa0, 0x8, 0x3fe0000}, {0x80000000, 0xdbf3, 0x80000001, 0x1000, 0x2, 0x9}, {0x2, 0x2, 0x7, 0x7, 0xfffffffa, 0x8}, {0x4, 0x7fff, 0x8, 0x101, 0x3, 0x6}, {0x0, 0x7f800000, 0x75, 0x2, 0x3e9, 0x3}, {0x9, 0x1, 0x7, 0x6, 0x5, 0x190b}, {0xe, 0x1000, 0x2, 0x6, 0x3, 0xd5}, {0x8, 0x75, 0x7ff, 0x7398, 0x6, 0x10001}, {0xfffffff7, 0x4, 0xfffffff9, 0x4997, 0x7fffffff, 0x200}, {0x4, 0x101, 0x7f, 0x401, 0x9, 0x7f}, {0x1, 0xf, 0xe, 0x2, 0x8, 0xe410}, {0x7, 0xe, 0x101, 0x400, 0x8907, 0xa04}, {0x2, 0x1, 0xc, 0xc, 0x3, 0x9}, {0x5, 0x0, 0x4, 0x1, 0x80000001, 0x3}, {0xa98f, 0x4, 0x9, 0x800, 0xd3, 0x3}, {0x9, 0x0, 0x6, 0x9, 0xd9, 0x7af7}, {0x5, 0x6, 0x2d8, 0x2, 0xefc, 0x80000001}, {0x10c, 0x3, 0x2978, 0x8, 0x8, 0x4}, {0x8, 0x8, 0x3, 0x3, 0xffff7fff, 0x1}, {0x0, 0x80, 0x5, 0x0, 0x4, 0x8}, {0xfffffffc, 0xfff, 0x6, 0xe, 0x7fff, 0xb11}, {0x7d7, 0x5, 0x7, 0x6, 0xb, 0xfffffffb}, {0x9, 0x800000, 0xfffffffd, 0x6, 0x5, 0x6}, {0x9, 0x0, 0x7, 0x7fff, 0x40, 0x5eb}, {0x10001, 0x1ff, 0x0, 0x4, 0x6, 0xafe5}, {0x7ff, 0xffffffff, 0x7fffffff, 0x3, 0xfffffffc, 0x4}, {0xfff, 0x100, 0x81, 0x8001, 0xa066, 0x1ff}, {0x3ff, 0x236, 0x5, 0x7fffffff, 0x4, 0x7ff}, {0x3, 0xc57d, 0x33400000, 0x1, 0x2, 0xfffffffa}, {0x8, 0xffff, 0x10, 0x101, 0x844, 0x28}, {0x0, 0x8, 0x1, 0x6, 0x7, 0x5}, {0x200000, 0x1, 0x6, 0xbc, 0xa4e, 0x7}, {0x1, 0x10, 0xa, 0x6, 0x3, 0x3}, {0x5, 0x3, 0x7ff, 0x5, 0x82bf, 0x1}, {0xe75, 0xfffffff8, 0x5, 0x0, 0x8, 0x9}, {0x0, 0x2, 0x5, 0xf522, 0x1a23, 0x29}, {0x6, 0xd9b4, 0x1, 0x3, 0x5, 0x10001}, {0x80, 0xc1b0, 0x80000001, 0x2, 0xffffffff, 0x80000000}, {0x10001, 0x5, 0x5fc, 0x1176a235, 0x6, 0x2fd9}, {0xbd, 0xff, 0x101, 0x0, 0x6, 0x37f}, {0x4, 0x3fb, 0x60d31cf6, 0x7, 0x7ff, 0x38000000}, {0x6, 0x7, 0x1, 0x7, 0x4}, {0x8, 0x5f2d, 0x4000000, 0x6, 0xd, 0x1}, {0xf6, 0x1, 0x5, 0x200, 0x4, 0x4}, {0x0, 0x3fffc0, 0x6, 0xc, 0x5fcd, 0xef3}, {0x0, 0x24, 0x0, 0x54, 0x12, 0x94}, {0x0, 0x0, 0x5, 0x80000000, 0x9, 0xf545}, {0x0, 0x80000000, 0x1000, 0x0, 0x6}, {0x7f, 0x0, 0x9, 0x0, 0x5}, {0x200, 0x3, 0x5, 0x4, 0x0, 0xd}, {0x685, 0x787, 0xd, 0x4, 0x4, 0x3}, {0xd33b, 0x0, 0x0, 0x1, 0x4, 0xc0}, {0x1, 0x8000, 0xfffffff1, 0x7ff, 0xbab, 0xb9}, {0xb, 0x4, 0x7e2d03df, 0x9, 0x0, 0x5}, {0x0, 0x1, 0x5, 0x176, 0x6, 0x7}, {0x4, 0x2879f55c, 0x7, 0x3, 0x3, 0x739}, {0x800, 0x79a, 0x3, 0xffff7fff, 0x8, 0x5}, {0x5, 0x6, 0x1, 0x80000001, 0xfff}, {0xb000, 0x0, 0x1ff, 0x4, 0x3, 0x9}, {0x4, 0x1aca, 0x2, 0xb1, 0x5, 0x5}, {0x1bb, 0x40, 0x8, 0x9, 0x80000001, 0x800}, {0x5, 0x81, 0x3a5, 0xe6, 0x2, 0xbd9}, {0x27d, 0x87, 0x6, 0x3, 0x1, 0x42}, {0x7f, 0x4, 0xffff, 0x8000, 0x0, 0x1}, {0x0, 0xc, 0x8, 0x4, 0x7, 0x466}, {0x7, 0x176, 0x40, 0x2, 0x76, 0x9}, {0x9, 0xb204099, 0x800, 0x8000, 0x9, 0x6}, {0xb, 0x40, 0x101, 0x2, 0x4, 0x3}, {0xa, 0x1, 0x7, 0x0, 0xfffffdaa, 0x1}, {0x5, 0x5, 0x6, 0xffffffff, 0xd5b, 0x3}, {0x0, 0x80, 0x7ff, 0xd, 0x5, 0x2}, {0xfffffff0, 0x2, 0x7, 0x3, 0x2, 0x7fffffff}, {0x2003, 0x400, 0x3, 0x8, 0xfffffffb, 0x6}, {0x58c2, 0x4, 0x26, 0xffffffff, 0x9, 0x7}, {0x2, 0x7, 0x436, 0x8, 0x7, 0x6}, {0x800, 0xff07, 0xffffffb4, 0x5, 0x963, 0x2}, {0x2, 0x6, 0x8, 0xc, 0x80000001, 0x4}, {0x3, 0x2, 0xfffffffb, 0x8, 0x6, 0x140}, {0x2, 0x5, 0x10001, 0x8, 0x2, 0x2}, {0x6, 0x5239, 0x6, 0x974f, 0x4, 0x2}, {0xff, 0x9, 0x10, 0x800, 0xf, 0x8000}, {0x7, 0x8, 0x0, 0x7fff, 0x7f5f, 0x4}, {0x1000, 0x6, 0xfffffffc, 0x5, 0x3, 0x81}, {0x0, 0xe196, 0x4, 0x800, 0x1, 0x94}, {0x80000001, 0x217021e6, 0x2702ff34, 0x9b40, 0x3}, {0x57cf8ce0, 0x2, 0x76, 0x80000000, 0x12, 0x7}, {0x4, 0xfffffff6, 0x2, 0x1000, 0x1ff, 0x2}, {0x8, 0x9, 0x6, 0x4316, 0x6, 0x7}, {0x6, 0x7, 0x7, 0x2, 0x1, 0x8}], [{0x5, 0x1}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x4}, {0x0, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x2}, {0x3}, {0xf9923793e02d7db6}, {}, {0x2, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x5}, {0x2, 0x1}, {0x1}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {0x5}, {0x4, 0x1}, {0x4, 0x1}, {0x3}, {0x0, 0x1}, {}, {}, {0x1, 0x1}, {0x4, 0x1}, {}, {0x2, 0x1}, {0x3, 0x1}, {0x7, 0x1}, {0x2}, {0x2, 0x1}, {0x4}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x2}, {}, {0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x1}, {0x4, 0x1}, {0x5}, {0x2}, {0x2, 0x1}, {0x1, 0x3}, {0x7}, {0x5, 0x1}, {0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x4}, {0x5}, {0x2, 0x1}, {0x0, 0x1}, {0x5}, {0x5, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x2}, {0x4, 0x1}, {0x1}, {0x3}, {0x3}, {0x1, 0x1}, {0x3}, {}, {0x5, 0xe1835468be4c3e98}, {0x0, 0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1}, {0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x5}, {}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5}, {0x7, 0x1}, {0x3}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x9a9242c1bef3e2b4}, {0x2, 0x1}, {0x2}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x12a0}, 0x1, 0x0, 0x0, 0x4004880}, 0x44000) 1.883432462s ago: executing program 3 (id=7248): r0 = socket(0x840000000002, 0x3, 0x100) setsockopt$inet_msfilter(r0, 0x0, 0x30, 0x0, 0x2000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000480)=ANY=[@ANYRESDEC=r0, @ANYRES16=r0, @ANYBLOB="00000000000000001c0012800c0001006d0900000000000000000280080001000800000008000500676d9e977aba66c4a0bef67775d9e6337c90687449e7ae10ac50cf7cbd24a325ce840a9ad4032535d8851a60313fa03441f0e491311c43b36685ed0307000000000000008f1e431adae86bc55a32cf6480cf2fb03707b7d24d6d04c6d655ff95e21afc1b3e0905324384004b1c44c35154192c3461dfd5154e681e656be1c2792c92e6c0f9118032d257c9d6d447559296a37378106d4fc4393b4ca06fdc0c9cf54040a9f721fb47f73a81262f91289c328ba553cb6c0babb878c10ca9f408c63817643dc7d77aaf2c0ea3e040434e5d3706ea9e4d13f7fde70c36c67fb0ee5c43f4dcf57479fb5bf7c4e65e703f6de4f0fca608954fb3303c6db292c1f5617f5d0fb7ca4e0986cad7ddea02eb820f532b97c7b4d6b165e8e455deaa7da23376ecde16fe025ddcf15688c3ba0109e7c330d2e972902c79e3725f305b135d2659e7f3cd5c32bc0eced619e027f48a882279f49b4a633bfbc38cf336e601d0141cf3b55cca125363870962240397e33ede871e4b8ef46720c455dc8dd2a3c919e2245deefcc58814fac3402b83ab6e9c6f09563848f27090bd111f72e68dc8b5c79be2fcd26b73c92ddb21be7e7a1e5200cc08f32ee42dc01107b7731b59d1326f1b54e200f87e0f10dad95de451469a3a27922b03df3facb5dd3af8b87564", @ANYRES32=r0, @ANYRES32=r0, @ANYRES8=r0], 0x44}, 0x1, 0x0, 0x0, 0x20000080}, 0x4045) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x100, 0x70bc25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) socket$kcm(0x10, 0x2, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="b31f05604c464bed3d53cca495ed40787cc1e9b415bb21f9f409d400a828f4cf0541abd969d7ae2b66c2fb3728be89220ea3c7065accdc31d2fd1162089c39b180233d4de244f94d277775950a19947d7b50c288e83292786893e195bc7da1c387f99539028079152caaa277f00878229b054871432388fec7804c9c7fdb9dc342a379f70529baae953024ac325499267a25c06e4ce726"], 0xe4}, 0x1, 0x0, 0x0, 0x8081}, 0x4004800) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x1000005, 0x10, 0xffffffffffffffff, 0xae0da000) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x1, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x6, &(0x7f0000000140)=0x2000001, 0x6e5aca7c8c673eef) sendto$inet(r3, 0x0, 0x0, 0x4048002, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendto$inet(r3, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000024c0)=@delchain={0x2c, 0x64, 0x425, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x0, 0xfffb}, {}, {0xb, 0x7}}, [@TCA_CHAIN={0x8, 0xb, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8808}, 0x800) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) 1.658940707s ago: executing program 3 (id=7250): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r1, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) (async) bind$bt_sco(r1, &(0x7f0000000080)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) listen(r1, 0x0) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70b524, 0x25dfdbf9, {0x0, 0x0, 0x0, r5, {0xfff3, 0xffe0}, {0x0, 0xfff1}, {0xfff3, 0x1}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4008849}, 0xc884) ioctl$sock_inet_SIOCDARP(r0, 0x8955, &(0x7f00000004c0)={{0x2, 0x0, @broadcast}, {0x0, @random="9f444415c302"}, 0x4, {0x2, 0x0, @broadcast}}) 1.56711417s ago: executing program 2 (id=7252): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0x18, 0x7, &(0x7f00000005c0)=ANY=[@ANYBLOB="8510000004000000950000000000000018000000000000000000000000000000950000000000000085100000fcffffff95"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newlink={0x38, 0x10, 0x401, 0x2000000, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, 0x0, 0x1084}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x38}}, 0x20044840) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x2, &(0x7f0000001680)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @multicast1}]}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x40}}, 0x0) 1.537932665s ago: executing program 0 (id=7253): r0 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) (async) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000580)=0x14) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="540000001000370401000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="890c04000000000005001000050000002c0012800b00010067726574617000001c00028005001700000000000800040003000000060003009c"], 0x54}, 0x1, 0x0, 0x0, 0x44801}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) getsockopt$sock_buf(r2, 0x1, 0x2d0d7c888459f2b7, &(0x7f00000003c0)=""/252, &(0x7f0000000140)=0xfc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r4, 0x2) recvmsg(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000002640)=""/4096, 0x1000}], 0x1}, 0x40000001) setsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000000180)=0x5, 0x4) (async) setsockopt$llc_int(r0, 0x10c, 0x5, &(0x7f0000000180)=0x5, 0x4) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) (async) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r5) (async) close(r5) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) (async) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random}) (async) ioctl$SIOCSIFHWADDR(r6, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random}) sendmmsg$inet(r2, &(0x7f0000003380)=[{{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, 0x0, 0x0, &(0x7f0000001a40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @empty, @rand_addr=0x64010102}}}], 0x20}}], 0x1, 0x4040880) 1.500862668s ago: executing program 2 (id=7254): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="0104000000000000004008000000"], 0x14}}, 0x0) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0xd0bb0, 0x8}, 0xc) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000), 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7050000080000a8c5000000a5000000180100002020640500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002780)={0x28, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @fd}]}, @nested={0x4, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = socket$inet_smc(0x2b, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r2, &(0x7f00000000c0)="55f09f79b7839225d9d55598c872469dcba12aedcb188ae612142934faa287882dcf67948df66590fb026d2c6aee07ea4afa02a18fbf647e3b4e2a0d9a489545f58fe28dd8f2d47f0788ba5849d59bac8162dda4b5d07cb0748e5b79e4ed8385bede6061d72c5da3bf2175705a9b696e2c5c0a99bee6e43c9b374f62de9c3e918a4111cdb9", &(0x7f0000000180)=@tcp=r6}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="b4050000000000007911c00000000000850000008e00000095000000f8000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x3}, 0x10}, 0x94) bpf$ENABLE_STATS(0x20, &(0x7f0000000300), 0x4) 1.499184142s ago: executing program 3 (id=7255): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x67b}]}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = accept4$inet6(r3, &(0x7f0000000240)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000280)=0x1c, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x23, &(0x7f0000000600)="ee340ad606a8ba6e1e06303bac9177f9a3f6d9178ca1bad7eccc3d7ae8b07450e0a3c731907db20ecf01a9511db303e44811acbd45ffffdf94bd96e076302cf7d8b6e3fa8ffe70ad9535c25c101c0370a80d867a2973a213fd246db2454a0041bcb061928774290f65a55b06443fb6112b943a42b44409af03583799006b61bf1e12650e8f23dbe8b8d7a9b52d8b0a96e406b358114283a359b6100ffc316e2b73b5c1ecde61f6334c2bc202dc5a21ba3677b7ebc31d8cf4fead8b28598ef3e2f2017f10902e9465d589a3950d3431421b1001587a3ff3fb44f2505aca95294352b9bab9f622bd68cffc51a9de586eb2d128f82e0166a8e05355ac32c2a7b3ffa8aa1c297a224157e559cba87d222acc8bf5a878b2b46aae5fa33417905912f9a36c7504bdb32893abc018b8efc30d4a3239f5925c97d29bc377503f066d56a082812d832b38c4564e57b77e9983ada720e4b2", 0x153) close(r3) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r5 = accept4(r2, 0x0, 0x0, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000300)={@local, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x68, 0x0, 0x0, 0x88, 0x0, @remote, @local}, {0x4e20, 0x4e24, 0x9c, 0x0, @wg=@initiation={0x1, 0x3, "497a1d08fd3d0ee007022798bb6374ed840b4f36f41fc4d035e9ebe414aa958d", "4bbef5e4007898221aa606d083cd59745493938f1e2de8fdadd3823fedd2c01b2aff03050a4ca5d10fd1b6b06f47ea42", "ef7c9d6a98e3943f6892078bb952854743fe4dddd2e7c0ce70a4ac7d", {"a851525b16af17fe87acbae2ab0b233d", "d8e4ad6fc1d3b573e94331d0b791a724"}}}}}}}, 0x0) sendmsg$alg(r5, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) recvmmsg(r5, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}], 0x1}, 0x3}], 0x2, 0x62, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'team_slave_1\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000740)={'team0\x00', 0x0}) r11 = syz_genetlink_get_family_id$team(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={0x5c, r11, 0x809, 0x70bd27, 0x25dfdbfc, {}, [{{0x8, 0x1, r10}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r9}}}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4040}, 0x4004000) connect$bt_rfcomm(r5, &(0x7f00000000c0)={0x1f, @any, 0x2}, 0xa) sendmmsg$inet(r1, &(0x7f0000000100)=[{{&(0x7f00000004c0)={0x2, 0x4e24, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) readv(r12, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/243, 0xfffffdef}], 0x1) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r13, 0x0, 0xfe33) sendto$inet(r1, &(0x7f0000000c80)="e8", 0x6200, 0x12000000, 0x0, 0x0) 1.359000991s ago: executing program 2 (id=7257): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x9006000, &(0x7f00000030c0)=[{&(0x7f0000000180)="1400000016001963d25a80648c56915a19aa2bfe", 0x14}], 0x1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8b07, &(0x7f0000000080)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) (async) socket$kcm(0x10, 0x3, 0x10) (async) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x9006000, &(0x7f00000030c0)=[{&(0x7f0000000180)="1400000016001963d25a80648c56915a19aa2bfe", 0x14}], 0x1}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8b07, &(0x7f0000000080)={'virt_wifi0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}) (async) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}}, 0x0) (async) 1.326472128s ago: executing program 0 (id=7258): r0 = socket(0x40000000015, 0x5, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048801) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=@deltfilter={0x24, 0x2d, 0x400, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0x6}, {0x2, 0x3}, {0xb, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x100, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FLAGS={0x8, 0x8, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x34045803}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRESOCT=r0, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000500)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x14937112027866e7) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x13, r3, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r3}, 0x4) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r4 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) getsockopt$ax25_int(r4, 0x101, 0x5, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$AUTOFS_IOC_EXPIRE(r4, 0x810c9365, &(0x7f0000000340)={{0x6, 0x7fff}, 0x100, './file0\x00'}) 1.31032448s ago: executing program 4 (id=7259): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) r1 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet6_mreq(r0, 0x29, 0x14, &(0x7f0000000000)={@remote, 0x0}, &(0x7f0000000040)=0x14) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={'erspan0\x00', r2, 0x1, 0x20, 0x40, 0xc1, {{0xf, 0x4, 0x1, 0x3d, 0x3c, 0x65, 0x0, 0x6a, 0x2f, 0x0, @loopback, @empty, {[@ssrr={0x89, 0xb, 0x4, [@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x1d, 0x1, [{0x6, 0x4, "93d7"}, {0x7, 0x11, "3ae2032cc0060babad5e2799e97612"}, {0x6, 0x2}]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYRES32], 0x48) bpf$MAP_UPDATE_BATCH(0x19, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd600000000018060100000000000000000000000000000000fe8000000000000000000000000000aa04004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="68c200009038"], 0x0) 1.19142077s ago: executing program 2 (id=7260): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x7d, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000cc0)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_PMKSA(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002cbd7000ffdbdf253500000008000300", @ANYRES32=r4, @ANYBLOB="14309e0c603631cca7b50c6888d307000000ae7b3107a0b800000000000000000000003f6d371b753da3bfadeeb78acb810c2a5b78c548ccf8374349a793c87bc272250b31ea46"], 0x30}, 0x1, 0x0, 0x0, 0x811}, 0x20000080) sendmsg$NL80211_CMD_REGISTER_FRAME(r1, &(0x7f0000000700)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x24, r3, 0x21b, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x8850}, 0x811) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'ip6_vti0\x00', &(0x7f00000002c0)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x0, 0x8, 0x40, @mcast2, @ipv4={'\x00', '\xff\xff', @loopback}, 0x20, 0x7, 0x6, 0xad0b}}) sendmsg$nl_route(r1, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="54000000490000012dbd7000fddbdf250a003f00", @ANYRES32=r6, @ANYBLOB="0200000014000100fc000000000e00000000000000000001080002000000000008000200b73d000014cc3fc5e38b3cf52200000000000000000000bb2765f3358d87ddc13f94db28"], 0x54}}, 0x40000) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)=0x80000000, 0x4) sendmsg$AUDIT_USER(r1, &(0x7f0000000600)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000500)={0xd4, 0x3ed, 0x1, 0x70bd2b, 0x25dfdbfe, "b775c5574581d39689d2ae3b8c9564cfb074dad170570781d4655d487bdd99dfc7f85a7aaee8f74d67017e52bf9f193185be7a0e76ed61618c49f4cf973e343db11ecfb20a990ded9c2ff942d9774cb66f736cc984c913a5c864ec095f919e08e02f55e4fa23ecd4cee80e9b69334402201b9b516ea6fd8498f31fbcca944642c30caea633d74c2953531c1f8aa0bfca801185e904b5e366818f8564818ae774b8cec99933712234cf406a9c7361b8c2f5fe704c312203231d3953a80958ac0ee2", ["", "", "", "", "", "", ""]}, 0xd4}, 0x1, 0x0, 0x0, 0xbf0845d035bc3fc7}, 0x81) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x33, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) listen(0xffffffffffffffff, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip_vti0\x00'}) pipe(&(0x7f0000000100)) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="1c040000000000faff0000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000400"/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r7, &(0x7f00000000c0), &(0x7f0000000000)=""/10, 0x2}, 0x20) r8 = epoll_create1(0x0) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r9, 0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r9, &(0x7f0000000080)) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r7, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) bind$phonet(0xffffffffffffffff, &(0x7f0000000440)={0x23, 0x4, 0x9, 0x6}, 0x10) sendmsg$kcm(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000091008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x40000) 1.163650898s ago: executing program 0 (id=7261): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="eed857f1d5cc6491a4dcbd4fef30ddd9fc07c77945ad3c6558e490fa99a98af6532777dbd603c15553aeea674cbe36686b747d3f8c685aec254021896debd901ebd277b5b61849b6e826e31695db6f9317755acba4b6c9082fd87049af4a1a3a2180167d83877ab8828d26298f8e18a18c91b72f3bb96a96da1fa3b42a6859bed643b4def84c6b18523beba7f28a8d825f198fd639d6ceedfb162738b09f06c9d1039d992b0231e6393b2ad4854c4da7efef4793bcc4578a47fe735402560ec7e3bf84252a3846fa1c4a0c88cd58b0a07cff27b74bf49209dbd13133dafce206b7f37371c368ad269cc609a17ce7a733568c98cf037bfbf6e829d60c73999b9cb5a4765d030a5fcf9aef2547666dbbda89b939d4bd1a35548ae5c659e71d53b06dc9b9a86957ac556e29220fdc6af58faada581a11957c8bbfeeac86c1af55c9404f43363254cebf37db67dccfed9b2814884bd5ee4c4934ec25c174846838328575db636604a499174b990f9c45ac7b47a66c981243cb21d6b2bd2bb549597abe390f82fa973edb8e9d6a1c02921c77daf82317cdd7490bb61ff3adaaa33e63ebf9fd94b8a6142ecbfbbdcf7469d8d9e3bfcb0a0096790e2b0765d4fdf654416d58546450"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bf8200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 1.118829826s ago: executing program 2 (id=7262): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x8000000, {0x0, 0x0, 0x0, r7, {0x0, 0xe}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0xe, 0x7, 0x6361, 0x1, 0xffffffff, 0x6}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa, 0x7, 0x7, 0xfffff8d2, 0x1, 0x80, 0x1}}, {0x4}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20008001}, 0x24004880) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x85, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800000}}}, 0x90) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)={0x38, 0x2e, 0x9, 0x70bd26, 0x0, {0x4}, [@nested={0x24, 0x11, 0x0, 0x1, [@generic="9326988d2516e0eff7e551cd3040c3a66adbc8caab96d3061d1fe91ff4f07d0c"]}]}, 0x38}, 0x1, 0x0, 0x0, 0x42804}, 0x4000000) 1.00082709s ago: executing program 0 (id=7265): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) r4 = socket$inet6(0xa, 0x4, 0x9ec8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r4, 0x84, 0x6c, &(0x7f0000000200)={0x0, 0x4c, "f4f2e8269ba20dd9a3133a4416cba03bab091507c9e4701b85eb8878472cbc2a2e51c24d684c4de0ee6abcab7ac3cc19271cb96c90f581817be4b2bc108194354b5240b01b640b15248ad376"}, &(0x7f0000000180)=0x54) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000300)={'syzkaller0\x00', @random="e15e1cfb536c"}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r7, 0x10e, 0x4, &(0x7f0000000140)=0x4, 0x4) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0x10, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xf}, {0x0, 0xfff3}}}, 0x24}}, 0x0) socket$inet6(0xa, 0xa, 0x8) r12 = socket(0x400000000010, 0x3, 0x0) r13 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000027c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r14, {0x0, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xfff1, 0x9}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x0) r15 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r15) socket(0x1d, 0x5, 0x80000001) 903.568207ms ago: executing program 4 (id=7266): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0xe}, {&(0x7f0000000500)="873868307a570da7d96620b611b10c0b97722160f94f6381", 0x18}], 0x2) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x44084}, 0x20040800) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200000054000480500001800a000100696e6e65720000004000028008000240200000840800034000000007080004400000000f08000140000000001c0005800c000100707b796c6f6164000c00028008000240000000050900010073797a30000000000900020073797a32"], 0xa8}}, 0x0) 903.103253ms ago: executing program 1 (id=7267): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000380)=0x2, 0x4) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)=""/111, 0x6f}], 0x1, &(0x7f00000003c0)=""/172, 0xac}, 0x6}, {{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000540)=""/114, 0x72}, {&(0x7f00000005c0)=""/193, 0xc1}], 0x2, &(0x7f0000000700)=""/251, 0xfb}, 0x5}, {{&(0x7f0000000800)=@caif=@dbg, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000880)=""/102, 0x66}, {&(0x7f0000000900)=""/131, 0x83}, {&(0x7f00000009c0)}, {&(0x7f0000001780)=""/4096, 0x1000}], 0x4}, 0x8}], 0x3, 0x10002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000480)="b7028d7a89a1a9e34b7acba3d9bff1ab77e1", 0x12}], 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r2, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x100000e, 0x10012, r1, 0x3549e000) r4 = socket$kcm(0x11, 0x2, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8918, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8916, &(0x7f0000000040)={'veth1_macvtap\x00', @random="0200ac7f7f00"}) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483d0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) r7 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f00000001c0)=0x1) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000040)={r7}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r8, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6}]}) r9 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\t\x00\x00'], 0x50) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="500000001000370400"/20, @ANYRES32=r6, @ANYBLOB="8b040400000000003000128008000100736974002400028008000100", @ANYRES8=r9, @ANYRES64=r4], 0x50}}, 0x0) ioctl$TUNSETQUEUE(r8, 0x400454d9, &(0x7f00000000c0)={'macsec0\x00', 0x400}) ioctl$TUNSETQUEUE(r8, 0x400454d9, &(0x7f00000006c0)={'bridge_slave_0\x00', 0x600}) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/pid\x00') 833.154142ms ago: executing program 1 (id=7268): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001c000000bca30000000000002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff"], 0x0, 0x2}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="760a00000000000061119800000000000000000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00'}, 0x80) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000580)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000400)={&(0x7f0000000500)=@bridge_delvlan={0x64, 0x71, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_RANGE={0x6, 0x2, 0xe}}, @BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_ID={0x8, 0x1, 0x8}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x1, 0x2}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x31, 0x3}}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5, 0x3, 0x3}}, @BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_STATE={0x5, 0x3, 0x1}}]}, 0x64}, 0x1, 0x0, 0x0, 0x28004}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000c7057b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000bab704000000000000850000001600000095"], 0x0, 0x6, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="01005634c8000009000000017b090000510000000000"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000002440)=ANY=[@ANYBLOB="34000000090605000a00000000000000000000000900020073797a300000000005000100060000000c00078006000440"], 0x34}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6gretap0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b036c00e0ff64000200475400f6a13bb10000000800894f4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x0, r6}, 0x14) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$BTRFS_IOC_DEFRAG(r8, 0x50009402, 0x0) sendmsg$nl_route(r7, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@delneigh={0x1c, 0x1d, 0x400, 0x70bd2a, 0x25dfdbfe, {0x1c, 0x0, 0x0, r6, 0x4, 0x44, 0xb}}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4) 761.951468ms ago: executing program 1 (id=7269): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="bc1b0000400007012bbd700000000000017c00000400c2800c00018006000600843b0000971b02805402178006"], 0x1bbc}, 0x1, 0x0, 0x0, 0x4048011}, 0x0) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x6a040000) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a60000000060a090400000000000000000200fffe0900020073797a32000000000900010073797a300000000034000480300001800a0001006d617463680000002000028005000300000000000b000100736f636b657400000800024000000003"], 0x88}, 0x1, 0x0, 0x0, 0x24044800}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000000000)={'nat\x00', 0x4, "99161d83"}, &(0x7f0000000080)=0x2c) 711.493378ms ago: executing program 4 (id=7270): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3c00000010000100000000000000000004000000", @ANYRES32=0x0, @ANYBLOB="000000000001000014001680100001800c000400feffffff0400000008001b"], 0x3c}}, 0x0) setsockopt$MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x1, 0x8, @rand_addr=' \x01\x00', 0x8}, {0xa, 0x4e22, 0xffffffff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x0, {[0xfffffffa, 0xaa6, 0x7fffffff, 0x6, 0x1, 0xfff, 0x101]}}, 0x5c) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a300000000050000000090a010400000000000000000700000008000a40000000000900020000000031000000000900010073797a30000000000800054000000021"], 0x98}}, 0x0) r3 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000500)={&(0x7f0000000180)=@sco, 0x80, &(0x7f0000000200)=[{&(0x7f0000000000)="5c675b9ad967f63671dc69b5747c775531b0299b6711091a339788bd", 0x1c}, {&(0x7f0000000080)='I2kf', 0x4}], 0x2, &(0x7f0000000240)=[{0xc0, 0x84, 0x929, "a07636b4d5354486aebcd7801b876b662646a681545a42c8d38d618d09115b755ed397a56ecc1650524d66960b8e53978314bb0f431609f3946d465744aaf48426ea82a4bb86cd54b95a2bb9ba81ae6dc501e3e39e191efcc15d96c79c9fe6efca438bd2e9e58386e56cd29a66dfc52f097866f487cf83689a2c86d98cd96eba03197ecdac534160929bcc6a9b299f58ed796e9dddfad66748cb6e8b9cabddf46719a4010fa97957599edce144"}, {0x70, 0x109, 0x8000, "17df7a8830729cef63595be6e0775c4ad5802d46980df7f583bd4486a0ef4346bbe055f81abdf86186e85943e7459e5e2f05d06d8873f97cff0bf74fe4f548d9a52806831eb0e3aa4a34d01bc4fddd82768c74e14cf8d30efb0e1f9a2dde13"}, {0x80, 0x102, 0x1, "4808685542d942ead210af3dd95978d24fddf258473f5b5d6d9677b2046c92e86a629894f0af7074ae9f60c9aed12b424ff39d381e6237f0f88758aabceed8aa002b153563a652a645409081476e2d2bd20616a4d9d735b0037d9a3f9fce6fc083899ab3d86cda642820660f91e8065d"}, {0x100, 0x118, 0xa3, "cb73dc5556eceb8fac75d357ff4ab050ca02a8edcf7cf26e6ee632d681f6d9852c08b7cb80c822102bd66cf0ca15cb0d068a5db1ac71bf4b932616b75db42d760f087760b5ae8fc1393879b5fc6d4eeffedce2bb5b9093dc36f6e6fd2a821d4c2c4f9959e46e7b285eaa73e5dc6581e23c10d7881a5e16862f467c469d4ed17b5280e89a0be6fabe119b4d86ec1dddf24f33f0c0667f7a44bef74dbe612741606774c08adc691189e00512cd62b6c8e2182e00da11d9e14e389398c98085870e774f4862f72529e2becd1f0f70130fc411e2347f2b548557fe3733b4334f51ebf7a641c4d040d22df42b259b470e0cee"}], 0x2b0}, 0x8041) 597.519563ms ago: executing program 1 (id=7271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x3d, 0x0, &(0x7f0000000040)) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="34000000000801b50000000000000000000000030600024080f300000400048005000300010000000900010073797a31"], 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x34, &(0x7f00000000c0)={@multicast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0x12, 0x0, @opaque="6b8b836832cfd4d288a8"}}}}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000000000000000580000014000500ffffffffffffffff00000100000000001c00090008"], 0x4c}}, 0x140400c0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x35, 0x301, 0x70bd26, 0xfffffffc, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x1882}, 0x0) sendmsg$key(r2, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)={0x2, 0x400000000000003, 0x0, 0x0, 0x16, 0x0, 0x0, 0x0, [@sadb_lifetime={0x4, 0x3}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @local}}, @sadb_lifetime={0x4, 0x4}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}]}, 0xb0}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r4, 0x0, 0x80, &(0x7f0000001d80)=@broute={'broute\x00', 0x20, 0x4, 0x12e, [0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000c0], 0x0, 0x0, &(0x7f00000000c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{0x3, 0x7, 0x0, 'vlan0\x00', 'veth0_to_team\x00', 'ip6gre0\x00', 'team0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, [0xff, 0x0, 0xff], @local, [0x0, 0xff, 0x0, 0xff, 0xff], 0x6e, 0x6e, 0x9e, [], [], @common=@AUDIT={'AUDIT\x00', 0x8}}]}, {0x0, '\x00', 0x2, 0xfffffffffffffffe}, {0x0, '\x00', 0x4, 0xfffffffffffffffe}]}, 0x1a6) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0xfc) 580.30632ms ago: executing program 3 (id=7272): ioctl$PPPIOCSFLAGS1(0xffffffffffffffff, 0x40047459, &(0x7f00000000c0)=0x80040) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000780)={0x1c, 0x35, 0x107, 0xffffffff, 0xfffffffe, {0x5, 0x7c}, [@nested={0x8, 0x4, 0x0, 0x1, [@nested={0x4, 0x149}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0xc000) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c000380080009"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x60}, 0x1, 0x0, 0x0, 0x4004880}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x140, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@multicast1, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in6=@private1, 0x4d6, 0x32}, @in=@multicast2, {0x0, 0x0, 0x0, 0x4, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x0, 0x1}, {}, 0x70bd2c, 0x3500, 0x2, 0x0, 0x0, 0x50}, [@algo_aead={0x50, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x20, 0x60, "210466d3"}}]}, 0x140}, 0x1, 0x0, 0x0, 0x880}, 0x2014) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffffffffffffffff}, 0x6) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2}, [@FRA_FLOW={0x8, 0xb, 0xe}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x1403, 0x100, 0x70bd26, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x80) setsockopt$bt_hci_HCI_FILTER(r2, 0x0, 0x2, &(0x7f0000000080)={0xff, [0xa, 0x80000000], 0x3}, 0x10) 503.518626ms ago: executing program 4 (id=7273): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311802e2e"], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001000000001006d6163766c616e0018000280080001001000000004000580080003000300000008000500", @ANYRES32=r3, @ANYBLOB], 0x50}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x6f008dfdf5eb0808}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=@mpls_getnetconf={0x3c, 0x52, 0x400, 0x70bd2c, 0x25dfdbff, {}, [@NETCONFA_IFINDEX={0x8, 0x1, r3}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0x7}, @NETCONFA_IFINDEX={0x8, 0x1, r3}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0xc2c}, @IGNORE_ROUTES_WITH_LINKDOWN={0x8, 0x6, 0xc}]}, 0x3c}}, 0x40) 485.115848ms ago: executing program 1 (id=7274): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x1d, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7}, [@map_idx={0x18, 0xf, 0x5, 0x0, 0x1}, @cb_func={0x18, 0xa, 0x4, 0x0, 0xfffffffffffffffd}, @initr0={0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x9}, @tail_call, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9b31}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0x10000}, @jmp={0x5, 0x1, 0x0, 0x4, 0x4, 0x40, 0xfffffffffffffffc}, @call={0x85, 0x0, 0x0, 0xba}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x5}]}, &(0x7f0000000180)='syzkaller\x00', 0x8, 0xa4, &(0x7f00000001c0)=""/164, 0x41000, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x1, 0x9, 0x81, 0x9}, 0x10, 0x0, 0x0, 0x1, &(0x7f00000002c0)=[0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1], &(0x7f0000000300)=[{0x2, 0x3, 0x0, 0x3}], 0x10, 0x10000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='vm_unmapped_area\x00', r0, 0x0, 0x8}, 0x18) ioctl$SIOCGSKNS(0xffffffffffffffff, 0x894c, &(0x7f0000000440)={'team_slave_1\x00', 0x400}) 478.514715ms ago: executing program 0 (id=7275): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3400000010000100"/20, @ANYRES32=r3, @ANYBLOB="00000000000000000c001a800800028004000180080004"], 0x34}}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x30, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x40014}, 0x4810) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="240000001900010000000000000000001c140000fe0000010000000005001a0004"], 0x24}}, 0x0) 355.402122ms ago: executing program 4 (id=7276): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}]}, 0x40}}, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=ANY=[@ANYRES32], 0x48) bpf$MAP_UPDATE_BATCH(0x19, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000380)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd600000000018060100000000000000000000000000000000fe8000000000000000000000000000aa04004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="68c200009038"], 0x0) 355.010942ms ago: executing program 3 (id=7277): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b2b, &(0x7f0000000080)={'wlan1\x00', @random="02001c00004a"}) (async) getsockopt$inet_buf(r0, 0x0, 0x10, &(0x7f0000000040)=""/123, &(0x7f00000000c0)=0x7b) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r1, 0x11b, 0x6, &(0x7f0000000000)=0x40000000, 0x4) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) (async) syz_extract_tcp_res$synack(&(0x7f0000000140)={0x41424344, 0x41424344}, 0x1, 0x0) write$tun(r2, &(0x7f0000001540)=ANY=[@ANYBLOB="0000655802040300bf000600a200000f0e00000000000000090000000000000000006cfc835d136206fffe880000000000000000000000000101fc0000000000000000000000000000006706010100000000fc02000000000000000000000000000000000000000000000000000000000000fc02000000000000000000000000000000000e40680000000c00402164000000011700000000000005020002c2040000000fc20400000004c91000000000000000000000ffffac1e000104010f01030000000748000000021003ff03ffffffffffffff7f0700000000000000010000000100000002000000000000001900000000000000ffff0000000000000600000000000000040000000000000006443cdbf535972aa0dd7e59c22219d9ab17915909133bad72f2715d8f7aee172bc7a09a1df9d57199d1a70a83cc19590d6c614997ca0c2406c72198af5884fbf6e592a5b5b30103000000003a2b0000000000000001000710000000030206010009000000000000000800fa436d059b3db19e16e47d73c76bbf4a6d3e520857788be7294fbd63c92702bd0dffc14748372e00082d4a87564e7ad68a9405f599fbcd5082f54d924b9df92bbc70bf1def94936aec669849282c53a54584086ea81a3d2eb074d927465630ba11f26bb9bdb122acc0ae4da2db2093dcc163e3e291458259a612e02e8381d08e4ae7ad69d57a56d0c7f23e3c2404e2b8bbca9e53c130f32a0e7148f62d86874fda0d020b48ea568f9c1a74971b7502833cb0069171f319a1e922ae20896b6e934bc06b9a92a5d6934c25466f724c55bc2775388299ca4b19238d7e93cc58dfeca32ec1c60cca84855780fffa6d5497a5b1072b900fd72ba3c1c1ee3a3a1fc6e90024c5b56b37f781f270948b1ad416a9c906b7afab4ed8a128eab0916397a79bf0a6c2677b8185cbbd7a5f0d5319c0f8c3326fb3e98ad4c83a69545c13e28146372de0b2af83de87b1782dce87c3b82b95ccf59d83af8661901c69eee13f9f9b354940777588bbc0fcfe8eeba30245a45a35021c8c8ed16cd0b45257cd6481d766a7bbb8d70106e36cf04cbcf70609db4d6e7b9fa75f3220a1f7215d55edb29a50b8eca3c8e7ba1ec0c4e5a1c05cd8b9d74ce46c78bc91268431b14af382a480dfba64a29b611e5b8f08ad68b1e7c673fc1b9aaf3397ab367a531ce1c36dd4ab690c10ba42276307d81dde4e74387a6b1ff573fea101001bb0f75d7e533076b07f5c1ebdea19eb675033b35f98ca99b5002bec664f8931ccf28b413b959ea02f02d67218f84319e5c62eb2d22a12f02b96e68c540d303587eb34c789f67efb80d9d83a910d8db3b8afb7a714267985e22ce974a61d5fc10d35e67bcec8cb30bec6d27d94b3672dfa28fcdcb35c6fc609d9885298ef0070e510ba625712a6c053a41b7c4b53bb8ed99a1a3ca9a6483b0c6c6c9c55b4a55188d9b9839859f132c54b0c8c6a343bca1f8739404989a993f71f592795bd06156b9399ec2bf8f017e9ac4206a21e9b6952d4d2d48c6a865f65e3c29df6e71ebac46d6f3731e98276115ba9846f2a89687328b88f41e6a5269075075fd1ea3651727921140bd4fc8755792201bbe9f8919d36248e79f455b3b36185ee90b003bad589ff543dcb075de5756cc67f0c261c7df238fbb387eb5ac7a43b580ce3445c3d7345c17e2b09ff945958ad981f91b68d07eb2e34dd8d24ac88056949693931747a9ef2e233ec628606f29ee0de14e0b37dca7295a2de74fac47e8128e38c0956e5d88e3f4b030ab6b09bf0cd1a74cc2d6070c7b571d29e838614ce66d62884c943ef77508b278e72394c1e4bd9932c030107870a5c121cc79241a90f1aba9c5b3bf02822892944c94160d19d1e79c712692285902e3e95711faf5f9330f0083906272aa1f0ec5dc50c9f7b74f7ee0227b5ba2b2e38f35dc37fd6492ccf5caa096a4a15e52e9840764962aa27b8a55412375ec3d468adb65ea15e8e7a787b1e16cfe76f81fc98d5936ec52889f1ce5f49de37670525917a5a000f1bfa16b85d96d10e1abe215c96c3d4b5f59b33474b355a519336b6a6741f8acc564e9a1fad6684656a8264543da309a7c2536255a081a82efd8aaccda263b2f358ee690fe1d33fbe050733430d77d137977a6cfc72cf8497abb8523c2ea19c3ceffdfd4ffcb86227f9bd336c53785cc0a5dbf489e13480ea039dc9110aba5caef23bab9aa062ea7cd550d58dd1e39a0fd55d7748b5c45718a484924f331d5193f8c09e8e5fd7cdcb799836ee91398c9bfab34fbec9a25443d0d0e92bf8ca31a9f430194976dce13853851f6ab9a9cf0b417d67997c3143ab939f8ec2905fd071f7682ece10e8ac2389bbc57f9762a1a700ad15e1cdf3e8a373d9085bfeb8560bbc10a8ac93ccb9156850889ba2d503847f46837e2b854f614f016447ed0ccb3386e0d185b9c5566e5d68323dfbed418b883f472bbde38b13de5ed718089f29f73772571d2b2a80fc6bc9910ab217cf78726515858dd30c3b728df38d0bb2b229437abec83ae5144616d6c152d188f94ad40e8fb3dd03a4905cd74b5719db7dc60a0f1525fe5bd272cc378a2c9810acfb8ed04f8c4e1d2c5c12782e4a8795611c38b8ea809e9a9de557f0879c05e3b9426012356abcc0479480eb6bd472174d5a02d0dbd3870d92cb935cf8789e32164ff4cec3464c77e36943af973c324bea791a5c3803f5b8226bcd1dc9d28bd1bfa10e16e2f5e17a0b31b4b8f95af0b612003b309d1e1ad41a124563c666210b58d27fb4feabd44986e544a044e55e21ac4db04fa32e8795cf64467e9aa5be366e755b3f852697f1231942c516e99c9d4cd00500ba65418ccafa95dbf7adac766452812841b7670961e702905a0b64b227eb73881d721c5fe226f993e98951df67a8c577c10afe9436a87ccc7d36715b554f986e2e3c1a62680e12c02c89fb2382401a6d64b5a7a689d0fc79052c904a0405e9f7e0305f8ddc326446bb3cc158cdf996a5b55c4f2331489eaa2cb63da21fa93f5e6232231ee84152b458be4dcfd8f336f65abd0708f796685d6e0233fae0088aa06863a936f4b9b9193c681fcd5bbfd792a4edc84cd0c6ef5f6cfcf0dd65b762aca442ccae4684caeaa68b947d520cb38aef67c16e17ebe32f8fbf3052b44c0299fd7487b582d96a640bfd8f2e2cedca18e91f60cb416304d5402a048ea766de890e960f4415add50844ad4c3d444c7d1be187582a303ed49e36f566028121622ad5d583211eca388a2cfce06737a632f60748f76bc031275edbd6951c12ed8897fc7bcf54039310af0a7824b2e6dd8fe09aec20a575476cead93428251bbab2718b8fe027a3f5998d83b7445fc3766afe7d6e046bc84ebf57d4c6ef73821173556def416469481f5ffcfd3e37ecf4b8cf113f35c7ae44189d0b729aca95e3024b1c5818d97ac4cef3890613e0f56fd8da2cb681d6920631e863c3fe81e99478c1124387653227b677fc72e0aa1fc5ca981760021443c77035bf19a3e1d754dd8f5d7674533aaa48dba72ef246a2a91bc6e04aec6a1fc58802a03e4979a84749021bded782360e80cda8ccfbc32fb67cc07fef111a76c965cf6235645e3e807c1b39fc5b733d76a29b045801bed501d560d5a91e0a06636a7d708a1d8cb4e8f6d5258fdec7d006b0c103990d04926e2d0ebd946df36e46582699a7157082ecde4a45db79eba00b22639785ab8d779de3f429f399410fa586f399e76a6b4b36ff887199cde692c2e2a9e025a6561c488835606b84770de6159c966d5994868563e70b2ba19ed5c104452607951d0aaf516701c3ffa1a9763dd31f195017e6df66b90b8b445d08f74ded25241ccb7a80392d1d6267b9aed0d2e32d3a15ff545f242cca3a7fea55967bc8f40ce87bd40e4b384d647e6ce9a208b6ddda28d34f2d4983298980e024d8dec56bc00ba4397fd9eef0e42aa749266eedca99a9617b926221024b9e589f40b40c5af6b2b66bf20a6b82fa6b735f20a5315a35aab50bd89bd3d45c5fa1e470c7767affb94a7a7f00dff4855a1f2bd4dcf1ec0828b56b70f83ba5cdd882a0444e9dd4e5e45abc0007c0d29e05a92974a95959fe882caed9c7b8c9ac14b80b4830b2ef794fa1127d2d07d069058d18b921bd7f7642b944a4df85b12fc0870a1d961f14ba2040711665fdd32cd117e542acdd794e2cb1d7bd21dcf7e1eba2974304c18a6379138e51dee4270ff60dabc84e21b414989eddeed6a61d5ec7d001cd30cee16c7101f40c2e356cff022e2e6e34873a8fd77d5fd75a6791653ef930b89691bdf0ba1e422807753aab6013e755c142886942f438b241ec3277495dcf009e6a5faa43c927452a7a820560e21f0f767325fdd88a0b498267e2f74ea51ea7fb4c5f4d7c4d5f269e7b1dc0c77e666d7267b4c3796192c4821cbdcb07902daba184bde8cc586be731772bb7e84e4c0613b0d3384323da391c41bc2d11421fcb10aeb15bbc5d2e84399c62e8b71a1b76c5a13d0d06038908535296ae30d594c87b25568c7bd42771b39d191f232fcd63442fc62a2aa32c5060abd94c17712308a6436325dca34ebbb24acf9023fa481d369da8f5cfc54a8dd94f7ef4f689cf8d712f475a6ab4e765243612a1d6d4b71669c63b3a00f88757f43a610e9ed7f033b35a8ed0ace22cb03f5b2a9007e86f6e8bb5ab0d07a1fea9e113017f08680a3442e666a435bc7571e05e4e9931f72ea1e3cba474a998284b72f4b501efb5799bd76a800e79ad995681cfcc61633848265ed9278820cb7aa8aac8049da1eb574532dd28c068b3e16bb37200e87350b79c996b1d674947eace0833c3ca0f878f00126da785efaf16e4a49f3c28a17163c5fd6ae35c11c736c9570ef9c18a9b8be2ed40a0f65781838ae747d7f0ce5caa70b9682d7e42e6441fad586bf2a1c3741b011914ab85e7a43410324adef641e6cc61ff41eb528a7d15737cf6e4482e4379cf2617f796e1437794a9b883820e42f14bf1a68a13af59c6ead665d329e1f24e367e815c7b720eed55c8673226831a9c112da9bb8184a04d8c363d15339e2b732f1619252195f2dc8d0923f88cb4315956f6fbff4312ab4b18fdbd156a33c45e6fc53816769ea45780dff4b72f1e24ad2212fa578cd885f3bd12350a5a94f0deb71bcae2a762f4811ee57365b188411987ba476ab5a1652258e5ea4a4542505506f8156130708d14488b3823ad2e970574386b8010faf8984c87968acebf185f125db760a970eed44574cfc140f008fe4aa1041a58e94505a6a513df81fc074cf57750f9d6adcd7696d80f5341eeca87ccd45158cf5f20c075cd605b21160cf67b135afe49800eb7b2d665adff64a5091a0c331dfb20ea96c92b58e95916d6be16a17e215e3b210c6404f58903f645367dfda8abffa7c26e992e157ea4498bc0df7452865ecf4052975cc760107cbb6111d80be9ea6b23cb2c0cfd19815c42a3889e5166b32b78d0812b9f94e921492e25abff390efef59991e2ed928f1f51d808b1e2a739b888c44fe8a33cf3c9037b946329d183a50cd6951f647ccdbbbd8400ee5f7d272a124581a67f1b4174e43421ab6dbff958bb0008fd8c28d926c96e70f446e42da950796818e8fac216e5773839e6d82c2318999c4a1270ac97363adc73616dce3955f978a68d87303898a0b813de9941c07cd6a95aa31fdad0eedcf5745a4007e544c45fb2f501cd85db0a615f706bc67f4a65c5ab97ef498a46924abb038b9f7eaad1dda11c2645048790274420c007a35ace65cff6974c7712465092a92d92a3dcd3a1e30d0bbf8a16edbf2160a410dce4b4ce8e410f8f53f68b8828cfa2ca2ee3b874e58f8028c44d8d942f2864150cf163a6e7ffc875db7080aca6077bac1c151315a9bb6305b26c632bd90614fa8dfdd7db1e3d3391ae894a67758299dfb817f130ff15147bfbeda390d2752b433ebce94e06d254f959c1e35d9eb03cdffdb5bc46fdd3ec816a4bd3bcb29d0e8c9d23428fb3f59d92021c8d3a20a5367e10afc3f9eeb0bef523dd160e335badde62f0d3c9818d9e99ce750e09cfd5c562e27d504d71d6621560f46a3bff7e904cf63cc3c1e5e4ee6819bf19dcb4538fda956cd7e0518891344ed55b75e4845076f1819d224d507d07773ef66ed519f1a77522388517ffde1ba2ea798db26352a0013f2f22cc8191011a20a9251f93978a333c4073345d1098bb46cac2b5c4ace3cdcee996ff82642f125086a0361956679c7002bebb12ed7e555207236e8b85797677b95ca1699bd85838050280000730000000000a000000fb0d0000000000000000000000000000030000000000000007000000000000000200000000000000d4d5db9e6311858b4476edf730da160c932e8a01bbd4a03346f73b56e38c7d7fb672b0ac55a004412079dc545e7e3247aeb5af49068e6f67c5cfdec2ee0b567617e046575c4521148b79e7a934f1ffdaa65d1c284ef1ec3df54df0d9ec05196f168c640496bca494cadefcf70478b1d6baee0991e5107fb7eaacc34b4a94fd0974f3f45275e3f25ed277c30495030cb4fed7e2f17186e6286f855942212385cabac7a7cb9b47e5496d86a24e00f414ee1e8fa9a84fd3582afa057f255e33bd7ad001627f2783e5aaff422c6987823744728f29bd38fd4804010c0730000000000a0507007f00000000000000b45f00000000000001000000000000007500000000000000080000000000000000000000000000320c00000000000007580000000114fc03000600000000000000350800000000000005000000000000000300000000000000ff7f000000000000fbffffffffffffffffff0000000000007f000000000000000200000000000000040000000000000001000101000001000000000000003b00000000000000000100000000000011000000000000004e224e20631ff4fadfff2f491d62d1adc717d3e64f59690494699736f10f97ae77531910b2ed3d475734d433c6d6faa98a31cb000000", @ANYRES32=0x41424344, @ANYRES32=r3, @ANYBLOB="d0100002907800040508f298ec3ffbb0000103035600051200000000000001ff000000080000000743ecacf44897b9d479af1d056aa010970e51e22ea8b6a403c5049044dde122683baeaa2e6af245b1bf5abac4bda5"], 0x13ac) 354.669968ms ago: executing program 1 (id=7278): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000000000069107f000000000004000000000000009508001500040000"], &(0x7f0000000080)='GPL\x00', 0x2, 0x3f7, &(0x7f000000cf3d)=""/195}, 0x48) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000012c0)={&(0x7f00000012c0)=ANY=[], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x80) r2 = accept4$llc(0xffffffffffffffff, &(0x7f0000000100)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000240)=0x10, 0x80800) connect$llc(r2, &(0x7f0000000280)={0x1a, 0x323, 0x7, 0x8, 0x0, 0x8, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x20}}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000002c0)=""/4077, 0xfed}], 0x1}, 0x9}], 0x1, 0x2000, 0x0) ioctl$FITHAW(r1, 0xc0045878) r3 = socket$nl_generic(0x11, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCDELRT(r5, 0x8916, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'ip6gre0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellink={0x20, 0x11, 0x101, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r6}}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x240400c4) 272.446105ms ago: executing program 0 (id=7279): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000100)={0x48, r2, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r1}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0xfb2e77a8993c1939}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}]}, 0x48}}, 0x20000000) 0s ago: executing program 4 (id=7280): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x2a8, 0x0, 0x700001b, 0x148, 0x0, 0x148, 0x210, 0x206, 0x240, 0x210, 0x240, 0x7fffffe, 0x0, {[{{@uncond, 0x1ea, 0xd8, 0x138, 0x0, {0x390, 0x8f00}, [@common=@set={{0x40}, {{0x0, [0x5, 0x2, 0x1, 0x4, 0x5, 0x1], 0x3}}}, @inet=@rpfilter={{0x28}, {0x4}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, 0x7, 0x0, [0x2d, 0x12, 0x2e, 0x40, 0xd, 0x3a, 0x23, 0x40, 0x103, 0x1c, 0x4037, 0x15, 0x31, 0x4, 0x31, 0x1f], 0x1, 0x8, 0x7}}}, {{@uncond, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x900, 0x10, 0x8, 'syz0\x00', 'syz0\x00', {0x8000}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x308) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r1, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x3, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, 0x0, &(0x7f0000000040)) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@newqdisc={0x2c, 0x28, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffdfe, {0x0, 0x0, 0x0, r4, {0xd}, {0xffff}, {0x7, 0x6}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004040}, 0x4000080) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x88, r6, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x74, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x0, @multicast2}}, {0x14, 0x2, @in={0x2, 0x0, @broadcast}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0xd}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}}}}]}]}, 0x88}}, 0x0) kernel console output (not intermixed with test programs): g): unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.550445][T26017] bond5: entered promiscuous mode [ 584.555535][T26017] bond5: entered allmulticast mode [ 584.563595][T26017] 8021q: adding VLAN 0 to HW filter on device bond5 [ 584.611689][T26018] bond6: entered promiscuous mode [ 584.615972][T26025] netlink: 'syz.3.6017': attribute type 1 has an invalid length. [ 584.617416][T26018] bond6: entered allmulticast mode [ 584.631774][T26018] 8021q: adding VLAN 0 to HW filter on device bond6 [ 584.775540][T25777] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 584.848334][T26025] 8021q: adding VLAN 0 to HW filter on device bond10 [ 584.859531][T26025] bond9: (slave bond10): making interface the new active one [ 584.868421][T26025] bond9: (slave bond10): Enslaving as an active interface with an up link [ 584.908593][T26046] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 584.945846][T26046] syzkaller1: Refused to change device type [ 585.019760][T26048] chnl_net:caif_netlink_parms(): no params data found [ 585.254054][T25777] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 585.272783][T25777] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 585.285577][T25777] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 585.316437][T25777] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 585.733401][T25777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 585.806428][T25777] 8021q: adding VLAN 0 to HW filter on device team0 [ 585.821181][T26104] netlink: 'syz.2.6036': attribute type 11 has an invalid length. [ 585.839531][ T7386] bridge0: port 1(bridge_slave_0) entered blocking state [ 585.846757][ T7386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 585.904407][ T7391] bridge0: port 2(bridge_slave_1) entered blocking state [ 585.911643][ T7391] bridge0: port 2(bridge_slave_1) entered forwarding state [ 586.119293][T21809] Bluetooth: hci3: command tx timeout [ 586.156398][T26119] openvswitch: netlink: Tunnel attr 148 out of range max 16 [ 586.192803][T26121] xt_hashlimit: size too large, truncated to 1048576 [ 586.210212][T26125] openvswitch: netlink: Message has 4 unknown bytes. [ 586.238499][T26125] bridge0: port 1(bridge_slave_0) entered disabled state [ 586.626082][T25777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 586.709181][T26148] netlink: 'syz.3.6050': attribute type 1 has an invalid length. [ 586.793518][T26148] 8021q: adding VLAN 0 to HW filter on device bond11 [ 586.794563][T26158] netlink: 'syz.2.6053': attribute type 10 has an invalid length. [ 586.826005][T25777] veth0_vlan: entered promiscuous mode [ 586.854282][T26153] bond11: (slave geneve4): making interface the new active one [ 586.856321][T26161] ipt_REJECT: TCP_RESET invalid for non-tcp [ 586.868772][T26153] bond11: (slave geneve4): Enslaving as an active interface with an up link [ 586.911988][T26158] bond0: (slave ÿÿÿÿÿÿ): Enslaving as an active interface with an up link [ 587.003320][T25777] veth1_vlan: entered promiscuous mode [ 587.068142][T26172] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 587.111077][T25777] veth0_macvtap: entered promiscuous mode [ 587.144447][T26176] xt_hashlimit: size too large, truncated to 1048576 [ 587.174063][T25777] veth1_macvtap: entered promiscuous mode [ 587.241194][T25777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 587.292994][T25777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 587.312920][ T7391] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.323181][ T7391] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.344594][ T7391] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.373822][ T7391] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 587.426625][T26189] delete_channel: no stack [ 587.539748][T26196] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 587.595675][T26197] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 2, id = 0 [ 587.618504][ T7383] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.647899][ T7383] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.729952][ T7391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.751170][ T7391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.196875][T21809] Bluetooth: hci3: command tx timeout [ 588.790152][ T5836] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 588.802961][ T5836] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 588.815257][ T5836] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 588.823766][ T5836] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 588.838787][ T5836] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 588.953286][T26268] delete_channel: no stack [ 589.227566][T26289] __nla_validate_parse: 16 callbacks suppressed [ 589.227587][T26289] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6092'. [ 589.383353][T26295] dvmrp0: entered allmulticast mode [ 589.461188][T26257] lo speed is unknown, defaulting to 1000 [ 589.580341][T26305] geneve3: entered promiscuous mode [ 589.608391][ T7383] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.627327][ T7383] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.739409][ T7383] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.749548][ T7383] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 589.784332][T26310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6098'. [ 589.813863][T26316] bridge0: port 3(ipvlan2) entered blocking state [ 589.822609][T26316] bridge0: port 3(ipvlan2) entered disabled state [ 589.834885][T26316] ipvlan2: entered allmulticast mode [ 589.850789][T26316] bridge0: entered allmulticast mode [ 589.874023][T26316] ipvlan2: left allmulticast mode [ 589.892332][T26316] bridge0: left allmulticast mode [ 589.970179][T26333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 590.063893][T26337] sctp: [Deprecated]: syz.4.6103 (pid 26337) Use of int in maxseg socket option. [ 590.063893][T26337] Use struct sctp_assoc_value instead [ 590.255828][T26257] chnl_net:caif_netlink_parms(): no params data found [ 590.380711][T26257] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.388547][T26257] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.395837][T26257] bridge_slave_0: entered allmulticast mode [ 590.405014][T26257] bridge_slave_0: entered promiscuous mode [ 590.415064][T26257] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.422850][T26257] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.431257][T26257] bridge_slave_1: entered allmulticast mode [ 590.440285][T26257] bridge_slave_1: entered promiscuous mode [ 590.485541][T26257] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 590.500166][T26257] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 590.534418][T26257] team0: Port device team_slave_0 added [ 590.542602][T26257] team0: Port device team_slave_1 added [ 590.571902][T26257] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 590.579629][T26257] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 590.607853][T26257] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 590.620976][T26257] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 590.629141][T26257] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 590.655774][T26257] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 590.704183][T26257] hsr_slave_0: entered promiscuous mode [ 590.711437][T26257] hsr_slave_1: entered promiscuous mode [ 590.718294][T26257] debugfs: 'hsr0' already exists in 'hsr' [ 590.724047][T26257] Cannot create hsr debugfs directory [ 590.917530][T21809] Bluetooth: hci4: command tx timeout [ 590.980617][T26371] netlink: 'syz.1.6113': attribute type 23 has an invalid length. [ 590.995279][T26371] netlink: 'syz.1.6113': attribute type 10 has an invalid length. [ 591.030963][T26371] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 591.268146][T26384] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6117'. [ 591.386489][T26387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6118'. [ 591.404693][T26387] netlink: 176 bytes leftover after parsing attributes in process `syz.1.6118'. [ 591.414975][T26387] netlink: 'syz.1.6118': attribute type 5 has an invalid length. [ 591.425874][T26387] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.6118'. [ 591.438192][T26257] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 591.449302][T26257] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 591.463368][T26257] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 591.474666][T26257] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 591.661373][T26257] 8021q: adding VLAN 0 to HW filter on device bond0 [ 591.711398][T26257] 8021q: adding VLAN 0 to HW filter on device team0 [ 591.770711][ T7408] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.777951][ T7408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 591.815618][ T7408] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.822843][ T7408] bridge0: port 2(bridge_slave_1) entered forwarding state [ 591.922724][T26415] netlink: 'syz.4.6125': attribute type 4 has an invalid length. [ 591.978052][T26407] syzkaller0: mtu less than device minimum [ 592.001573][T26418] bridge8: entered promiscuous mode [ 592.007420][T26418] bridge8: entered allmulticast mode [ 593.000652][T21809] Bluetooth: hci4: command tx timeout [ 593.697784][T26422] sch_tbf: burst 0 is lower than device lo mtu (1514) ! [ 593.708071][T26430] netlink: 'syz.3.6130': attribute type 2 has an invalid length. [ 593.758454][T26430] netlink: 'syz.3.6130': attribute type 4 has an invalid length. [ 593.909863][T26442] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6132'. [ 593.971312][T26445] xt_hashlimit: size too large, truncated to 1048576 [ 593.984823][T26445] warn_alloc: 1 callbacks suppressed [ 593.984841][T26445] syz.4.6134: vmalloc error: size 10485760, failed to allocated page array size 20480, mode:0xcc2(GFP_KERNEL|__GFP_HIGHMEM), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 594.016000][T26445] CPU: 0 UID: 0 PID: 26445 Comm: syz.4.6134 Not tainted syzkaller #0 PREEMPT(full) [ 594.016027][T26445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 594.016039][T26445] Call Trace: [ 594.016047][T26445] [ 594.016055][T26445] dump_stack_lvl+0x189/0x250 [ 594.016091][T26445] ? __pfx_dump_stack_lvl+0x10/0x10 [ 594.016116][T26445] ? __pfx__printk+0x10/0x10 [ 594.016134][T26445] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 594.016159][T26445] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 594.016186][T26445] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 594.016215][T26445] warn_alloc+0x214/0x310 [ 594.016252][T26445] ? __pfx_warn_alloc+0x10/0x10 [ 594.016291][T26445] ? __get_vm_area_node+0x28f/0x300 [ 594.016317][T26445] ? htable_create+0x101/0x7a0 [ 594.016347][T26445] __vmalloc_node_range_noprof+0x690/0x12d0 [ 594.016399][T26445] ? alloc_pages_mpol+0x3cd/0x4a0 [ 594.016420][T26445] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 594.016450][T26445] ? rcu_is_watching+0x15/0xb0 [ 594.016471][T26445] ? htable_create+0x101/0x7a0 [ 594.016496][T26445] __kvmalloc_node_noprof+0x674/0x910 [ 594.016526][T26445] ? htable_create+0x101/0x7a0 [ 594.016548][T26445] ? hashlimit_pernet+0x23/0x240 [ 594.016572][T26445] ? hashlimit_pernet+0x23/0x240 [ 594.016594][T26445] ? hashlimit_pernet+0x23/0x240 [ 594.016625][T26445] htable_create+0x101/0x7a0 [ 594.016659][T26445] hashlimit_mt_check_common+0x719/0xa10 [ 594.016694][T26445] xt_check_match+0x3d1/0xab0 [ 594.016726][T26445] ? __pfx_xt_check_match+0x10/0x10 [ 594.016754][T26445] ? pcpu_alloc_noprof+0xfdd/0x1720 [ 594.016794][T26445] ? xt_find_match+0x1f7/0x250 [ 594.016825][T26445] translate_table+0x1553/0x2040 [ 594.016889][T26445] ? __pfx_translate_table+0x10/0x10 [ 594.016922][T26445] ? __might_fault+0xb0/0x130 [ 594.016971][T26445] ? _copy_from_user+0x94/0xb0 [ 594.017003][T26445] do_ip6t_set_ctl+0x970/0xce0 [ 594.017037][T26445] ? rcu_is_watching+0x15/0xb0 [ 594.017060][T26445] ? trace_contention_end+0x39/0x120 [ 594.017085][T26445] ? __pfx_do_ip6t_set_ctl+0x10/0x10 [ 594.017140][T26445] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 594.017176][T26445] ? file_init_path+0x3b/0x590 [ 594.017202][T26445] ? __lock_acquire+0xab9/0xd20 [ 594.017224][T26445] nf_setsockopt+0x26f/0x290 [ 594.017253][T26445] rawv6_setsockopt+0x23b/0x5b0 [ 594.017274][T26445] ? __pfx_rawv6_setsockopt+0x10/0x10 [ 594.017293][T26445] ? aa_sock_opt_perm+0xff/0x1b0 [ 594.017323][T26445] ? sock_common_setsockopt+0x36/0xc0 [ 594.017351][T26445] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 594.017381][T26445] do_sock_setsockopt+0x17c/0x1b0 [ 594.017407][T26445] __x64_sys_setsockopt+0x13f/0x1b0 [ 594.017434][T26445] do_syscall_64+0xfa/0xfa0 [ 594.017461][T26445] ? lockdep_hardirqs_on+0x9c/0x150 [ 594.017489][T26445] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.017508][T26445] ? clear_bhb_loop+0x60/0xb0 [ 594.017533][T26445] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 594.017552][T26445] RIP: 0033:0x7f599618f749 [ 594.017570][T26445] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 594.017587][T26445] RSP: 002b:00007f599710e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 594.017609][T26445] RAX: ffffffffffffffda RBX: 00007f59963e5fa0 RCX: 00007f599618f749 [ 594.017624][T26445] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000007 [ 594.017634][T26445] RBP: 00007f5996213f91 R08: 0000000000000528 R09: 0000000000000000 [ 594.017646][T26445] R10: 0000200000000440 R11: 0000000000000246 R12: 0000000000000000 [ 594.017658][T26445] R13: 00007f59963e6038 R14: 00007f59963e5fa0 R15: 00007ffdd6ad8298 [ 594.017692][T26445] [ 594.382345][T26445] Mem-Info: [ 594.385709][T26445] active_anon:3895 inactive_anon:0 isolated_anon:0 [ 594.385709][T26445] active_file:3272 inactive_file:40091 isolated_file:0 [ 594.385709][T26445] unevictable:768 dirty:93 writeback:0 [ 594.385709][T26445] slab_reclaimable:13407 slab_unreclaimable:269370 [ 594.385709][T26445] mapped:29258 shmem:1367 pagetables:974 [ 594.385709][T26445] sec_pagetables:0 bounce:0 [ 594.385709][T26445] kernel_misc_reclaimable:0 [ 594.385709][T26445] free:1149066 free_pcp:14097 free_cma:0 [ 594.394157][T26257] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 594.475593][T26257] veth0_vlan: entered promiscuous mode [ 594.489245][T26257] veth1_vlan: entered promiscuous mode [ 594.518840][T26445] Node 0 active_anon:15480kB inactive_anon:0kB active_file:13088kB inactive_file:160160kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117032kB dirty:368kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17292kB pagetables:3732kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 594.548338][T26257] veth0_macvtap: entered promiscuous mode [ 594.551288][T26445] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 594.566193][T26257] veth1_macvtap: entered promiscuous mode [ 594.588529][T26445] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 594.623534][T26445] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 594.633444][T26445] Node 0 DMA32 free:682412kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:15480kB inactive_anon:0kB active_file:13088kB inactive_file:160160kB unevictable:1536kB writepending:368kB zspages:0kB present:3129332kB managed:2565148kB mlocked:0kB bounce:0kB free_pcp:44592kB local_pcp:19908kB free_cma:0kB [ 594.667459][T26445] lowmem_reserve[]: 0 0 0 0 0 [ 594.672201][T26445] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 594.707216][T26445] lowmem_reserve[]: 0 0 0 0 0 [ 594.711982][T26445] Node 1 Normal free:3898492kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:11712kB local_pcp:5056kB free_cma:0kB [ 594.713945][T26456] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6137'. [ 594.744956][T26445] lowmem_reserve[]: 0 0 0 0 0 [ 594.745010][T26445] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 594.745160][T26445] Node 0 DMA32: 1083*4kB (UME) 320*8kB (UME) 230*16kB (UM) 39*32kB (UME) 38*64kB (UM) 24*128kB (UME) 28*256kB (UM) 115*512kB (UM) 51*1024kB (UM) 3*2048kB (ME) 132*4096kB (UM) = 682412kB [ 594.745352][T26445] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 594.745468][T26445] Node 1 Normal: 199*4kB (UME) 40*8kB (UME) 46*16kB (UME) 212*32kB (UME) 75*64kB (UME) 18*128kB (UME) 5*256kB (UME) 3*512kB (UM) 3*1024kB (UM) 1*2048kB (E) 946*4096kB (M) = 3898492kB [ 594.745659][T26445] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 594.745678][T26445] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 594.745697][T26445] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 594.745714][T26445] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 594.745733][T26445] 44727 total pagecache pages [ 594.745744][T26445] 0 pages in swap cache [ 594.745753][T26445] Free swap = 124996kB [ 594.745762][T26445] Total swap = 124996kB [ 594.745773][T26445] 2097051 pages RAM [ 594.745782][T26445] 0 pages HighMem/MovableOnly [ 594.745791][T26445] 424122 pages reserved [ 594.745798][T26445] 0 pages cma reserved [ 594.962523][T26257] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 594.995329][T26257] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 595.070259][ T7408] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.088415][T21809] Bluetooth: hci4: command tx timeout [ 595.095883][ T7408] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.156408][ T7408] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.192591][ T7408] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 595.241503][T26469] netlink: 'syz.4.6140': attribute type 1 has an invalid length. [ 595.255616][T26475] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6142'. [ 595.382327][ T7393] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 595.394293][ T7393] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 595.463016][T26477] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6143'. [ 595.473999][ T7408] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 595.489075][ T7408] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 595.750868][T26492] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 595.762374][T26492] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 595.857915][T26497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6150'. [ 596.084901][T26499] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6151'. [ 596.391614][T26511] netlink: 'syz.0.6154': attribute type 83 has an invalid length. [ 596.504174][ T7408] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.525930][ T5836] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 596.542249][ T5836] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 596.552084][ T5836] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 596.562493][ T5836] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 596.579513][ T5836] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 596.651719][ T7408] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.694526][T26524] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6156'. [ 596.744029][ T7408] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 596.825469][ T7408] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.092978][ T7408] team0: left allmulticast mode [ 597.107559][ T7408] team_slave_0: left allmulticast mode [ 597.117725][ T7408] team_slave_1: left allmulticast mode [ 597.129981][ T7408] team0: left promiscuous mode [ 597.141991][ T7408] team_slave_0: left promiscuous mode [ 597.148806][ T7408] team_slave_1: left promiscuous mode [ 597.157673][T21809] Bluetooth: hci4: command tx timeout [ 597.190729][T26542] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6160'. [ 597.211765][ T7408] veth0_virt_wifi: left promiscuous mode [ 597.235717][ T7408] bridge0: port 3(team0) entered disabled state [ 597.272830][ T7408] bridge_slave_1: left allmulticast mode [ 597.278596][ T7408] bridge_slave_1: left promiscuous mode [ 597.284390][ T7408] bridge0: port 2(bridge_slave_1) entered disabled state [ 597.310567][ T7408] bridge_slave_0: left allmulticast mode [ 597.316282][ T7408] bridge_slave_0: left promiscuous mode [ 597.325558][ T7408] bridge0: port 1(bridge_slave_0) entered disabled state [ 597.643777][ T7408] dvmrp0 (unregistering): left allmulticast mode [ 598.082397][ T7408] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 598.092451][ T7408] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 598.101887][ T7408] bond0 (unregistering): Released all slaves [ 598.215323][ T7408] bond1 (unregistering): Released all slaves [ 598.228580][ T7408] bond2 (unregistering): Released all slaves [ 598.336029][ T7408] bond3 (unregistering): (slave veth0_to_bond): Releasing active interface [ 598.346098][ T7408] bond3 (unregistering): Released all slaves [ 598.455555][ T7408] bond4 (unregistering): Released all slaves [ 598.565445][ T7408] bond5 (unregistering): Released all slaves [ 598.689707][T21809] Bluetooth: hci0: command tx timeout [ 598.698028][ T7408] bond6 (unregistering): Released all slaves [ 598.713495][T26518] lo speed is unknown, defaulting to 1000 [ 598.737011][T26555] bond0: Error: Cannot enslave bond to itself. [ 598.999405][ T7408] 9: left promiscuous mode [ 599.054247][T26566] netlink: 188 bytes leftover after parsing attributes in process `syz.3.6167'. [ 599.100436][T26566] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 599.116903][ T7408] tipc: Disabling bearer [ 599.150385][ T7408] tipc: Left network mode [ 599.362525][T26580] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input6 [ 599.622709][T26592] netlink: 'syz.1.6176': attribute type 39 has an invalid length. [ 599.803175][T26598] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6177'. [ 600.134152][T26607] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6179'. [ 600.208128][T26607] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6179'. [ 600.428726][T26615] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6182'. [ 600.444117][ T7408] hsr_slave_1: left promiscuous mode [ 600.446781][T26618] netlink: 'syz.3.6184': attribute type 1 has an invalid length. [ 600.464821][T26615] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6182'. [ 600.713571][T26632] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6187'. [ 600.727951][T26632] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6187'. [ 600.764425][T21809] Bluetooth: hci0: command tx timeout [ 600.841285][T26639] xt_policy: too many policy elements [ 600.999168][ T7408] team0 (unregistering): Port device veth0_virt_wifi removed [ 601.017180][T26646] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6190'. [ 601.088632][T26647] netlink: 56 bytes leftover after parsing attributes in process `syz.2.6190'. [ 601.175264][ T7408] team0 (unregistering): Port device team_slave_1 removed [ 601.219630][ T7408] team0 (unregistering): Port device team_slave_0 removed [ 601.637295][ T7391] smc: removing ib device sz1 [ 601.644780][T26518] chnl_net:caif_netlink_parms(): no params data found [ 601.677604][T26618] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 601.873320][T26656] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6192'. [ 601.913780][T26658] delete_channel: no stack [ 601.991061][T26663] tipc: Enabling of bearer rejected, already enabled [ 602.213738][T26679] netlink: 'syz.1.6197': attribute type 9 has an invalid length. [ 602.639315][T26518] bridge0: port 1(bridge_slave_0) entered blocking state [ 602.665268][T26518] bridge0: port 1(bridge_slave_0) entered disabled state [ 602.690481][T26518] bridge_slave_0: entered allmulticast mode [ 602.745968][T26518] bridge_slave_0: entered promiscuous mode [ 602.784085][T26518] bridge0: port 2(bridge_slave_1) entered blocking state [ 602.807296][T26518] bridge0: port 2(bridge_slave_1) entered disabled state [ 602.838367][T21809] Bluetooth: hci0: command tx timeout [ 602.857113][T26518] bridge_slave_1: entered allmulticast mode [ 603.011115][T26518] bridge_slave_1: entered promiscuous mode [ 603.113124][ T7392] tipc: Resetting bearer [ 603.206446][T26712] gre0: entered promiscuous mode [ 603.235005][T26712] gre0: entered allmulticast mode [ 603.370010][T26518] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 603.540397][T26719] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 603.551990][T26719] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 603.562787][T26719] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 603.634200][T26518] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 603.984555][T26719] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 603.995836][T26719] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.012391][T26719] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 604.064910][T26518] team0: Port device team_slave_0 added [ 604.081086][T26518] team0: Port device team_slave_1 added [ 604.219537][T26719] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.251905][T26719] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.270422][T26719] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 604.428485][T26759] tipc: Enabling of bearer rejected, failed to enable media [ 604.504513][T26760] vlan2: entered allmulticast mode [ 604.631822][T26719] bond0: (slave ÿÿÿÿÿÿ): Releasing backup interface [ 604.644372][T26719] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 604.659153][T26719] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 604.670080][T26719] netdevsim netdevsim2 ÿÿÿÿÿÿ (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 604.693628][T26518] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 604.702710][T26518] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.734956][T26518] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 604.752516][T26518] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 604.761065][T26518] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 604.795543][T26518] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 604.923154][T26771] __nla_validate_parse: 6 callbacks suppressed [ 604.923173][T26771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6220'. [ 604.924416][T21809] Bluetooth: hci0: command tx timeout [ 604.954324][T26771] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6220'. [ 604.954775][T26518] hsr_slave_0: entered promiscuous mode [ 604.971564][T26518] hsr_slave_1: entered promiscuous mode [ 604.978152][T26518] debugfs: 'hsr0' already exists in 'hsr' [ 604.983901][T26518] Cannot create hsr debugfs directory [ 605.072819][ T7409] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.110897][ T7409] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.126503][T26777] FAULT_INJECTION: forcing a failure. [ 605.126503][T26777] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 605.129923][ T7409] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 605.143339][T26777] CPU: 1 UID: 0 PID: 26777 Comm: syz.1.6223 Not tainted syzkaller #0 PREEMPT(full) [ 605.143365][T26777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 605.143378][T26777] Call Trace: [ 605.143386][T26777] [ 605.143395][T26777] dump_stack_lvl+0x189/0x250 [ 605.143427][T26777] ? __pfx____ratelimit+0x10/0x10 [ 605.143454][T26777] ? __pfx_dump_stack_lvl+0x10/0x10 [ 605.143480][T26777] ? __pfx__printk+0x10/0x10 [ 605.143500][T26777] ? __might_fault+0xb0/0x130 [ 605.143538][T26777] should_fail_ex+0x414/0x560 [ 605.143573][T26777] _copy_from_user+0x2d/0xb0 [ 605.143598][T26777] ___sys_sendmsg+0x158/0x2a0 [ 605.143624][T26777] ? __pfx____sys_sendmsg+0x10/0x10 [ 605.143681][T26777] ? __fget_files+0x2a/0x420 [ 605.143699][T26777] ? __fget_files+0x3a0/0x420 [ 605.143729][T26777] __x64_sys_sendmsg+0x19b/0x260 [ 605.143753][T26777] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 605.143784][T26777] ? __pfx_ksys_write+0x10/0x10 [ 605.143815][T26777] ? do_syscall_64+0xbe/0xfa0 [ 605.143846][T26777] do_syscall_64+0xfa/0xfa0 [ 605.143873][T26777] ? lockdep_hardirqs_on+0x9c/0x150 [ 605.143900][T26777] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.143919][T26777] ? clear_bhb_loop+0x60/0xb0 [ 605.143942][T26777] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 605.143969][T26777] RIP: 0033:0x7f7f1958f749 [ 605.143986][T26777] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 605.144004][T26777] RSP: 002b:00007f7f1a4e3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 605.144024][T26777] RAX: ffffffffffffffda RBX: 00007f7f197e5fa0 RCX: 00007f7f1958f749 [ 605.144040][T26777] RDX: 0000000004000800 RSI: 00002000000001c0 RDI: 0000000000000003 [ 605.144053][T26777] RBP: 00007f7f1a4e3090 R08: 0000000000000000 R09: 0000000000000000 [ 605.144066][T26777] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 605.144078][T26777] R13: 00007f7f197e6038 R14: 00007f7f197e5fa0 R15: 00007ffd56b1e068 [ 605.144110][T26777] [ 605.278390][T26779] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6225'. [ 605.394642][T26786] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6224'. [ 605.471299][T26788] xt_connbytes: Forcing CT accounting to be enabled [ 605.478592][ T7408] IPVS: stop unused estimator thread 0... [ 605.491422][ T7409] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.517122][ T7409] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.525339][ T7409] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 605.544312][ T7409] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.556335][ T7409] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.576081][ T7409] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 605.629957][ T7409] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 605.641478][ T7409] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 605.667081][ T7409] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 605.730893][T26806] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6230'. [ 605.823204][ T7408] bridge_slave_1: left allmulticast mode [ 605.843170][ T7408] bridge_slave_1: left promiscuous mode [ 605.863477][ T7408] bridge0: port 2(bridge_slave_1) entered disabled state [ 605.885445][T26818] xt_hashlimit: size too large, truncated to 1048576 [ 605.886759][ T7408] bridge_slave_0: left allmulticast mode [ 605.906977][ T7408] bridge0: port 1(bridge_slave_0) entered disabled state [ 606.155903][T26826] FAULT_INJECTION: forcing a failure. [ 606.155903][T26826] name failslab, interval 1, probability 0, space 0, times 0 [ 606.180231][T26826] CPU: 1 UID: 0 PID: 26826 Comm: syz.1.6233 Not tainted syzkaller #0 PREEMPT(full) [ 606.180259][T26826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 606.180272][T26826] Call Trace: [ 606.180280][T26826] [ 606.180290][T26826] dump_stack_lvl+0x189/0x250 [ 606.180322][T26826] ? __pfx____ratelimit+0x10/0x10 [ 606.180349][T26826] ? __pfx_dump_stack_lvl+0x10/0x10 [ 606.180373][T26826] ? __pfx__printk+0x10/0x10 [ 606.180398][T26826] ? __pfx___might_resched+0x10/0x10 [ 606.180419][T26826] ? fs_reclaim_acquire+0x7d/0x100 [ 606.180454][T26826] should_fail_ex+0x414/0x560 [ 606.180488][T26826] should_failslab+0xa8/0x100 [ 606.180510][T26826] kmem_cache_alloc_node_noprof+0x77/0x710 [ 606.180537][T26826] ? __alloc_skb+0x112/0x2d0 [ 606.180553][T26826] ? netlink_autobind+0xdb/0x300 [ 606.180579][T26826] __alloc_skb+0x112/0x2d0 [ 606.180602][T26826] netlink_sendmsg+0x5c6/0xb30 [ 606.180632][T26826] ? __pfx_netlink_sendmsg+0x10/0x10 [ 606.180656][T26826] ? aa_sock_msg_perm+0xf1/0x1d0 [ 606.180686][T26826] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 606.180706][T26826] ? __pfx_netlink_sendmsg+0x10/0x10 [ 606.180727][T26826] __sock_sendmsg+0x21c/0x270 [ 606.180758][T26826] ____sys_sendmsg+0x505/0x830 [ 606.180784][T26826] ? __pfx_____sys_sendmsg+0x10/0x10 [ 606.180810][T26826] ? import_iovec+0x74/0xa0 [ 606.180831][T26826] ___sys_sendmsg+0x21f/0x2a0 [ 606.180849][T26826] ? __pfx____sys_sendmsg+0x10/0x10 [ 606.180892][T26826] ? __fget_files+0x2a/0x420 [ 606.180910][T26826] ? __fget_files+0x3a0/0x420 [ 606.180940][T26826] __x64_sys_sendmsg+0x19b/0x260 [ 606.180965][T26826] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 606.181005][T26826] ? __pfx_ksys_write+0x10/0x10 [ 606.181037][T26826] ? do_syscall_64+0xbe/0xfa0 [ 606.181066][T26826] do_syscall_64+0xfa/0xfa0 [ 606.181092][T26826] ? lockdep_hardirqs_on+0x9c/0x150 [ 606.181128][T26826] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.181145][T26826] ? clear_bhb_loop+0x60/0xb0 [ 606.181167][T26826] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 606.181185][T26826] RIP: 0033:0x7f7f1958f749 [ 606.181200][T26826] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 606.181215][T26826] RSP: 002b:00007f7f1a4e3038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 606.181237][T26826] RAX: ffffffffffffffda RBX: 00007f7f197e5fa0 RCX: 00007f7f1958f749 [ 606.181251][T26826] RDX: 0000000004000800 RSI: 00002000000001c0 RDI: 0000000000000003 [ 606.181263][T26826] RBP: 00007f7f1a4e3090 R08: 0000000000000000 R09: 0000000000000000 [ 606.181276][T26826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 606.181286][T26826] R13: 00007f7f197e6038 R14: 00007f7f197e5fa0 R15: 00007ffd56b1e068 [ 606.181318][T26826] [ 607.080699][ T7408] bond6 (unregistering): (slave bridge7): Releasing backup interface [ 607.128514][ T7408] bond8 (unregistering): (slave bridge8): Releasing active interface [ 607.311394][ T7409] smc: removing ib device syz1 [ 607.312107][ T7408] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 607.330501][ T7408] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 607.341846][ T7408] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 607.354486][ T7408] bond0 (unregistering): Released all slaves [ 607.467561][ T7408] bond1 (unregistering): Released all slaves [ 607.482685][ T7408] bond2 (unregistering): Released all slaves [ 607.595769][ T7408] bond3 (unregistering): Released all slaves [ 607.609622][ T7408] bond4 (unregistering): Released all slaves [ 607.622339][ T7408] bond5 (unregistering): Released all slaves [ 607.742391][ T7408] bond6 (unregistering): Released all slaves [ 607.768532][ T7408] bond7 (unregistering): Released all slaves [ 607.782030][ T7408] bond8 (unregistering): Released all slaves [ 608.076218][T26839] netlink: 'syz.1.6238': attribute type 3 has an invalid length. [ 608.128958][T26839] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6238'. [ 608.210641][T26843] netdevsim netdevsim1: Direct firmware load for . failed with error -2 [ 608.249064][T26843] netdevsim netdevsim1: Falling back to sysfs fallback for: . [ 608.341190][T26850] xt_hashlimit: size too large, truncated to 1048576 [ 608.676109][T26518] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 608.725734][T26518] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 608.801501][T26518] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 608.830615][T26518] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 608.846545][T26864] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.6244'. [ 609.036554][T26879] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6246'. [ 609.121094][T26881] netlink: 244 bytes leftover after parsing attributes in process `syz.3.6247'. [ 609.344519][T26879] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.481328][T26879] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.632970][T26879] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 609.711391][T26906] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6255'. [ 609.716317][T26518] 8021q: adding VLAN 0 to HW filter on device bond0 [ 609.722277][T26904] xt_hashlimit: size too large, truncated to 1048576 [ 609.835426][T26879] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 610.017490][T26518] 8021q: adding VLAN 0 to HW filter on device team0 [ 610.039936][T26912] __nla_validate_parse: 1 callbacks suppressed [ 610.039957][T26912] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6256'. [ 610.062675][ T7383] bridge0: port 1(bridge_slave_0) entered blocking state [ 610.069899][ T7383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 610.105021][ T7383] bridge0: port 2(bridge_slave_1) entered blocking state [ 610.112304][ T7383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 610.189425][T26912] bridge0: port 2(bridge_slave_1) entered disabled state [ 610.305731][T26912] bridge_slave_1 (unregistering): left allmulticast mode [ 610.314234][T26921] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6258'. [ 610.334385][T26912] bridge_slave_1 (unregistering): left promiscuous mode [ 610.354734][T26912] bridge0: port 2(bridge_slave_1) entered disabled state [ 610.385556][T26921] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6258'. [ 610.416841][T26921] netlink: 'syz.2.6258': attribute type 9 has an invalid length. [ 610.720481][ T7386] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.784373][ T7393] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.962624][T23041] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 610.982428][T26936] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6266'. [ 610.992055][ T7393] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 611.051984][T26936] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6266'. [ 611.214150][T26948] xt_hashlimit: size too large, truncated to 1048576 [ 611.225618][ T7408] 9: left promiscuous mode [ 611.322237][T26951] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6269'. [ 611.498077][ T7408] tipc: Disabling bearer [ 611.560755][ T7408] tipc: Disabling bearer [ 611.566313][ T7408] tipc: Left network mode [ 611.733364][T26518] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 612.182472][T26986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6278'. [ 612.205192][T26986] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6278'. [ 612.331438][T26990] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6280'. [ 612.635009][T27015] xt_hashlimit: size too large, truncated to 1048576 [ 612.723541][T26518] veth0_vlan: entered promiscuous mode [ 612.753475][T26518] veth1_vlan: entered promiscuous mode [ 612.860308][T26518] veth0_macvtap: entered promiscuous mode [ 612.895216][T26518] veth1_macvtap: entered promiscuous mode [ 612.961730][T26518] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 613.048893][T26518] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 613.099295][ T7409] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.109023][ T7409] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.189987][ T7409] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.228245][ T7386] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 613.290514][ T7408] hsr_slave_0: left promiscuous mode [ 613.298829][ T7408] hsr_slave_1: left promiscuous mode [ 613.312706][ T7408] veth1_macvtap: left promiscuous mode [ 613.322682][ T7408] veth0_macvtap: left promiscuous mode [ 613.483200][ T7408] pim6reg (unregistering): left allmulticast mode [ 613.555254][T27060] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 614.332195][T27068] xt_hashlimit: size too large, truncated to 1048576 [ 614.407017][ T7386] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 614.414884][ T7386] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 614.487463][ T7392] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 614.505654][ T7392] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 614.785588][ T7408] IPVS: stop unused estimator thread 0... [ 614.884338][T27099] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6307'. [ 614.963916][T27099] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 615.058324][T27099] syzkaller1: entered promiscuous mode [ 615.063959][T27099] syzkaller1: entered allmulticast mode [ 615.292905][T27108] vlan2: entered allmulticast mode [ 615.324277][T27113] __nla_validate_parse: 1 callbacks suppressed [ 615.324297][T27113] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6311'. [ 615.549902][T27121] bridge0: port 2(bridge_slave_1) entered disabled state [ 615.557648][T27121] bridge0: port 1(bridge_slave_0) entered disabled state [ 615.737852][ T5836] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 615.748367][ T5836] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 615.757882][ T5836] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 615.783612][ T5836] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 615.795869][ T5836] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 616.163284][T27159] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6325'. [ 616.229912][T27167] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6325'. [ 616.396348][T27125] chnl_net:caif_netlink_parms(): no params data found [ 616.716856][T27192] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6336'. [ 616.725963][T27192] netlink: 'syz.4.6336': attribute type 7 has an invalid length. [ 616.736739][T27192] netlink: 'syz.4.6336': attribute type 8 has an invalid length. [ 616.747076][T27192] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6336'. [ 616.753531][T27125] bridge0: port 1(bridge_slave_0) entered blocking state [ 616.768378][T27125] bridge0: port 1(bridge_slave_0) entered disabled state [ 616.775763][T27125] bridge_slave_0: entered allmulticast mode [ 616.785257][T27125] bridge_slave_0: entered promiscuous mode [ 616.821888][T27125] bridge0: port 2(bridge_slave_1) entered blocking state [ 616.838072][T27125] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.839390][T27200] IPv6: NLM_F_REPLACE set, but no existing node found! [ 616.848784][T27125] bridge_slave_1: entered allmulticast mode [ 616.863666][T27125] bridge_slave_1: entered promiscuous mode [ 616.993682][T27125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 617.043839][T27125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 617.133753][T27208] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6340'. [ 617.138954][T27210] netlink: 36 bytes leftover after parsing attributes in process `syz.0.6342'. [ 617.145297][T27125] team0: Port device team_slave_0 added [ 617.164373][T27125] team0: Port device team_slave_1 added [ 617.299350][T27217] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6340'. [ 617.319921][T27216] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6343'. [ 617.340920][T27125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 617.373217][T27125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 617.453942][T27125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 617.520475][T27125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 617.539920][T27125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 617.613818][T27125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 617.846422][T27125] hsr_slave_0: entered promiscuous mode [ 617.869841][T27125] hsr_slave_1: entered promiscuous mode [ 617.877773][ T5836] Bluetooth: hci2: command tx timeout [ 617.883916][T27125] debugfs: 'hsr0' already exists in 'hsr' [ 617.898168][T27248] netlink: 176 bytes leftover after parsing attributes in process `syz.1.6351'. [ 617.908099][T27125] Cannot create hsr debugfs directory [ 617.923754][T27251] netlink: 'syz.2.6352': attribute type 1 has an invalid length. [ 618.021532][T27255] bond8: (slave xfrm2): The slave device specified does not support setting the MAC address [ 618.032428][T27255] bond8: (slave xfrm2): Setting fail_over_mac to active for active-backup mode [ 618.047838][T27255] bond8: (slave xfrm2): making interface the new active one [ 618.056112][T27255] bond8: (slave xfrm2): Enslaving as an active interface with an up link [ 618.108198][T27251] bond8 (unregistering): (slave xfrm2): Releasing backup interface [ 618.123618][T27251] bond8 (unregistering): Released all slaves [ 618.139669][T27268] Bluetooth: MGMT ver 1.23 [ 618.303485][T27270] syzkaller0: entered promiscuous mode [ 618.318141][T27270] syzkaller0: entered allmulticast mode [ 618.631874][T27125] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.644108][T27125] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.657536][T27125] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 618.705434][T27288] syzkaller0: entered promiscuous mode [ 618.712256][T27288] syzkaller0: entered allmulticast mode [ 618.805732][T27125] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.817195][T27125] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.829233][T27125] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 618.863528][T27283] tipc: Enabled bearer , priority 0 [ 618.964800][T27125] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.978758][T27125] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 618.994888][T27125] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 619.043678][T27282] tipc: Resetting bearer [ 619.095694][T27304] unsupported nla_type 33542 [ 619.103544][T27282] tipc: Disabling bearer [ 619.319225][T27125] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 619.349453][T27125] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 619.376225][T27125] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 619.426787][T27125] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 619.574382][T27343] netlink: 'syz.4.6374': attribute type 10 has an invalid length. [ 619.626114][T27343] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 619.732913][T27125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 619.764272][T27125] 8021q: adding VLAN 0 to HW filter on device team0 [ 619.784320][ T7386] bridge0: port 1(bridge_slave_0) entered blocking state [ 619.791554][ T7386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 619.840787][ T7386] bridge0: port 2(bridge_slave_1) entered blocking state [ 619.847985][ T7386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 619.967873][ T5836] Bluetooth: hci2: command tx timeout [ 620.002274][T27125] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 620.015460][T27125] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 620.171458][T27371] netlink: 'syz.0.6382': attribute type 1 has an invalid length. [ 620.181002][T27371] netlink: 'syz.0.6382': attribute type 2 has an invalid length. [ 620.219108][T27368] netem: unknown loss type 0 [ 620.224146][T27368] netem: change failed [ 620.334164][T27380] __nla_validate_parse: 4 callbacks suppressed [ 620.334181][T27380] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6386'. [ 620.432906][T27377] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 620.448067][T27378] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 620.540019][T27392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6389'. [ 620.564365][T27392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6389'. [ 620.574192][T27392] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6389'. [ 622.037546][ T5836] Bluetooth: hci2: command tx timeout [ 622.183769][T27125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 622.236494][T27404] x_tables: unsorted underflow at hook 4 [ 622.304375][T27125] veth0_vlan: entered promiscuous mode [ 622.321140][T27411] x_tables: unsorted underflow at hook 4 [ 622.335949][T27125] veth1_vlan: entered promiscuous mode [ 622.452155][T27125] veth0_macvtap: entered promiscuous mode [ 622.482661][T27125] veth1_macvtap: entered promiscuous mode [ 622.560687][T27125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 622.617750][T27125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 622.685243][ T7409] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.742398][ T7409] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.766850][ T7409] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.808121][ T7409] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 622.866290][ T7392] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 622.907225][ T7392] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 622.908160][T27436] netlink: 'syz.4.6399': attribute type 1 has an invalid length. [ 623.105727][T27436] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6399'. [ 623.137782][T27447] bond1: (slave xfrm1): The slave device specified does not support setting the MAC address [ 623.174750][T27447] bond1: (slave xfrm1): Setting fail_over_mac to active for active-backup mode [ 623.212634][T27447] bond1: (slave xfrm1): making interface the new active one [ 623.223495][T27447] bond1: (slave xfrm1): Enslaving as an active interface with an up link [ 623.234990][ T7391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 623.243655][ T7391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 623.264632][T27436] bond1 (unregistering): (slave xfrm1): Releasing backup interface [ 623.280056][T27436] bond1 (unregistering): Released all slaves [ 623.554307][T27470] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6408'. [ 623.647008][T27477] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 624.029306][T27494] netlink: 'syz.0.6413': attribute type 8 has an invalid length. [ 624.059654][T27493] x_tables: duplicate underflow at hook 1 [ 624.118723][ T5836] Bluetooth: hci2: command tx timeout [ 624.399693][T21809] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 624.411050][T21809] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 624.422597][T21809] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 624.446499][T21809] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 624.459373][T21809] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 624.588105][T27514] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6422'. [ 624.643479][T27517] Bluetooth: MGMT ver 1.23 [ 624.651247][T27518] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6423'. [ 624.895740][T27506] chnl_net:caif_netlink_parms(): no params data found [ 625.037191][T27538] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6429'. [ 625.089234][T27506] bridge0: port 1(bridge_slave_0) entered blocking state [ 625.100037][T27543] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6430'. [ 625.111340][T27506] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.120330][T27506] bridge_slave_0: entered allmulticast mode [ 625.131319][T27506] bridge_slave_0: entered promiscuous mode [ 625.142729][T27506] bridge0: port 2(bridge_slave_1) entered blocking state [ 625.167899][T27506] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.187389][T27506] bridge_slave_1: entered allmulticast mode [ 625.195744][T27506] bridge_slave_1: entered promiscuous mode [ 625.284772][T27506] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 625.319447][T27506] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 625.404887][T27506] team0: Port device team_slave_0 added [ 625.424737][T27506] team0: Port device team_slave_1 added [ 625.534109][T27506] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 625.559196][T27506] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 625.613335][T27506] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 625.639339][T27506] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 625.646355][T27506] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 625.681499][T27506] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 625.919312][T27506] hsr_slave_0: entered promiscuous mode [ 625.931538][T27506] hsr_slave_1: entered promiscuous mode [ 625.939112][T27506] debugfs: 'hsr0' already exists in 'hsr' [ 625.944982][T27506] Cannot create hsr debugfs directory [ 626.154179][T27595] __nla_validate_parse: 1 callbacks suppressed [ 626.154205][T27595] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6444'. [ 626.170753][T27595] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6444'. [ 626.214275][T27599] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 626.228094][T27599] gretap2: entered promiscuous mode [ 626.235690][T27599] gretap2: entered allmulticast mode [ 626.295052][T27604] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 626.354903][T27604] xt_hashlimit: size too large, truncated to 1048576 [ 626.371403][T27506] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.384620][T27506] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.400377][T27506] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 626.435181][T27616] netlink: 'syz.4.6452': attribute type 1 has an invalid length. [ 626.435373][T27617] netlink: 'syz.4.6452': attribute type 1 has an invalid length. [ 626.492281][T27619] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6452'. [ 626.515203][T27616] 8021q: adding VLAN 0 to HW filter on device bond1 [ 626.522443][ T5836] Bluetooth: hci5: command tx timeout [ 626.561955][T27610] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 626.574948][T27610] bond1 (unregistering): Released all slaves [ 626.596192][T27619] bond1: entered allmulticast mode [ 626.604773][T27506] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.616462][T27506] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.627080][T27506] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 626.689434][T27624] tipc: Resetting bearer [ 626.711011][T27506] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.723110][T27506] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.738035][T27506] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 626.901881][T27506] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.912672][T27506] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.929387][T27506] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 627.111637][T27635] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6457'. [ 627.121603][T27635] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6457'. [ 627.150627][T27635] netlink: 31 bytes leftover after parsing attributes in process `syz.1.6457'. [ 627.207945][T27635] netlink: 'syz.1.6457': attribute type 2 has an invalid length. [ 627.215720][T27635] netlink: 31 bytes leftover after parsing attributes in process `syz.1.6457'. [ 627.252994][T27642] FAULT_INJECTION: forcing a failure. [ 627.252994][T27642] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 627.295327][T27642] CPU: 0 UID: 0 PID: 27642 Comm: syz.4.6459 Not tainted syzkaller #0 PREEMPT(full) [ 627.295363][T27642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 627.295377][T27642] Call Trace: [ 627.295385][T27642] [ 627.295395][T27642] dump_stack_lvl+0x189/0x250 [ 627.295426][T27642] ? __pfx____ratelimit+0x10/0x10 [ 627.295453][T27642] ? __pfx_dump_stack_lvl+0x10/0x10 [ 627.295480][T27642] ? __pfx__printk+0x10/0x10 [ 627.295501][T27642] ? __might_fault+0xb0/0x130 [ 627.295541][T27642] should_fail_ex+0x414/0x560 [ 627.295577][T27642] _copy_from_iter+0x1de/0x1790 [ 627.295606][T27642] ? rcu_is_watching+0x15/0xb0 [ 627.295633][T27642] ? kmalloc_reserve+0xbd/0x290 [ 627.295654][T27642] ? __pfx__copy_from_iter+0x10/0x10 [ 627.295679][T27642] ? __build_skb_around+0x262/0x3f0 [ 627.295702][T27642] ? netlink_sendmsg+0x642/0xb30 [ 627.295721][T27642] ? skb_put+0x11b/0x210 [ 627.295745][T27642] netlink_sendmsg+0x6b2/0xb30 [ 627.295776][T27642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.295801][T27642] ? aa_sock_msg_perm+0xf1/0x1d0 [ 627.295832][T27642] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 627.295853][T27642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 627.295874][T27642] __sock_sendmsg+0x21c/0x270 [ 627.295905][T27642] ____sys_sendmsg+0x505/0x830 [ 627.295934][T27642] ? __pfx_____sys_sendmsg+0x10/0x10 [ 627.295966][T27642] ? import_iovec+0x74/0xa0 [ 627.295993][T27642] ___sys_sendmsg+0x21f/0x2a0 [ 627.296015][T27642] ? __pfx____sys_sendmsg+0x10/0x10 [ 627.296070][T27642] ? __fget_files+0x2a/0x420 [ 627.296084][T27642] ? __fget_files+0x3a0/0x420 [ 627.296107][T27642] __x64_sys_sendmsg+0x19b/0x260 [ 627.296125][T27642] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 627.296151][T27642] ? __pfx_ksys_write+0x10/0x10 [ 627.296178][T27642] ? do_syscall_64+0xbe/0xfa0 [ 627.296203][T27642] do_syscall_64+0xfa/0xfa0 [ 627.296225][T27642] ? lockdep_hardirqs_on+0x9c/0x150 [ 627.296251][T27642] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.296268][T27642] ? clear_bhb_loop+0x60/0xb0 [ 627.296290][T27642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 627.296306][T27642] RIP: 0033:0x7f8e3698f749 [ 627.296322][T27642] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 627.296347][T27642] RSP: 002b:00007f8e3778c038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 627.296366][T27642] RAX: ffffffffffffffda RBX: 00007f8e36be5fa0 RCX: 00007f8e3698f749 [ 627.296379][T27642] RDX: 0000000000000000 RSI: 0000200000009b40 RDI: 0000000000000003 [ 627.296391][T27642] RBP: 00007f8e3778c090 R08: 0000000000000000 R09: 0000000000000000 [ 627.296403][T27642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 627.296414][T27642] R13: 00007f8e36be6038 R14: 00007f8e36be5fa0 R15: 00007ffd955aec28 [ 627.296444][T27642] [ 627.304045][T27506] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 627.630046][T27657] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6465'. [ 627.642656][T27506] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 627.672353][T27506] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 627.705136][T27662] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6465'. [ 627.721070][T27506] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 627.956620][T27506] 8021q: adding VLAN 0 to HW filter on device bond0 [ 628.035641][T27506] 8021q: adding VLAN 0 to HW filter on device team0 [ 628.080114][ T7386] bridge0: port 1(bridge_slave_0) entered blocking state [ 628.084491][T27687] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6471'. [ 628.087335][ T7386] bridge0: port 1(bridge_slave_0) entered forwarding state [ 628.119996][ T7386] bridge0: port 2(bridge_slave_1) entered blocking state [ 628.127178][ T7386] bridge0: port 2(bridge_slave_1) entered forwarding state [ 628.340880][T27698] FAULT_INJECTION: forcing a failure. [ 628.340880][T27698] name failslab, interval 1, probability 0, space 0, times 0 [ 628.368695][T27699] netem: change failed [ 628.383646][T27698] CPU: 1 UID: 0 PID: 27698 Comm: syz.0.6475 Not tainted syzkaller #0 PREEMPT(full) [ 628.383676][T27698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 628.383688][T27698] Call Trace: [ 628.383697][T27698] [ 628.383706][T27698] dump_stack_lvl+0x189/0x250 [ 628.383737][T27698] ? __pfx____ratelimit+0x10/0x10 [ 628.383765][T27698] ? __pfx_dump_stack_lvl+0x10/0x10 [ 628.383791][T27698] ? __pfx__printk+0x10/0x10 [ 628.383817][T27698] ? __lock_acquire+0xab9/0xd20 [ 628.383845][T27698] should_fail_ex+0x414/0x560 [ 628.383878][T27698] should_failslab+0xa8/0x100 [ 628.383900][T27698] kmem_cache_alloc_noprof+0x74/0x6e0 [ 628.383927][T27698] ? skb_clone+0x212/0x3a0 [ 628.383956][T27698] skb_clone+0x212/0x3a0 [ 628.383982][T27698] __netlink_deliver_tap+0x404/0x850 [ 628.384015][T27698] ? netlink_deliver_tap+0x2e/0x1b0 [ 628.384037][T27698] netlink_deliver_tap+0x19c/0x1b0 [ 628.384058][T27698] netlink_unicast+0x7fa/0x9e0 [ 628.384098][T27698] ? __pfx_netlink_unicast+0x10/0x10 [ 628.384129][T27698] ? netlink_sendmsg+0x642/0xb30 [ 628.384148][T27698] ? skb_put+0x11b/0x210 [ 628.384177][T27698] netlink_sendmsg+0x805/0xb30 [ 628.384216][T27698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 628.384242][T27698] ? aa_sock_msg_perm+0xf1/0x1d0 [ 628.384278][T27698] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 628.384298][T27698] ? __pfx_netlink_sendmsg+0x10/0x10 [ 628.384320][T27698] __sock_sendmsg+0x21c/0x270 [ 628.384352][T27698] ____sys_sendmsg+0x505/0x830 [ 628.384381][T27698] ? __pfx_____sys_sendmsg+0x10/0x10 [ 628.384417][T27698] ? import_iovec+0x74/0xa0 [ 628.384449][T27698] ___sys_sendmsg+0x21f/0x2a0 [ 628.384474][T27698] ? __pfx____sys_sendmsg+0x10/0x10 [ 628.384538][T27698] ? __fget_files+0x2a/0x420 [ 628.384558][T27698] ? __fget_files+0x3a0/0x420 [ 628.384589][T27698] __x64_sys_sendmsg+0x19b/0x260 [ 628.384616][T27698] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 628.384653][T27698] ? __pfx_ksys_write+0x10/0x10 [ 628.384685][T27698] ? do_syscall_64+0xbe/0xfa0 [ 628.384718][T27698] do_syscall_64+0xfa/0xfa0 [ 628.384746][T27698] ? lockdep_hardirqs_on+0x9c/0x150 [ 628.384774][T27698] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.384794][T27698] ? clear_bhb_loop+0x60/0xb0 [ 628.384818][T27698] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.384837][T27698] RIP: 0033:0x7f5bf358f749 [ 628.384855][T27698] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 628.384874][T27698] RSP: 002b:00007f5bf43d0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 628.384896][T27698] RAX: ffffffffffffffda RBX: 00007f5bf37e5fa0 RCX: 00007f5bf358f749 [ 628.384911][T27698] RDX: 0000000000000000 RSI: 0000200000009b40 RDI: 0000000000000003 [ 628.384925][T27698] RBP: 00007f5bf43d0090 R08: 0000000000000000 R09: 0000000000000000 [ 628.384938][T27698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 628.384951][T27698] R13: 00007f5bf37e6038 R14: 00007f5bf37e5fa0 R15: 00007fffd0411f88 [ 628.384987][T27698] [ 628.684651][T27703] netem: change failed [ 628.697457][ T5836] Bluetooth: hci5: command tx timeout [ 628.859694][T27713] warn_alloc: 1 callbacks suppressed [ 628.859712][T27713] syz.0.6479: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 628.874669][T27506] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 628.896563][T27713] CPU: 0 UID: 0 PID: 27713 Comm: syz.0.6479 Not tainted syzkaller #0 PREEMPT(full) [ 628.896592][T27713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 628.896606][T27713] Call Trace: [ 628.896615][T27713] [ 628.896625][T27713] dump_stack_lvl+0x189/0x250 [ 628.896660][T27713] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 628.896693][T27713] ? __pfx_dump_stack_lvl+0x10/0x10 [ 628.896721][T27713] ? __pfx__printk+0x10/0x10 [ 628.896744][T27713] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 628.896772][T27713] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 628.896810][T27713] warn_alloc+0x214/0x310 [ 628.896841][T27713] ? stack_depot_save_flags+0x40/0x860 [ 628.896878][T27713] ? __pfx_warn_alloc+0x10/0x10 [ 628.896909][T27713] ? kasan_save_track+0x3e/0x80 [ 628.896937][T27713] ? __kasan_kmalloc+0x93/0xb0 [ 628.896968][T27713] ? xsk_setsockopt+0x4dc/0x8d0 [ 628.896992][T27713] ? do_sock_setsockopt+0x17c/0x1b0 [ 628.897013][T27713] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 628.897033][T27713] ? do_syscall_64+0xfa/0xfa0 [ 628.897062][T27713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.897094][T27713] __vmalloc_node_range_noprof+0x125/0x12d0 [ 628.897186][T27713] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 628.897220][T27713] ? __kasan_kmalloc+0x93/0xb0 [ 628.897254][T27713] vmalloc_user_noprof+0xad/0xf0 [ 628.897282][T27713] ? xskq_create+0xbf/0x170 [ 628.897311][T27713] xskq_create+0xbf/0x170 [ 628.897339][T27713] xsk_init_queue+0xb0/0x110 [ 628.897366][T27713] xsk_setsockopt+0x4dc/0x8d0 [ 628.897394][T27713] ? __pfx_xsk_setsockopt+0x10/0x10 [ 628.897424][T27713] ? __pfx_aa_sk_perm+0x10/0x10 [ 628.897454][T27713] ? aa_sock_opt_perm+0xff/0x1b0 [ 628.897488][T27713] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 628.897507][T27713] ? __pfx_xsk_setsockopt+0x10/0x10 [ 628.897534][T27713] do_sock_setsockopt+0x17c/0x1b0 [ 628.897563][T27713] __x64_sys_setsockopt+0x13f/0x1b0 [ 628.897590][T27713] do_syscall_64+0xfa/0xfa0 [ 628.897616][T27713] ? lockdep_hardirqs_on+0x9c/0x150 [ 628.897645][T27713] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.897666][T27713] ? clear_bhb_loop+0x60/0xb0 [ 628.897691][T27713] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.897711][T27713] RIP: 0033:0x7f5bf358f749 [ 628.897729][T27713] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 628.897747][T27713] RSP: 002b:00007f5bf43d0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 628.897769][T27713] RAX: ffffffffffffffda RBX: 00007f5bf37e5fa0 RCX: 00007f5bf358f749 [ 628.897785][T27713] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 628.897798][T27713] RBP: 00007f5bf3613f91 R08: 0000000000000004 R09: 0000000000000000 [ 628.897811][T27713] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 628.897824][T27713] R13: 00007f5bf37e6038 R14: 00007f5bf37e5fa0 R15: 00007fffd0411f88 [ 628.897858][T27713] [ 628.927395][T27506] veth0_vlan: entered promiscuous mode [ 629.096541][T27713] Mem-Info: [ 629.115916][T27506] veth1_vlan: entered promiscuous mode [ 629.220028][T27713] active_anon:4052 inactive_anon:0 isolated_anon:0 [ 629.220028][T27713] active_file:3465 inactive_file:40109 isolated_file:0 [ 629.220028][T27713] unevictable:768 dirty:243 writeback:0 [ 629.220028][T27713] slab_reclaimable:13468 slab_unreclaimable:181752 [ 629.220028][T27713] mapped:29399 shmem:1367 pagetables:1019 [ 629.220028][T27713] sec_pagetables:0 bounce:0 [ 629.220028][T27713] kernel_misc_reclaimable:0 [ 629.220028][T27713] free:1235600 free_pcp:14710 free_cma:0 [ 629.287962][T27713] Node 0 active_anon:16408kB inactive_anon:0kB active_file:13860kB inactive_file:160232kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117596kB dirty:968kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:17264kB pagetables:3912kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 629.330925][T27713] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 629.368385][T27713] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 629.447429][T27713] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 629.453774][T27713] Node 0 DMA32 free:1028636kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:16208kB inactive_anon:0kB active_file:13860kB inactive_file:160232kB unevictable:1536kB writepending:968kB zspages:0kB present:3129332kB managed:2565148kB mlocked:0kB bounce:0kB free_pcp:47232kB local_pcp:23872kB free_cma:0kB [ 629.533950][T27713] lowmem_reserve[]: 0 0 0 0 0 [ 629.540371][T27506] veth0_macvtap: entered promiscuous mode [ 629.564930][T27506] veth1_macvtap: entered promiscuous mode [ 629.575154][T27713] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 629.651604][T27506] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 629.660111][T27713] lowmem_reserve[]: 0 0 0 0 0 [ 629.664867][T27713] Node 1 Normal free:3898276kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:11912kB local_pcp:6608kB free_cma:0kB [ 629.713831][T27506] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 629.760300][ T7391] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.772059][T27713] lowmem_reserve[]: 0 0 0 0 0 [ 629.779394][ T7391] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.794533][T27713] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 629.848328][ T7391] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.859239][ T7391] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.868751][T27713] Node 0 DMA32: 686*4kB (UME) 106*8kB (M) 285*16kB (UME) 116*32kB (ME) 137*64kB (UME) 194*128kB (UM) 87*256kB (UM) 137*512kB (UME) 60*1024kB (UME) 3*2048kB (UM) 201*4096kB (UM) = 1028760kB [ 629.893186][T27713] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 629.905076][T27713] Node 1 Normal: 129*4kB (UME) 5*8kB (ME) 33*16kB (UME) 222*32kB (UME) 79*64kB (UME) 20*128kB (UME) 5*256kB (UME) 3*512kB (UM) 3*1024kB (UM) 1*2048kB (E) 946*4096kB (M) = 3898556kB [ 629.962395][T27713] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 629.973432][T27713] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 629.985141][T27713] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 629.995423][T27713] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 630.007266][T27713] 44940 total pagecache pages [ 630.012043][T27713] 0 pages in swap cache [ 630.040836][T27713] Free swap = 124996kB [ 630.045042][T27713] Total swap = 124996kB [ 630.069664][ T7408] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 630.080008][ T7408] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 630.088872][T27713] 2097051 pages RAM [ 630.092705][T27713] 0 pages HighMem/MovableOnly [ 630.110042][T27713] 424122 pages reserved [ 630.114246][T27713] 0 pages cma reserved [ 630.179238][ T7391] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 630.193066][ T7391] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 630.508235][T27774] syz_tun: entered allmulticast mode [ 630.523971][T27773] syz_tun: left allmulticast mode [ 630.654510][T27787] netlink: 'syz.1.6500': attribute type 1 has an invalid length. [ 630.719648][T27787] bond1: entered promiscuous mode [ 630.725947][T27787] 8021q: adding VLAN 0 to HW filter on device bond1 [ 630.759480][ T5836] Bluetooth: hci5: command tx timeout [ 630.841461][T27797] veth3: entered promiscuous mode [ 630.996292][T27810] netlink: 'syz.3.6505': attribute type 14 has an invalid length. [ 631.004401][T27810] netlink: 'syz.3.6505': attribute type 13 has an invalid length. [ 631.023615][T27810] netlink: 'syz.3.6505': attribute type 14 has an invalid length. [ 631.062520][T27810] netlink: 'syz.3.6505': attribute type 13 has an invalid length. [ 631.115085][T27814] bridge_slave_0: left allmulticast mode [ 631.140151][T27814] bridge_slave_0: left promiscuous mode [ 631.170218][T27814] bridge0: port 1(bridge_slave_0) entered disabled state [ 631.192507][T27814] bridge_slave_1: left allmulticast mode [ 631.227361][T27814] bridge_slave_1: left promiscuous mode [ 631.233289][T27814] bridge0: port 2(bridge_slave_1) entered disabled state [ 631.322890][T27826] __nla_validate_parse: 15 callbacks suppressed [ 631.322909][T27826] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6512'. [ 631.371504][T27814] bond0: (slave bond_slave_0): Releasing backup interface [ 631.492309][T27814] bond0: (slave bond_slave_1): Releasing backup interface [ 631.582794][T27814] team0: Port device team_slave_0 removed [ 631.625295][T27814] team0: Port device team_slave_1 removed [ 631.645017][T27814] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 631.654760][T27814] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 631.676369][T27814] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 631.715209][T27814] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 631.747505][T27814] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 631.983210][ T7386] bridge_slave_1: left allmulticast mode [ 631.990563][ T7386] bridge_slave_1: left promiscuous mode [ 632.003874][ T7386] bridge0: port 2(bridge_slave_1) entered disabled state [ 632.091419][ T7386] bridge_slave_0: left allmulticast mode [ 632.097331][ T7386] bridge_slave_0: left promiscuous mode [ 632.113366][ T7386] bridge0: port 1(bridge_slave_0) entered disabled state [ 632.221991][T27850] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6518'. [ 632.270543][T27850] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6518'. [ 632.339789][T27856] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6519'. [ 632.710102][T27865] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6522'. [ 632.837257][ T5836] Bluetooth: hci5: command tx timeout [ 632.931219][T27871] netlink: 100 bytes leftover after parsing attributes in process `syz.0.6525'. [ 633.052757][ T7386] bond1 (unregistering): (slave gretap1): Releasing active interface [ 633.080485][T27877] x_tables: duplicate underflow at hook 1 [ 633.235371][ T7386] team0: Port device geneve0 removed [ 633.939367][ T7386] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 633.950255][ T7386] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 633.969035][ T7386] bond0 (unregistering): (slave 0!): Releasing backup interface [ 633.980508][ T7386] bond0 (unregistering): Released all slaves [ 633.993835][ T7386] bond1 (unregistering): Released all slaves [ 634.006118][ T7386] bond2 (unregistering): Released all slaves [ 634.023244][ T7386] bond3 (unregistering): Released all slaves [ 634.044563][ T7386] bond4 (unregistering): Released all slaves [ 634.061510][ T7386] bond5 (unregistering): (slave lo): Releasing backup interface [ 634.071921][ T7386] bond5 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 634.086082][ T7386] bond5 (unregistering): Released all slaves [ 634.197949][ T7386] bond6 (unregistering): Released all slaves [ 634.212118][ T7386] bond7 (unregistering): Released all slaves [ 634.449149][T27890] netlink: 'syz.0.6529': attribute type 3 has an invalid length. [ 634.457132][T27890] netlink: 'syz.0.6529': attribute type 1 has an invalid length. [ 634.528756][T27897] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6531'. [ 634.725299][T27905] netlink: 'syz.1.6535': attribute type 12 has an invalid length. [ 634.908035][T27905] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6535'. [ 635.088693][T27933] openvswitch: netlink: Key type 88 is out of range max 32 [ 635.131016][T27932] netlink: 144 bytes leftover after parsing attributes in process `syz.0.6541'. [ 635.285366][T27940] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 635.303896][T27940] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 635.422146][T27946] xt_hashlimit: size too large, truncated to 1048576 [ 635.947799][T27967] netem: incorrect ge model size [ 635.952830][T27967] netem: change failed [ 635.970175][ T7386] : left promiscuous mode [ 636.022515][T27973] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6558'. [ 636.180225][ T7386] tipc: Left network mode [ 636.215935][ T7386] IPVS: stopping backup sync thread 25255 ... [ 636.462196][T28001] __nla_validate_parse: 1 callbacks suppressed [ 636.462215][T28001] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6566'. [ 636.505708][ T7386] hsr_slave_0: left promiscuous mode [ 636.515001][ T7386] hsr_slave_1: left promiscuous mode [ 636.546046][ T7386] team_slave_0: left promiscuous mode [ 636.551541][ T7386] team_slave_1: left promiscuous mode [ 636.557184][ T7386] batadv1: left promiscuous mode [ 636.564335][ T7386] veth1_macvtap: left promiscuous mode [ 636.570193][ T7386] veth0_macvtap: left promiscuous mode [ 636.577516][ T7386] veth1_vlan: left promiscuous mode [ 636.582805][ T7386] veth0_vlan: left promiscuous mode [ 636.599767][T28011] netlink: 'syz.3.6565': attribute type 8 has an invalid length. [ 636.716253][ T7386] pim6reg (unregistering): left allmulticast mode [ 636.772252][ T7386] team0 (unregistering): Port device batadv1 removed [ 637.122718][ T7386] team0 (unregistering): Port device team_slave_1 removed [ 637.184320][ T7386] team0 (unregistering): Port device team_slave_0 removed [ 637.614779][T27997] syzkaller0: entered promiscuous mode [ 637.621057][T27997] syzkaller0: entered allmulticast mode [ 637.700525][T28027] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6570'. [ 637.760557][T28020] netlink: 14544 bytes leftover after parsing attributes in process `syz.4.6569'. [ 637.904431][T28026] netlink: 'syz.1.6570': attribute type 1 has an invalid length. [ 637.929323][T28027] netlink: 'syz.1.6570': attribute type 1 has an invalid length. [ 638.264765][ T7386] IPVS: stop unused estimator thread 0... [ 638.413250][T28055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6580'. [ 638.426240][T28055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6580'. [ 638.494557][T28067] netlink: 'syz.2.6582': attribute type 3 has an invalid length. [ 638.941260][T28089] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6585'. [ 639.230847][T28098] netlink: 'syz.1.6590': attribute type 13 has an invalid length. [ 639.289243][T28098] gre0: left promiscuous mode [ 639.299727][T28098] gre0: left allmulticast mode [ 639.320520][T28098] gretap0: refused to change device tx_queue_len [ 639.331301][T28098] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 639.369449][T28098] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6590'. [ 639.516282][T28110] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6592'. [ 639.523102][T28113] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6593'. [ 639.697343][T28118] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6593'. [ 639.920315][T28129] geneve2: entered promiscuous mode [ 640.201595][T28146] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 640.221652][T28143] netlink: 'syz.2.6598': attribute type 12 has an invalid length. [ 640.232871][T28143] netlink: 'syz.2.6598': attribute type 29 has an invalid length. [ 640.569395][T28171] : renamed from bridge_slave_0 (while UP) [ 640.733201][T28182] netlink: 'syz.0.6613': attribute type 1 has an invalid length. [ 640.772440][T28182] 8021q: adding VLAN 0 to HW filter on device bond1 [ 640.798318][T28182] veth3: entered promiscuous mode [ 640.809093][T28182] bond1: (slave veth3): Enslaving as an active interface with an up link [ 640.856393][ T5836] block nbd5: Receive control failed (result -32) [ 640.886056][T28192] IPVS: length: 24 != 6168 [ 640.962789][T28194] netlink: 'syz.1.6616': attribute type 1 has an invalid length. [ 641.107191][T28203] syzkaller0: entered promiscuous mode [ 641.113003][T28203] syzkaller0: entered allmulticast mode [ 641.524237][T28225] netlink: 'syz.4.6625': attribute type 5 has an invalid length. [ 641.609743][T28229] __nla_validate_parse: 3 callbacks suppressed [ 641.609764][T28229] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6627'. [ 641.622887][T28231] netlink: 'syz.1.6628': attribute type 27 has an invalid length. [ 641.644205][T28232] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6628'. [ 642.026399][T28251] netlink: 7 bytes leftover after parsing attributes in process `syz.2.6636'. [ 642.415139][T28270] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6642'. [ 642.464507][T28268] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6643'. [ 642.852051][T28292] netlink: 'syz.2.6649': attribute type 2 has an invalid length. [ 642.867394][T28292] netlink: 119 bytes leftover after parsing attributes in process `syz.2.6649'. [ 643.024152][T28297] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 643.051401][T28297] netlink: 'syz.2.6651': attribute type 142 has an invalid length. [ 643.073517][T28299] bridge4: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 643.292276][T28309] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6655'. [ 643.346773][T28309] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6655'. [ 643.408085][T28318] Cannot find set identified by id 0 to match [ 643.789411][T28339] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6665'. [ 643.827854][T28339] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6665'. [ 643.894386][T28347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 644.705881][T28392] FAULT_INJECTION: forcing a failure. [ 644.705881][T28392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 644.734286][T28392] CPU: 1 UID: 0 PID: 28392 Comm: syz.1.6682 Not tainted syzkaller #0 PREEMPT(full) [ 644.734315][T28392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 644.734328][T28392] Call Trace: [ 644.734337][T28392] [ 644.734346][T28392] dump_stack_lvl+0x189/0x250 [ 644.734378][T28392] ? __pfx____ratelimit+0x10/0x10 [ 644.734406][T28392] ? __pfx_dump_stack_lvl+0x10/0x10 [ 644.734433][T28392] ? __pfx__printk+0x10/0x10 [ 644.734454][T28392] ? __might_fault+0xb0/0x130 [ 644.734494][T28392] should_fail_ex+0x414/0x560 [ 644.734529][T28392] _copy_from_user+0x2d/0xb0 [ 644.734556][T28392] nr_rt_ioctl+0x726/0xd50 [ 644.734592][T28392] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 644.734613][T28392] ? lockdep_hardirqs_on+0x9c/0x150 [ 644.734654][T28392] ? apparmor_capable+0x137/0x1b0 [ 644.734685][T28392] ? capable+0x89/0xe0 [ 644.734707][T28392] ? nr_ioctl+0x1b1/0x3b0 [ 644.734730][T28392] sock_do_ioctl+0xdc/0x300 [ 644.734760][T28392] ? __pfx_sock_do_ioctl+0x10/0x10 [ 644.734803][T28392] sock_ioctl+0x576/0x790 [ 644.734831][T28392] ? __pfx_sock_ioctl+0x10/0x10 [ 644.734859][T28392] ? __fget_files+0x3a0/0x420 [ 644.734879][T28392] ? __fget_files+0x2a/0x420 [ 644.734908][T28392] ? bpf_lsm_file_ioctl+0x9/0x20 [ 644.734931][T28392] ? __pfx_sock_ioctl+0x10/0x10 [ 644.734956][T28392] __se_sys_ioctl+0xfc/0x170 [ 644.734984][T28392] do_syscall_64+0xfa/0xfa0 [ 644.735011][T28392] ? lockdep_hardirqs_on+0x9c/0x150 [ 644.735038][T28392] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 644.735058][T28392] ? clear_bhb_loop+0x60/0xb0 [ 644.735084][T28392] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 644.735103][T28392] RIP: 0033:0x7f7f1958f749 [ 644.735121][T28392] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 644.735139][T28392] RSP: 002b:00007f7f1a4c2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 644.735160][T28392] RAX: ffffffffffffffda RBX: 00007f7f197e6090 RCX: 00007f7f1958f749 [ 644.735176][T28392] RDX: 0000200000004580 RSI: 000000000000890c RDI: 0000000000000005 [ 644.735190][T28392] RBP: 00007f7f1a4c2090 R08: 0000000000000000 R09: 0000000000000000 [ 644.735203][T28392] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 644.735215][T28392] R13: 00007f7f197e6128 R14: 00007f7f197e6090 R15: 00007ffd56b1e068 [ 644.735249][T28392] [ 645.281700][T28413] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 645.404419][T28414] syzkaller0: entered promiscuous mode [ 645.410577][T28414] syzkaller0: entered allmulticast mode [ 645.814434][T28446] xt_hashlimit: size too large, truncated to 1048576 [ 645.964923][T28456] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 645.998793][T28457] FAULT_INJECTION: forcing a failure. [ 645.998793][T28457] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 646.019634][T28457] CPU: 0 UID: 0 PID: 28457 Comm: syz.4.6705 Not tainted syzkaller #0 PREEMPT(full) [ 646.019664][T28457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 646.019678][T28457] Call Trace: [ 646.019687][T28457] [ 646.019697][T28457] dump_stack_lvl+0x189/0x250 [ 646.019729][T28457] ? __pfx____ratelimit+0x10/0x10 [ 646.019757][T28457] ? __pfx_dump_stack_lvl+0x10/0x10 [ 646.019784][T28457] ? __pfx__printk+0x10/0x10 [ 646.019818][T28457] should_fail_ex+0x414/0x560 [ 646.019865][T28457] _copy_to_user+0x31/0xb0 [ 646.019893][T28457] simple_read_from_buffer+0xe1/0x170 [ 646.019929][T28457] proc_fail_nth_read+0x1b3/0x220 [ 646.019958][T28457] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 646.019986][T28457] ? rw_verify_area+0x2a6/0x4d0 [ 646.020012][T28457] ? __lock_acquire+0xab9/0xd20 [ 646.020030][T28457] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 646.020057][T28457] vfs_read+0x200/0xa30 [ 646.020083][T28457] ? fdget_pos+0x247/0x320 [ 646.020106][T28457] ? __pfx___mutex_lock+0x10/0x10 [ 646.020136][T28457] ? __pfx_vfs_read+0x10/0x10 [ 646.020165][T28457] ? __fget_files+0x2a/0x420 [ 646.020188][T28457] ? __fget_files+0x3a0/0x420 [ 646.020206][T28457] ? __fget_files+0x2a/0x420 [ 646.020234][T28457] ksys_read+0x145/0x250 [ 646.020259][T28457] ? __fget_files+0x2a/0x420 [ 646.020279][T28457] ? __pfx_ksys_read+0x10/0x10 [ 646.020309][T28457] ? do_syscall_64+0xbe/0xfa0 [ 646.020338][T28457] do_syscall_64+0xfa/0xfa0 [ 646.020359][T28457] ? lockdep_hardirqs_on+0x9c/0x150 [ 646.020383][T28457] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.020401][T28457] ? clear_bhb_loop+0x60/0xb0 [ 646.020423][T28457] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 646.020441][T28457] RIP: 0033:0x7f8e3698e15c [ 646.020458][T28457] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 646.020476][T28457] RSP: 002b:00007f8e3776b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 646.020494][T28457] RAX: ffffffffffffffda RBX: 00007f8e36be6090 RCX: 00007f8e3698e15c [ 646.020508][T28457] RDX: 000000000000000f RSI: 00007f8e3776b0a0 RDI: 0000000000000004 [ 646.020520][T28457] RBP: 00007f8e3776b090 R08: 0000000000000000 R09: 0000000000000000 [ 646.020531][T28457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 646.020541][T28457] R13: 00007f8e36be6128 R14: 00007f8e36be6090 R15: 00007ffd955aec28 [ 646.020571][T28457] [ 646.513210][T28477] lo: entered allmulticast mode [ 646.733818][T28492] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 646.759087][T28494] x_tables: duplicate underflow at hook 3 [ 646.811229][T28498] xt_hashlimit: size too large, truncated to 1048576 [ 646.843481][T28500] xt_policy: output policy not valid in PREROUTING and INPUT [ 647.275390][T25859] IPVS: starting estimator thread 0... [ 647.293449][T28517] IPVS: wrr: FWM 3 0x00000003 - no destination available [ 647.380746][T28518] IPVS: using max 27 ests per chain, 64800 per kthread [ 647.391609][T28524] syzkaller0: entered promiscuous mode [ 647.400717][T28524] syzkaller0: entered allmulticast mode [ 647.500371][T28526] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 647.544953][T28528] __nla_validate_parse: 12 callbacks suppressed [ 647.544972][T28528] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6724'. [ 647.755081][T28540] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6727'. [ 647.765265][T28540] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6727'. [ 647.873785][T28548] netlink: 'syz.1.6729': attribute type 4 has an invalid length. [ 647.904315][T28549] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6730'. [ 647.929624][T28549] netlink: 96 bytes leftover after parsing attributes in process `syz.4.6730'. [ 647.951857][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 647.952945][T28551] xt_hashlimit: size too large, truncated to 1048576 [ 648.022452][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.035399][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.060239][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.121457][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.163703][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.190699][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.212111][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.230582][T28554] netlink: 'syz.1.6732': attribute type 1 has an invalid length. [ 648.390902][T28589] tipc: Enabling of bearer rejected, failed to enable media [ 648.472856][T28594] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6742'. [ 648.692675][T28609] xt_hashlimit: size too large, truncated to 1048576 [ 648.765946][T28614] netlink: 164 bytes leftover after parsing attributes in process `syz.4.6749'. [ 649.006260][T28565] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 649.161769][T28632] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6753'. [ 649.292850][T28639] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6757'. [ 649.307430][T28639] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6757'. [ 649.454130][T28648] xt_hashlimit: size too large, truncated to 1048576 [ 650.107174][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807641f000: rx timeout, send abort [ 650.272169][T28699] xt_hashlimit: size too large, truncated to 1048576 [ 650.280845][ T5836] Bluetooth: hci0: command 0x0401 tx timeout [ 650.512085][T28714] delete_channel: no stack [ 650.607173][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807641d400: rx timeout, send abort [ 650.615417][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807641f000: abort rx timeout. Force session deactivation [ 650.951489][T28739] xt_hashlimit: size too large, truncated to 1048576 [ 651.115407][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807641d400: abort rx timeout. Force session deactivation [ 651.669518][T28783] xt_hashlimit: size too large, truncated to 1048576 [ 652.560552][T28838] mac80211_hwsim hwsim63 wlan1: entered allmulticast mode [ 652.573589][T28838] __nla_validate_parse: 12 callbacks suppressed [ 652.573610][T28838] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6817'. [ 652.610738][T28842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6819'. [ 652.622553][T28842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6819'. [ 652.634965][T28842] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6819'. [ 652.663216][T28844] xt_hashlimit: size too large, truncated to 1048576 [ 653.201506][T28864] syzkaller0: entered promiscuous mode [ 653.219478][T28864] syzkaller0: entered allmulticast mode [ 653.240746][T28864] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 653.259189][T28876] validate_nla: 30 callbacks suppressed [ 653.259208][T28876] netlink: 'syz.2.6831': attribute type 9 has an invalid length. [ 653.320449][T28876] xt_l2tp: missing protocol rule (udp|l2tpip) [ 653.408986][T28883] xt_hashlimit: size too large, truncated to 1048576 [ 653.443981][T28881] syzkaller0: entered promiscuous mode [ 653.452265][T28881] syzkaller0: entered allmulticast mode [ 655.669439][T28919] netlink: 332 bytes leftover after parsing attributes in process `syz.2.6845'. [ 655.743749][T28925] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6846'. [ 655.859465][T28930] netlink: 212360 bytes leftover after parsing attributes in process `syz.2.6849'. [ 655.865748][T28933] netlink: 348 bytes leftover after parsing attributes in process `syz.4.6850'. [ 655.894877][T28936] netlink: 348 bytes leftover after parsing attributes in process `syz.4.6850'. [ 655.896431][T28937] xt_hashlimit: size too large, truncated to 1048576 [ 656.311997][T28960] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 656.568093][T28976] netdevsim netdevsim2 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 656.651304][T28980] netlink: 88 bytes leftover after parsing attributes in process `syz.0.6867'. [ 656.749092][T28982] xt_hashlimit: size too large, truncated to 1048576 [ 656.760147][T28983] xt_CT: You must specify a L4 protocol and not use inversions on it [ 657.556119][T29032] xt_hashlimit: size too large, truncated to 1048576 [ 657.564579][T29036] netlink: 'syz.0.6884': attribute type 21 has an invalid length. [ 657.621422][T29036] bond2: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 657.634513][T29036] bond2 (unregistering): Released all slaves [ 657.672843][T29042] vcan0: tx drop: invalid da for name 0x0000000000000002 [ 657.928001][T29056] __nla_validate_parse: 1 callbacks suppressed [ 657.928022][T29056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6888'. [ 657.943785][T29056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6888'. [ 658.115053][T29070] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6892'. [ 658.225466][T29078] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6894'. [ 658.320356][T29083] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6897'. [ 658.421928][T29091] xt_hashlimit: size too large, truncated to 1048576 [ 658.551791][T29103] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6902'. [ 658.589214][T29107] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6904'. [ 658.664165][T29106] IPVS: persistence engine module ip_vs_pe_H not found [ 658.684725][T29112] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6904'. [ 658.697650][T29108] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6903'. [ 658.767414][T29107] netlink: 'syz.0.6904': attribute type 154 has an invalid length. [ 658.787309][T29107] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6904'. [ 658.817793][T29107] netlink: 'syz.0.6904': attribute type 7 has an invalid length. [ 658.825583][T29107] netlink: 'syz.0.6904': attribute type 8 has an invalid length. [ 658.959638][T29122] xt_recent: Unsupported userspace flags (000000b1) [ 659.020047][T29120] xt_CT: No such helper "syz1" [ 659.368529][T29150] netlink: 'syz.2.6912': attribute type 25 has an invalid length. [ 659.441957][T29154] netlink: 'syz.1.6914': attribute type 21 has an invalid length. [ 659.491622][ T7392] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.501916][T29154] netlink: 'syz.1.6914': attribute type 21 has an invalid length. [ 659.526186][ T7392] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.681455][ T7392] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.783892][ T7392] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 659.798258][T29168] xt_hashlimit: size too large, truncated to 1048576 [ 659.853036][T29171] xt_hashlimit: size too large, truncated to 1048576 [ 660.297436][ T7408] team0: left allmulticast mode [ 660.304485][ T7408] C: left allmulticast mode [ 660.323397][ T7408] team_slave_1: left allmulticast mode [ 660.346825][ T7408] team0: left promiscuous mode [ 660.351637][ T7408] C: left promiscuous mode [ 660.376607][ T7408] team_slave_1: left promiscuous mode [ 660.383396][ T7408] bridge0: port 3(team0) entered disabled state [ 660.463963][ T7408] bridge_slave_1: left allmulticast mode [ 660.473379][ T7408] bridge_slave_1: left promiscuous mode [ 660.481784][ T7408] bridge0: port 2(bridge_slave_1) entered disabled state [ 660.532268][ T1209] IPVS: starting estimator thread 0... [ 660.551466][ T7408] bridge_slave_0: left promiscuous mode [ 660.559014][ T7408] bridge0: port 1(bridge_slave_0) entered disabled state [ 660.636467][T29200] IPVS: using max 38 ests per chain, 91200 per kthread [ 660.800761][ T7383] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 661.587483][ T7408] bond0 (unregistering): (slave 1!€ÿ): Releasing backup interface [ 661.596256][ T7408] bond0 (unregistering): Released all slaves [ 661.609568][ T7408] bond1 (unregistering): Released all slaves [ 661.623078][ T7408] bond2 (unregistering): Released all slaves [ 661.743612][ T7408] bond3 (unregistering): Released all slaves [ 661.848319][ T7408] bond4 (unregistering): Released all slaves [ 661.861732][ T7408] bond5 (unregistering): Released all slaves [ 661.977396][ T7408] bond6 (unregistering): (slave veth5): Releasing active interface [ 661.987306][ T7408] bond6 (unregistering): (slave veth7): Releasing active interface [ 661.996568][ T7408] bond6 (unregistering): Released all slaves [ 662.105636][ T7408] bond7 (unregistering): Released all slaves [ 662.217894][ T7408] bond8 (unregistering): Released all slaves [ 662.319751][ T7408] bond9 (unregistering): Released all slaves [ 662.336121][T29195] geneve3: entered promiscuous mode [ 662.348850][T29197] geneve3: entered promiscuous mode [ 662.497552][ T7408] : left promiscuous mode [ 662.589482][T29229] xt_hashlimit: size too large, truncated to 1048576 [ 662.680440][ T7408] tipc: Disabling bearer [ 662.700530][ T7408] tipc: Disabling bearer [ 662.759532][ T7408] tipc: Left network mode [ 662.845651][T29250] netlink: 'syz.0.6936': attribute type 10 has an invalid length. [ 662.880920][T29250] team0: Port device dummy0 added [ 662.900761][T29250] netlink: 'syz.0.6936': attribute type 1 has an invalid length. [ 663.085881][T29258] __nla_validate_parse: 11 callbacks suppressed [ 663.085900][T29258] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6939'. [ 663.102873][T29258] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6939'. [ 663.266383][ T7408] hsr_slave_0: left promiscuous mode [ 663.292183][T29265] openvswitch: netlink: Unknown key attributes 2 [ 663.304431][ T7408] hsr_slave_1: left promiscuous mode [ 663.306468][T29260] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6940'. [ 663.314197][ T7408] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 663.334284][ T7408] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 663.494104][T29273] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6943'. [ 663.537535][T29273] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6943'. [ 663.576302][T29278] xt_hashlimit: size too large, truncated to 1048576 [ 664.184427][ T7408] team0 (unregistering): Port device team_slave_1 removed [ 664.229825][ T7408] team0 (unregistering): Port device C removed [ 664.811714][T29293] xt_hashlimit: size too large, truncated to 1048576 [ 664.879319][T29302] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6951'. [ 665.191716][T29321] netlink: 'syz.4.6958': attribute type 1 has an invalid length. [ 665.200021][T29321] netlink: 16179 bytes leftover after parsing attributes in process `syz.4.6958'. [ 665.299442][ T7408] IPVS: stop unused estimator thread 0... [ 665.331228][T29328] xt_hashlimit: size too large, truncated to 1048576 [ 665.459857][T29337] netlink: 'syz.1.6961': attribute type 10 has an invalid length. [ 665.473415][T29337] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6961'. [ 665.504084][T29338] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6963'. [ 665.535503][T29337] team0: Port device geneve0 added [ 665.562571][T29339] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6963'. [ 665.689577][T29343] netlink: 'syz.3.6964': attribute type 1 has an invalid length. [ 666.392069][T29387] netlink: 'syz.4.6976': attribute type 25 has an invalid length. [ 666.409418][T29387] netlink: 'syz.4.6976': attribute type 1 has an invalid length. [ 666.422428][T29387] bridge0: port 1(bridge_slave_0) entered learning state [ 666.463600][T29391] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.471090][T29391] bridge0: port 1() entered disabled state [ 666.762733][T29405] dvmrp0: entered allmulticast mode [ 666.789220][T29408] dvmrp0: left allmulticast mode [ 666.882034][ T30] audit: type=1800 audit(1764212249.382:59): pid=29414 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.6987" name="memory.events" dev="tmpfs" ino=831 res=0 errno=0 [ 666.960623][T29414] team0: Port device team_slave_0 removed [ 667.174767][T29415] syzkaller0: entered promiscuous mode [ 667.185435][T29415] syzkaller0: entered allmulticast mode [ 667.412180][T29440] IPv6: NLM_F_CREATE should be specified when creating new route [ 669.208944][T29454] xt_hashlimit: size too large, truncated to 1048576 [ 669.263470][T29463] netlink: 'syz.3.6998': attribute type 11 has an invalid length. [ 669.487533][T29471] tipc: Started in network mode [ 669.492450][T29471] tipc: Node identity 080211, cluster identity 4711 [ 669.517164][T29471] tipc: Enabled bearer , priority 0 [ 669.528529][T29471] mac80211_hwsim hwsim64 +: renamed from syzkaller0 [ 669.541112][T29471] tipc: Disabling bearer [ 669.590123][T29473] netlink: 'syz.2.7004': attribute type 39 has an invalid length. [ 669.663762][T29476] macvlan3: entered promiscuous mode [ 669.821237][T29482] __nla_validate_parse: 5 callbacks suppressed [ 669.821262][T29482] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7006'. [ 669.854218][T29482] netlink: 'syz.4.7006': attribute type 2 has an invalid length. [ 669.863025][T29482] netlink: 119 bytes leftover after parsing attributes in process `syz.4.7006'. [ 670.036861][T29497] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7011'. [ 670.140009][T29507] xt_hashlimit: size too large, truncated to 1048576 [ 670.339664][T29515] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7016'. [ 670.352038][T29515] netlink: 'syz.0.7016': attribute type 10 has an invalid length. [ 670.360482][T29515] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7016'. [ 670.375880][T29516] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7018'. [ 670.378464][T29517] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7017'. [ 670.415444][T29515] team0: Port device geneve0 added [ 670.455262][T29517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7017'. [ 670.464613][T29517] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7017'. [ 670.514655][T29521] netlink: 212324 bytes leftover after parsing attributes in process `syz.3.7019'. [ 670.690689][T29529] pim6reg1: entered promiscuous mode [ 670.696215][T29529] pim6reg1: entered allmulticast mode [ 670.754900][T29532] atomic_op ffff888077b4b998 conn xmit_atomic 0000000000000000 [ 670.950906][T29539] xt_CONNSECMARK: invalid mode: 0 [ 671.026289][T29541] xt_hashlimit: size too large, truncated to 1048576 [ 671.071777][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 671.088656][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 671.107330][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 671.212152][T29551] xt_TPROXY: Can be used only with -p tcp or -p udp [ 671.274918][T29549] syzkaller0: entered promiscuous mode [ 671.291293][T29549] syzkaller0: entered allmulticast mode [ 671.710552][T29546] infiniband syz2: set active [ 671.715365][T29546] infiniband syz2: added vxcan1 [ 671.725299][ T5922] vxcan1 speed is unknown, defaulting to 1000 [ 671.774511][T29546] RDS/IB: syz2: added [ 671.778822][T29546] smc: adding ib device syz2 with port count 1 [ 671.785086][T29546] smc: ib device syz2 port 1 has no pnetid [ 671.794617][ T1209] vxcan1 speed is unknown, defaulting to 1000 [ 671.802042][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 672.752277][T29577] delete_channel: no stack [ 673.899692][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 674.184326][T29623] erspan0: entered allmulticast mode [ 674.527744][T29639] netlink: 'syz.3.7055': attribute type 4 has an invalid length. [ 674.622364][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 675.072790][T29668] __nla_validate_parse: 6 callbacks suppressed [ 675.072809][T29668] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7064'. [ 675.114292][T29672] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7064'. [ 675.148679][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 675.173832][T29668] syzkaller0: entered promiscuous mode [ 675.180034][T29668] syzkaller0: entered allmulticast mode [ 675.276428][T29672] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7064'. [ 675.570743][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 675.585385][T29679] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7068'. [ 675.767608][T29682] netlink: 52 bytes leftover after parsing attributes in process `syz.1.7069'. [ 675.975380][T29698] netlink: 4336 bytes leftover after parsing attributes in process `syz.4.7075'. [ 675.984840][T29698] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 676.113788][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 676.448698][T29723] netlink: 64 bytes leftover after parsing attributes in process `syz.3.7080'. [ 676.467849][T29723] netlink: 64 bytes leftover after parsing attributes in process `syz.3.7080'. [ 676.547942][T29723] tipc: Started in network mode [ 676.566886][T29723] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 676.586858][T29723] tipc: Enabled bearer , priority 10 [ 676.606841][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 676.608077][T29728] 8021q: VLANs not supported on ip6tnl0 [ 676.676322][T29728] netlink: 68 bytes leftover after parsing attributes in process `syz.4.7085'. [ 676.843263][T29736] syzkaller1: entered promiscuous mode [ 676.848982][T29736] syzkaller1: entered allmulticast mode [ 676.966415][T29743] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7088'. [ 676.994576][T29546] vxcan1 speed is unknown, defaulting to 1000 [ 677.127779][T29751] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 677.144692][T29751] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 677.697583][ T9] tipc: Node number set to 10005162 [ 678.968994][T29844] netlink: 'syz.2.7118': attribute type 1 has an invalid length. [ 680.111786][T29886] __nla_validate_parse: 14 callbacks suppressed [ 680.111808][T29886] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7134'. [ 680.127489][T29886] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7134'. [ 680.152654][T29875] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.7129'. [ 680.221489][T29889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7133'. [ 680.241187][T29889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7133'. [ 680.251593][T29889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7133'. [ 680.268165][T29886] gretap3: entered promiscuous mode [ 680.277078][T29889] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7133'. [ 680.279924][T29886] gretap3: entered allmulticast mode [ 680.537961][T29906] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7139'. [ 680.573420][T29912] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7138'. [ 680.615961][T29916] netlink: 'syz.1.7142': attribute type 1 has an invalid length. [ 680.657669][T29916] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 680.844106][T29937] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7148'. [ 680.864979][T29937] netlink: 'syz.2.7148': attribute type 7 has an invalid length. [ 681.212741][T29957] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 681.884433][T29998] netlink: 'syz.1.7163': attribute type 39 has an invalid length. [ 681.965225][T29996] bond2 (unregistering): Released all slaves [ 682.075356][T30009] syzkaller0: entered promiscuous mode [ 682.081150][T30009] syzkaller0: entered allmulticast mode [ 682.314587][T30022] netlink: 'syz.4.7172': attribute type 1 has an invalid length. [ 682.389400][T30022] 8021q: adding VLAN 0 to HW filter on device bond4 [ 682.405945][T30022] bond3: (slave bond4): making interface the new active one [ 682.415304][T30022] bond3: (slave bond4): Enslaving as an active interface with an up link [ 682.421768][T30031] IPVS: set_ctl: invalid protocol: 44 10.1.1.0:20003 [ 682.444031][T30022] bond3: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 682.457802][T30022] bond3: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 683.276256][T30081] team0 (unregistering): Port device team_slave_0 removed [ 683.288721][T30081] team0 (unregistering): Port device team_slave_1 removed [ 683.299523][T30081] team0 (unregistering): Port device dummy0 removed [ 683.310937][T30081] team0 (unregistering): Port device geneve0 removed [ 683.332703][T30083] team0: Device ip6gre1 is up. Set it down before adding it as a team port [ 683.949326][T30116] netlink: 'syz.1.7199': attribute type 10 has an invalid length. [ 683.958998][T30112] netlink: 'syz.4.7200': attribute type 1 has an invalid length. [ 683.994535][T30116] team0: Port device dummy0 added [ 684.486312][ T9] IPVS: starting estimator thread 0... [ 684.574663][T30160] dvmrp0: entered allmulticast mode [ 684.580067][T30157] IPVS: using max 34 ests per chain, 81600 per kthread [ 684.594419][T30156] dvmrp0: left allmulticast mode [ 685.131091][T30189] __nla_validate_parse: 20 callbacks suppressed [ 685.131109][T30189] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7223'. [ 685.152123][T30193] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7223'. [ 685.829365][T30181] tipc: Resetting bearer [ 685.969107][T30187] tipc: Enabling of bearer rejected, media not registered [ 686.121864][ T7391] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.157407][ T7391] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.202171][ T7391] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.236901][ T7391] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.826201][T30257] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7240'. [ 686.835792][T30257] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7240'. [ 686.888892][T30259] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 687.005249][T30264] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7243'. [ 687.099119][T30268] x_tables: duplicate underflow at hook 1 [ 687.171141][T30272] xt_hashlimit: size too large, truncated to 1048576 [ 687.682713][T30296] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 687.901869][T30314] xt_hashlimit: size too large, truncated to 1048576 [ 687.961161][T30319] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7260'. [ 688.130500][T30326] tipc: Started in network mode [ 688.143190][T30326] tipc: Node identity 0a1d040d0745, cluster identity 4711 [ 688.175257][T30326] tipc: Enabled bearer , priority 0 [ 688.212068][T30331] syzkaller0: entered promiscuous mode [ 688.221066][T30331] syzkaller0: entered allmulticast mode [ 688.255698][T30330] tipc: Started in network mode [ 688.263531][T30330] tipc: Node identity 76f5b95f0011, cluster identity 4711 [ 688.271790][T30330] tipc: Enabled bearer , priority 0 [ 688.279932][T30330] syzkaller0: entered allmulticast mode [ 688.296359][T30326] tipc: Resetting bearer [ 688.448483][T30348] openvswitch: netlink: Duplicate or invalid key (type 0). [ 688.459540][T30347] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 688.488874][T30348] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 688.495678][T30347] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7270'. [ 688.510278][T30329] tipc: Resetting bearer [ 688.538406][T30329] tipc: Disabling bearer [ 688.612299][T30355] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 688.640433][T30355] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7272'. [ 688.711276][T30357] netlink: 'syz.4.7273': attribute type 16 has an invalid length. [ 688.723400][T30361] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 688.816628][T30365] xt_hashlimit: size too large, truncated to 1048576 [ 688.822970][T30368] syz.3.7277: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 688.840058][T21809] Bluetooth: hci5: command 0x0405 tx timeout [ 688.852662][T30368] CPU: 0 UID: 0 PID: 30368 Comm: syz.3.7277 Not tainted syzkaller #0 PREEMPT(full) [ 688.852710][T30368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 688.852729][T30368] Call Trace: [ 688.852737][T30368] [ 688.852746][T30368] dump_stack_lvl+0x189/0x250 [ 688.852779][T30368] ? __pfx_dump_stack_lvl+0x10/0x10 [ 688.852811][T30368] ? __pfx__printk+0x10/0x10 [ 688.852830][T30368] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 688.852859][T30368] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 688.852884][T30368] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 688.852908][T30368] warn_alloc+0x214/0x310 [ 688.852935][T30368] ? stack_depot_save_flags+0x40/0x860 [ 688.852964][T30368] ? __pfx_warn_alloc+0x10/0x10 [ 688.852991][T30368] ? kasan_save_track+0x3e/0x80 [ 688.853023][T30368] ? __kasan_kmalloc+0x93/0xb0 [ 688.853048][T30368] ? xsk_setsockopt+0x4dc/0x8d0 [ 688.853070][T30368] ? do_sock_setsockopt+0x17c/0x1b0 [ 688.853088][T30368] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 688.853105][T30368] ? do_syscall_64+0xfa/0xfa0 [ 688.853128][T30368] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.853154][T30368] __vmalloc_node_range_noprof+0x125/0x12d0 [ 688.853202][T30368] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 688.853229][T30368] ? __kasan_kmalloc+0x93/0xb0 [ 688.853259][T30368] vmalloc_user_noprof+0xad/0xf0 [ 688.853283][T30368] ? xskq_create+0xbf/0x170 [ 688.853308][T30368] xskq_create+0xbf/0x170 [ 688.853338][T30368] xsk_init_queue+0xb0/0x110 [ 688.853367][T30368] xsk_setsockopt+0x4dc/0x8d0 [ 688.853396][T30368] ? __pfx_xsk_setsockopt+0x10/0x10 [ 688.853425][T30368] ? __pfx_aa_sk_perm+0x10/0x10 [ 688.853456][T30368] ? aa_sock_opt_perm+0xff/0x1b0 [ 688.853490][T30368] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 688.853510][T30368] ? __pfx_xsk_setsockopt+0x10/0x10 [ 688.853534][T30368] do_sock_setsockopt+0x17c/0x1b0 [ 688.853557][T30368] __x64_sys_setsockopt+0x13f/0x1b0 [ 688.853590][T30368] do_syscall_64+0xfa/0xfa0 [ 688.853615][T30368] ? lockdep_hardirqs_on+0x9c/0x150 [ 688.853640][T30368] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.853657][T30368] ? clear_bhb_loop+0x60/0xb0 [ 688.853684][T30368] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.853702][T30368] RIP: 0033:0x7fede598f749 [ 688.853719][T30368] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 688.853734][T30368] RSP: 002b:00007fede6908038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 688.853752][T30368] RAX: ffffffffffffffda RBX: 00007fede5be5fa0 RCX: 00007fede598f749 [ 688.853764][T30368] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 688.853774][T30368] RBP: 00007fede5a13f91 R08: 0000000000000004 R09: 0000000000000000 [ 688.853784][T30368] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 688.853794][T30368] R13: 00007fede5be6038 R14: 00007fede5be5fa0 R15: 00007ffd5c17b778 [ 688.853821][T30368] [ 688.853969][T30368] Mem-Info: [ 689.150523][T30368] active_anon:4066 inactive_anon:0 isolated_anon:0 [ 689.150523][T30368] active_file:3530 inactive_file:40135 isolated_file:0 [ 689.150523][T30368] unevictable:768 dirty:102 writeback:0 [ 689.150523][T30368] slab_reclaimable:13372 slab_unreclaimable:122563 [ 689.150523][T30368] mapped:29436 shmem:1367 pagetables:1066 [ 689.150523][T30368] sec_pagetables:0 bounce:0 [ 689.150523][T30368] kernel_misc_reclaimable:0 [ 689.150523][T30368] free:1299682 free_pcp:12263 free_cma:0 [ 689.151080][T30321] tipc: Resetting bearer [ 689.208627][T30368] Node 0 active_anon:16264kB inactive_anon:0kB active_file:14120kB inactive_file:160336kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117744kB dirty:408kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16556kB pagetables:4100kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 689.260796][T30378] set match dimension is over the limit! [ 689.267594][T30368] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:164kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 689.298079][T30368] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 689.298880][T30321] tipc: Disabling bearer [ 689.335568][T30368] lowmem_reserve[]: 0 2505 2505 2505 2505 [ 689.342465][T30368] Node 0 DMA32 free:1282748kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:16364kB inactive_anon:0kB active_file:14120kB inactive_file:160336kB unevictable:1536kB writepending:408kB zspages:0kB present:3129332kB managed:2565148kB mlocked:0kB bounce:0kB free_pcp:39220kB local_pcp:18936kB free_cma:0kB [ 689.377394][T30368] lowmem_reserve[]: 0 0 0 0 0 [ 689.382289][T30368] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 689.388482][T30375] [ 689.412722][T30368] lowmem_reserve[]: [ 689.413830][T30375] ====================================================== [ 689.413843][T30375] WARNING: possible circular locking dependency detected [ 689.413862][T30375] syzkaller #0 Not tainted [ 689.417792][T30368] 0 [ 689.424647][T30375] ------------------------------------------------------ [ 689.424659][T30375] syz.0.7279/30375 is trying to acquire lock: [ 689.424671][T30375] ffff888143f0c0c8 (&q->elevator_lock [ 689.431848][T30368] 0 [ 689.436071][T30375] ){+.+.}-{4:4}, at: elevator_change+0x1e5/0x4c0 [ 689.441710][T30368] 0 [ 689.445594][T30375] [ 689.445594][T30375] but task is already holding lock: [ 689.445605][T30375] ffff888143f0bb88 (&q->q_usage_counter(io)#55){++++}-{0:0} [ 689.451996][T30368] 0 [ 689.457105][T30375] , at: elevator_change+0x1ca/0x4c0 [ 689.457139][T30375] [ 689.457139][T30375] which lock already depends on the new lock. [ 689.457139][T30375] [ 689.457148][T30375] [ 689.457148][T30375] the existing dependency chain (in reverse order) is: [ 689.457155][T30375] [ 689.457155][T30375] -> #6 (&q->q_usage_counter(io) [ 689.459732][T30368] 0 [ 689.465951][T30375] #55){++++}-{0:0}: [ 689.465975][T30375] lock_acquire+0x120/0x360 [ 689.465993][T30375] blk_alloc_queue+0x538/0x620 [ 689.466015][T30375] __blk_mq_alloc_disk+0x15c/0x340 [ 689.466031][T30375] nbd_dev_add+0x46c/0xae0 [ 689.466049][T30375] nbd_init+0x1c6/0x240 [ 689.466065][T30375] do_one_initcall+0x236/0x820 [ 689.466087][T30375] do_initcall_level+0x104/0x190 [ 689.466107][T30375] do_initcalls+0x59/0xa0 [ 689.466126][T30375] kernel_init_freeable+0x334/0x4b0 [ 689.469408][T30368] [ 689.475959][T30375] kernel_init+0x1d/0x1d0 [ 689.475986][T30375] ret_from_fork+0x4bc/0x870 [ 689.476005][T30375] ret_from_fork_asm+0x1a/0x30 [ 689.483517][T30368] Node 1 [ 689.485751][T30375] [ 689.485751][T30375] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 689.485784][T30375] lock_acquire+0x120/0x360 [ 689.491137][T30368] Normal free:3900364kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:9824kB local_pcp:5056kB free_cma:0kB [ 689.501337][T30375] fs_reclaim_acquire+0x72/0x100 [ 689.501371][T30375] __kmalloc_cache_node_noprof+0x45/0x6f0 [ 689.501396][T30375] create_worker+0x112/0x720 [ 689.501424][T30375] workqueue_prepare_cpu+0xe4/0x170 [ 689.501453][T30375] cpuhp_invoke_callback+0x445/0x860 [ 689.501476][T30375] _cpu_up+0x2c9/0x580 [ 689.501495][T30375] cpu_up+0x1d2/0x220 [ 689.501514][T30375] cpuhp_bringup_mask+0xb2/0x1a0 [ 689.501543][T30375] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 689.501571][T30375] bringup_nonboot_cpus+0x17/0x30 [ 689.501599][T30375] smp_init+0x32/0x110 [ 689.501622][T30375] kernel_init_freeable+0x316/0x4b0 [ 689.501646][T30375] kernel_init+0x1d/0x1d0 [ 689.501668][T30375] ret_from_fork+0x4bc/0x870 [ 689.501686][T30375] ret_from_fork_asm+0x1a/0x30 [ 689.501703][T30375] [ 689.501703][T30375] -> #4 (cpu_hotplug_lock){++++}-{0:0}: [ 689.501743][T30375] lock_acquire+0x120/0x360 [ 689.501761][T30375] cpus_read_lock+0x42/0x160 [ 689.501779][T30375] static_key_slow_inc+0x12/0x30 [ 689.501806][T30375] nbd_genl_reconfigure+0x10d8/0x1a50 [ 689.501827][T30375] genl_family_rcv_msg_doit+0x215/0x300 [ 689.501854][T30375] genl_rcv_msg+0x60e/0x790 [ 689.501877][T30375] netlink_rcv_skb+0x208/0x470 [ 689.501895][T30375] genl_rcv+0x28/0x40 [ 689.501918][T30375] netlink_unicast+0x82f/0x9e0 [ 689.501944][T30375] netlink_sendmsg+0x805/0xb30 [ 689.511339][T30368] lowmem_reserve[]: [ 689.518029][T30375] __sock_sendmsg+0x21c/0x270 [ 689.518059][T30375] ____sys_sendmsg+0x505/0x830 [ 689.518076][T30375] ___sys_sendmsg+0x21f/0x2a0 [ 689.518094][T30375] __x64_sys_sendmsg+0x19b/0x260 [ 689.518112][T30375] do_syscall_64+0xfa/0xfa0 [ 689.520741][T30368] 0 [ 689.524397][T30375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.524421][T30375] [ 689.524421][T30375] -> #3 (&nsock->tx_lock){+.+.}-{4:4} [ 689.530175][T30368] 0 [ 689.534703][T30375] : [ 689.534717][T30375] lock_acquire+0x120/0x360 [ 689.534740][T30375] __mutex_lock+0x187/0x1350 [ 689.540498][T30368] 0 [ 689.545258][T30375] nbd_queue_rq+0x257/0xf10 [ 689.545282][T30375] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 689.552321][T30368] 0 [ 689.555210][T30375] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 689.561502][T30368] 0 [ 689.565525][T30375] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 689.565565][T30375] blk_mq_run_hw_queue+0x348/0x4f0 [ 689.571557][T30368] [ 689.573598][T30375] blk_mq_dispatch_list+0xd0c/0xe00 [ 689.573631][T30375] blk_mq_flush_plug_list+0x469/0x550 [ 689.578699][T30368] Node 0 [ 689.583573][T30375] __blk_flush_plug+0x3d3/0x4b0 [ 689.583610][T30375] __submit_bio+0x2d3/0x5a0 [ 689.583627][T30375] submit_bio_noacct_nocheck+0x2fb/0xa50 [ 689.589628][T30368] DMA: [ 689.591807][T30375] block_read_full_folio+0x599/0x830 [ 689.591840][T30375] filemap_read_folio+0x117/0x380 [ 689.591859][T30375] do_read_cache_folio+0x350/0x590 [ 689.599402][T30368] 0*4kB [ 689.604057][T30375] read_part_sector+0xb6/0x2b0 [ 689.604096][T30375] adfspart_check_ICS+0xa4/0xa50 [ 689.604121][T30375] bdev_disk_changed+0x75f/0x14b0 [ 689.604144][T30375] blkdev_get_whole+0x380/0x510 [ 689.636462][T30368] 0*8kB [ 689.640998][T30375] bdev_open+0x31e/0xd30 [ 689.641032][T30375] blkdev_open+0x457/0x600 [ 689.641050][T30375] do_dentry_open+0x953/0x13f0 [ 689.641068][T30375] vfs_open+0x3b/0x340 [ 689.641083][T30375] path_openat+0x2ee5/0x3830 [ 689.641104][T30375] do_filp_open+0x1fa/0x410 [ 689.641124][T30375] do_sys_openat2+0x121/0x1c0 [ 689.641141][T30375] __x64_sys_openat+0x138/0x170 [ 689.641160][T30375] do_syscall_64+0xfa/0xfa0 [ 689.641187][T30375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.641208][T30375] [ 689.641208][T30375] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 689.641239][T30375] lock_acquire+0x120/0x360 [ 689.641255][T30375] __mutex_lock+0x187/0x1350 [ 689.641280][T30375] nbd_queue_rq+0xc8/0xf10 [ 689.641297][T30375] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 689.641321][T30375] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 689.641348][T30375] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 689.641375][T30375] blk_mq_run_hw_queue+0x348/0x4f0 [ 689.641397][T30375] blk_mq_dispatch_list+0xd0c/0xe00 [ 689.641421][T30375] blk_mq_flush_plug_list+0x469/0x550 [ 689.641444][T30375] __blk_flush_plug+0x3d3/0x4b0 [ 689.641471][T30375] __submit_bio+0x2d3/0x5a0 [ 689.641487][T30375] submit_bio_noacct_nocheck+0x2fb/0xa50 [ 689.641522][T30375] block_read_full_folio+0x599/0x830 [ 689.641546][T30375] filemap_read_folio+0x117/0x380 [ 689.641566][T30375] do_read_cache_folio+0x350/0x590 [ 689.641584][T30375] read_part_sector+0xb6/0x2b0 [ 689.641609][T30375] adfspart_check_ICS+0xa4/0xa50 [ 689.641635][T30375] bdev_disk_changed+0x75f/0x14b0 [ 689.641658][T30375] blkdev_get_whole+0x380/0x510 [ 689.641684][T30375] bdev_open+0x31e/0xd30 [ 689.648898][T30368] 0*16kB [ 689.653001][T30375] blkdev_open+0x457/0x600 [ 689.653025][T30375] do_dentry_open+0x953/0x13f0 [ 689.653045][T30375] vfs_open+0x3b/0x340 [ 689.662025][T30368] 0*32kB [ 689.664527][T30375] path_openat+0x2ee5/0x3830 [ 689.664556][T30375] do_filp_open+0x1fa/0x410 [ 689.669317][T30368] 0*64kB [ 689.673614][T30375] do_sys_openat2+0x121/0x1c0 [ 689.673639][T30375] __x64_sys_openat+0x138/0x170 [ 689.679467][T30368] 0*128kB [ 689.685380][T30375] do_syscall_64+0xfa/0xfa0 [ 689.685414][T30375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.691616][T30368] 0*256kB [ 689.695496][T30375] [ 689.695496][T30375] -> #1 (set->srcu){.+.+}-{0:0} [ 689.701321][T30368] 0*512kB [ 689.706033][T30375] : [ 689.706042][T30375] lock_sync+0xba/0x160 [ 689.706065][T30375] __synchronize_srcu+0x96/0x3a0 [ 689.711342][T30368] 1*1024kB [ 689.716414][T30375] elevator_switch+0x12b/0x640 [ 689.725199][T30368] (U) [ 689.729127][T30375] elevator_change+0x315/0x4c0 [ 689.729159][T30375] elevator_set_default+0x186/0x260 [ 689.729185][T30375] blk_register_queue+0x34e/0x3f0 [ 689.729202][T30375] __add_disk+0x677/0xd50 [ 689.739529][T30368] 1*2048kB [ 689.739727][T30375] add_disk_fwnode+0xfc/0x480 [ 689.745664][T30368] (M) [ 689.751645][T30375] nbd_dev_add+0x717/0xae0 [ 689.751666][T30375] nbd_init+0x1c6/0x240 [ 689.751683][T30375] do_one_initcall+0x236/0x820 [ 689.751709][T30375] do_initcall_level+0x104/0x190 [ 689.751731][T30375] do_initcalls+0x59/0xa0 [ 689.751752][T30375] kernel_init_freeable+0x334/0x4b0 [ 689.751777][T30375] kernel_init+0x1d/0x1d0 [ 689.751798][T30375] ret_from_fork+0x4bc/0x870 [ 689.751817][T30375] ret_from_fork_asm+0x1a/0x30 [ 689.751835][T30375] [ 689.751835][T30375] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 689.751868][T30375] validate_chain+0xb9b/0x2140 [ 689.751891][T30375] __lock_acquire+0xab9/0xd20 [ 689.751909][T30375] lock_acquire+0x120/0x360 [ 689.751926][T30375] __mutex_lock+0x187/0x1350 [ 689.751955][T30375] elevator_change+0x1e5/0x4c0 [ 689.751983][T30375] elevator_set_none+0x42/0xb0 [ 689.752010][T30375] blk_mq_update_nr_hw_queues+0x598/0x1ab0 [ 689.752031][T30375] nbd_start_device+0x17f/0xb10 [ 689.752051][T30375] nbd_genl_connect+0x135b/0x18f0 [ 689.752070][T30375] genl_family_rcv_msg_doit+0x215/0x300 [ 689.752097][T30375] genl_rcv_msg+0x60e/0x790 [ 689.752120][T30375] netlink_rcv_skb+0x208/0x470 [ 689.752138][T30375] genl_rcv+0x28/0x40 [ 689.752160][T30375] netlink_unicast+0x82f/0x9e0 [ 689.752188][T30375] netlink_sendmsg+0x805/0xb30 [ 689.752206][T30375] __sock_sendmsg+0x21c/0x270 [ 689.752232][T30375] ____sys_sendmsg+0x505/0x830 [ 689.752251][T30375] ___sys_sendmsg+0x21f/0x2a0 [ 689.757461][T30368] 3*4096kB [ 689.762528][T30375] __x64_sys_sendmsg+0x19b/0x260 [ 689.769127][T30368] (M) [ 689.772280][T30375] do_syscall_64+0xfa/0xfa0 [ 689.778213][T30368] = 15360kB [ 689.781349][T30375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.781374][T30375] [ 689.781374][T30375] other info that might help us debug this: [ 689.781374][T30375] [ 689.786626][T30368] Node 0 [ 689.791809][T30375] Chain exists of: [ 689.791809][T30375] &q->elevator_lock --> fs_reclaim [ 689.797195][T30368] DMA32: [ 689.802430][T30375] --> &q->q_usage_counter(io)#55 [ 689.802430][T30375] [ 689.808109][T30368] 2711*4kB [ 689.809935][T30375] Possible unsafe locking scenario: [ 689.809935][T30375] [ 689.809945][T30375] CPU0 CPU1 [ 689.809953][T30375] ---- ---- [ 689.816376][T30368] (UME) [ 689.823856][T30375] lock(&q->q_usage_counter(io)#55); [ 689.823878][T30375] lock(fs_reclaim); [ 689.823894][T30375] lock(&q->q_usage_counter(io)#55); [ 689.823914][T30375] lock(&q->elevator_lock); [ 689.823929][T30375] [ 689.823929][T30375] *** DEADLOCK *** [ 689.823929][T30375] [ 689.823936][T30375] 6 locks held by syz.0.7279/30375: [ 689.826497][T30368] 959*8kB [ 689.828812][T30375] #0: ffffffff8f331c10 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 689.828869][T30375] #1: ffffffff8f331a28 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10d/0x790 [ 689.828917][T30375] #2: [ 689.833965][T30368] (UME) [ 689.838995][T30375] ffff88802502d9c8 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xa7/0x1ab0 [ 689.839043][T30375] #3: ffff88802502d8d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xba/0x1ab0 [ 689.839094][T30375] #4: ffff888143f0bb88 (&q->q_usage_counter(io)#55){++++}-{0:0}, at: elevator_change+0x1ca/0x4c0 [ 689.839160][T30375] #5: ffff888143f0bbc0 (&q->q_usage_counter(queue)#39){+.+.}-{0:0}, at: elevator_change+0x1ca/0x4c0 [ 689.839225][T30375] [ 689.839225][T30375] stack backtrace: [ 689.839237][T30375] CPU: 0 UID: 0 PID: 30375 Comm: syz.0.7279 Not tainted syzkaller #0 PREEMPT(full) [ 689.839261][T30375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 689.839275][T30375] Call Trace: [ 689.839286][T30375] [ 689.839296][T30375] dump_stack_lvl+0x189/0x250 [ 689.839325][T30375] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.839353][T30375] ? __pfx__printk+0x10/0x10 [ 689.839375][T30375] ? print_lock_name+0xde/0x100 [ 689.839396][T30375] print_circular_bug+0x2ee/0x310 [ 689.839424][T30375] check_noncircular+0x134/0x160 [ 689.839451][T30375] validate_chain+0xb9b/0x2140 [ 689.839493][T30375] __lock_acquire+0xab9/0xd20 [ 689.839516][T30375] ? elevator_change+0x1e5/0x4c0 [ 689.839544][T30375] lock_acquire+0x120/0x360 [ 689.839563][T30375] ? elevator_change+0x1e5/0x4c0 [ 689.839593][T30375] __mutex_lock+0x187/0x1350 [ 689.839617][T30375] ? elevator_change+0x1e5/0x4c0 [ 689.839647][T30375] ? xa_find_after+0xae/0x430 [ 689.839668][T30375] ? xa_find_after+0x402/0x430 [ 689.839686][T30375] ? elevator_change+0x1e5/0x4c0 [ 689.839713][T30375] ? xa_find_after+0xae/0x430 [ 689.839731][T30375] ? __pfx___mutex_lock+0x10/0x10 [ 689.839760][T30375] ? __pfx_blk_mq_cancel_work_sync+0x10/0x10 [ 689.839784][T30375] elevator_change+0x1e5/0x4c0 [ 689.839815][T30375] elevator_set_none+0x42/0xb0 [ 689.839850][T30375] blk_mq_update_nr_hw_queues+0x598/0x1ab0 [ 689.839879][T30375] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 689.839909][T30375] ? sysfs_add_file_mode_ns+0x259/0x300 [ 689.839935][T30375] nbd_start_device+0x17f/0xb10 [ 689.839959][T30375] ? device_create_file+0xf4/0x1c0 [ 689.839981][T30375] nbd_genl_connect+0x135b/0x18f0 [ 689.840005][T30375] ? __pfx_nbd_genl_connect+0x10/0x10 [ 689.840027][T30375] ? rcu_is_watching+0x15/0xb0 [ 689.840051][T30375] ? __nla_parse+0x40/0x60 [ 689.840073][T30375] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 689.840104][T30375] genl_family_rcv_msg_doit+0x215/0x300 [ 689.840132][T30375] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 689.840164][T30375] ? stack_trace_save+0x9c/0xe0 [ 689.840191][T30375] genl_rcv_msg+0x60e/0x790 [ 689.840217][T30375] ? __pfx_genl_rcv_msg+0x10/0x10 [ 689.840240][T30375] ? __pfx_nbd_genl_connect+0x10/0x10 [ 689.840266][T30375] netlink_rcv_skb+0x208/0x470 [ 689.840284][T30375] ? __lock_acquire+0xab9/0xd20 [ 689.840302][T30375] ? __pfx_genl_rcv_msg+0x10/0x10 [ 689.840326][T30375] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 689.840353][T30375] ? down_read+0x1ad/0x2e0 [ 689.840376][T30375] genl_rcv+0x28/0x40 [ 689.840397][T30375] netlink_unicast+0x82f/0x9e0 [ 689.840430][T30375] ? __pfx_netlink_unicast+0x10/0x10 [ 689.840458][T30375] ? netlink_sendmsg+0x642/0xb30 [ 689.840482][T30375] ? skb_put+0x11b/0x210 [ 689.840502][T30375] netlink_sendmsg+0x805/0xb30 [ 689.840525][T30375] ? __pfx_netlink_sendmsg+0x10/0x10 [ 689.840546][T30375] ? aa_sock_msg_perm+0xf1/0x1d0 [ 689.840576][T30375] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 689.840594][T30375] ? __pfx_netlink_sendmsg+0x10/0x10 [ 689.840614][T30375] __sock_sendmsg+0x21c/0x270 [ 689.840641][T30375] ____sys_sendmsg+0x505/0x830 [ 689.840664][T30375] ? __pfx_____sys_sendmsg+0x10/0x10 [ 689.840689][T30375] ? import_iovec+0x74/0xa0 [ 689.840714][T30375] ___sys_sendmsg+0x21f/0x2a0 [ 689.840735][T30375] ? __pfx____sys_sendmsg+0x10/0x10 [ 689.840772][T30375] ? __fget_files+0x2a/0x420 [ 689.840789][T30375] ? __fget_files+0x3a0/0x420 [ 689.840811][T30375] __x64_sys_sendmsg+0x19b/0x260 [ 689.840834][T30375] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 689.840862][T30375] ? do_syscall_64+0xbe/0xfa0 [ 689.840891][T30375] do_syscall_64+0xfa/0xfa0 [ 689.840917][T30375] ? lockdep_hardirqs_on+0x9c/0x150 [ 689.840944][T30375] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.840963][T30375] ? clear_bhb_loop+0x60/0xb0 [ 689.840985][T30375] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.841004][T30375] RIP: 0033:0x7f5bf358f749 [ 689.841022][T30375] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 689.841040][T30375] RSP: 002b:00007f5bf43d0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 689.841061][T30375] RAX: ffffffffffffffda RBX: 00007f5bf37e5fa0 RCX: 00007f5bf358f749 [ 689.841076][T30375] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 689.841089][T30375] RBP: 00007f5bf3613f91 R08: 0000000000000000 R09: 0000000000000000 [ 689.841102][T30375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 689.841114][T30375] R13: 00007f5bf37e6038 R14: 00007f5bf37e5fa0 R15: 00007fffd0411f88 [ 689.841136][T30375] [ 691.060268][T30368] 468*16kB (UME) 568*32kB (UME) 295*64kB (UME) 284*128kB (UM) 158*256kB (UM) 188*512kB (UME) 109*1024kB (UME) 6*2048kB (UM) 225*4096kB (UM) = 1281620kB [ 691.063668][T30205] tipc: Node number set to 223872013 [ 691.082358][T30368] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 691.094377][T30368] Node 1 Normal: 195*4kB (UME) 40*8kB (UME) 46*16kB (UME) 235*32kB (UME) 85*64kB (UME) 22*128kB (UME) 5*256kB (UME) 3*512kB (UM) 3*1024kB (UM) 1*2048kB (E) 946*4096kB (M) = 3900364kB [ 691.103476][ T5836] block nbd6: Receive control failed (result -32) [ 691.113803][T30368] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 691.128738][T30368] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 691.129145][ T5836] block nbd6: Receive control failed (result -32) [ 691.138561][T30368] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 691.156814][T30368] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 691.157836][T30375] nbd6: detected capacity change from 0 to 127 [ 691.166120][T30368] 45029 total pagecache pages [ 691.166131][T30368] 0 pages in swap cache [ 691.166139][T30368] Free swap = 124996kB [ 691.166147][T30368] Total swap = 124996kB [ 691.166157][T30368] 2097051 pages RAM [ 691.225101][T30368] 0 pages HighMem/MovableOnly [ 691.230153][T30368] 424122 pages reserved [ 691.234321][T30368] 0 pages cma reserved