last executing test programs: 3.772004306s ago: executing program 0 (id=4331): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000a40)={'gretap0\x00', &(0x7f00000009c0)={'syztnl2\x00', 0x0, 0x1, 0x7, 0x8001, 0xc19, {{0xb, 0x4, 0x1, 0x3, 0x2c, 0x67, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, {[@ssrr={0x89, 0x7, 0x7e, [@dev={0xac, 0x14, 0x14, 0x21}]}, @ssrr={0x89, 0xf, 0xd1, [@local, @dev={0xac, 0x14, 0x14, 0x20}, @dev={0xac, 0x14, 0x14, 0x28}]}]}}}}}) sendmmsg$inet(r0, &(0x7f0000000bc0)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast2}, 0x10, &(0x7f0000000940)=[{&(0x7f00000000c0)="c80aaf9e9160f4dda4c24ab35fca9d41c0988939dc01206a0dc44fce9eead0f979802c01ea5d4b66b60d4093eab184594363070aae6436a62c2213c25e47ae385fa7", 0x42}, {&(0x7f0000000180)="606bcb428fdaf20652684cda252d83f7d4ece8cdafcefdd02ff8dd7c0372", 0x1e}, {&(0x7f0000000240)="23eebda28bad145d3c2320d04ac51336f4082f50abcc37f656fa8d2631e9f29cfe1691dc47de9a63b55e295fb54eed4462f462e743bd9b3a03e43560d1339cbc9c606eccb005e455da8efb10949e4b31b344f8019b0c9a1d4af3b9457245066c2e3f51dbf11fc3572237ff4dfc54a0193558172dd8f1b96aa8081e2d01fb1d60ebf3baf6169df0ed66cf2ffd75839c7e9782f7a0c535ea6b2c825d2b10fe4c7284810078742d274a7ee31256eab074f04a23137923cc2c19351cee289e4cb1053ce70f6fab007614cc1ad5c0e7e0d161dfbe47", 0xd3}, {&(0x7f0000000340)="31cfbab7f1ffa1dc951e3c0c6051b1496103823c14f48de205ac005919c4d199eb5585c7e78ae2bb196de5c962e36db25b0b05013ff91f28bf729e268a0a2b284fbeb4c0366b62e9a89271d6fe4ffb1656bb5cf5adf763d04a4ea3b2dc7e5ce342b9516d50ab36b9be352db0e7525602a9a934195080d08c1feb581b06132b08aec1cb835f4ec3657433dd890e8009e15005eaf59b18efa20deea7db7951bc7abbcc203697fa4b54a4490203757b8ca0999227e6a46a501c17613e0cc73b833fa501c45ba898af77e42252adada128464e202e5dead69231fa5a19f4a9ddfe93c8f6246b4628093b4f", 0xe9}, {&(0x7f0000000780)="dc8205e0526ea407a0971202ae32ecd4d486a7f53cd2dc30e920175fea5ea17cfaf1c2ed18215b3c4e4a19b4553452baa7385b67265e464a47c4921e43f989a41b647831638996465f71c4bebc39d7f28db1b20b9d2b047f816bfa0a850ad95433ca9d15dad418f7233d7510", 0x6c}, {&(0x7f0000000800)="9ef81111595e04f4bb9db2298131b61ae542b7716336aa052c927e2f2d8eab1dfb5fb6502731a286b01cc328735f43da15bd92c03f65eae5eb", 0x39}, {&(0x7f0000000840)="d69b693b0dd9ba4d40d7a6ff781ccd01e23e0b05", 0x14}, {&(0x7f0000000880)="3056dd712b49964c483898063e65eab93827da9d775d46769decd9b3c1acd8784168947f90c06b3d36faa897674bae48aec2639813e8a35d1b999e29996acf9bfdc2ebeb2e24b8427daa5584d19f9ab474bf4afb76c335a2932f629925a7caea2498e2a3a10b2d5ea4b3dd82e0981dbf27ad5845a4b9675f496627dab652331c6582b1a44259a03174070e8e1d9c1d3f30a44a99a5856ffdbd76c4f921e76238b129206a45d940684ccc6b65c9215527b4cfe5958c0af7c5190b2e8aeb99efa9", 0xc0}], 0x8, &(0x7f0000000a80)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7c6}}, @ip_retopts={{0x1c, 0x0, 0x7, {[@ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4, 0x1}, @end]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x55}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xffff8001}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @rand_addr=0x64010100, @multicast1}}}, @ip_retopts={{0x6c, 0x0, 0x7, {[@ssrr={0x89, 0x27, 0x38, [@dev={0xac, 0x14, 0x14, 0x28}, @private=0xa010101, @loopback, @dev={0xac, 0x14, 0x14, 0x25}, @loopback, @dev={0xac, 0x14, 0x14, 0x29}, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, @private=0xa010100]}, @noop, @rr={0x7, 0x17, 0xd0, [@loopback, @local, @broadcast, @multicast1, @dev={0xac, 0x14, 0x14, 0x26}]}, @lsrr={0x83, 0x1b, 0x5d, [@remote, @loopback, @local, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x26}]}, @noop]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}], 0x110}}], 0x1, 0x4000) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000000c0)}}], 0x2, 0x4040040) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200801, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r3, &(0x7f0000000200), 0xf000) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x0, 0x1}, {0x3, 0xffff}, {0xffff, 0xb}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xffff}}}]}, 0x38}}, 0x4000) r12 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r12, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r2, 0x0) r13 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r13, 0x29, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x278, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x328, 0xffffffff, 0xffffffff, 0x328, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x18}}, [], [], 'wg1\x00', 'caif0\x00', {}, {}, 0x62}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x0, 0x0, 0x2}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x2d8) 3.49265976s ago: executing program 3 (id=4334): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xf}]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x28}, 0x20) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYRES32, @ANYBLOB="000000000001f0000000000000b4ab9d7ba60e000000000000e2", @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="000000000100"/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000069106b0000000000bc001000000000009500000000000000ef4f7c81f5427c16bd2aacf32cdbb47063fd9a7bb1f3ad622c3261f324e081c0ea39bd16d9869302cc08fbd94867708cb208e22cc0ad536525e3b39869285c126353f6a49bc5abc6b9a4eab313655286ee33a56f03b665dd5f1739bda6accc3b9b0d26450d3161263aed01194269a5fba4553bb18fa1f37e2f68a8ef81f090829d0ee04b52611a41642b31a6fe2653171379cc327fc11e38418b589777f8c8ddcbf88df947a05937ea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000100007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r1, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0x100a, &(0x7f0000002500)=""/4106, 0x0, 0x2b}, 0x94) r2 = socket(0x10, 0x3, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r4, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000480)=@ethtool_ringparam={0x4, 0x106f, 0x6, 0x0, 0xbb63, 0x200, 0xc45, 0x6, 0x4}}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newqdisc={0x7c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x8}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x1ff}}, @TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9a, 0x7, 0x800, 0x1, 0x1, 0x4, 0x5}}, {0x4}}, {{0x1c, 0x1, {0xe, 0x8, 0xfffa, 0x7f, 0x2, 0xdaf, 0x6, 0x80000}}, {0x4}}]}]}, 0x7c}}, 0x0) 3.346116332s ago: executing program 1 (id=4336): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x204001, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0xc884) close(r3) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x25}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000480)="be", 0x1}], 0x1}, 0x8804) 3.274648767s ago: executing program 0 (id=4337): r0 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000002c0)={&(0x7f0000000100)=@ethernet={0x306, @multicast}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000680)='r/', 0x2}], 0x1, 0x0, 0x0, 0x30000}, 0x48810) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x40000) sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xfff1, 0xfff3}, {0x6, 0xffe0}, {0x10, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f00000000c0)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x3, 'lc\x00', 0x3, 0x1, 0x5f}, 0x2c) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket(0xa, 0x3, 0x3a) setsockopt$inet6_int(r6, 0x29, 0x50, &(0x7f0000000040), 0x4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x4, 0xf4, 0x69, 0x2, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7800, 0x40, 0x9}}) r7 = socket$kcm(0x29, 0x5, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x1ff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="08000000040000000400000008"], 0x48) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000340)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_emit_ethernet(0x4a, &(0x7f0000000380)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb8100100086dd000000000000000000000000000000000000000000ffff000000004e204e22043190782cc8fd14070ebb69c75d0f864c5ee35a6df2fbf206589d8a320e6658df0ffffaa8e52f856bb5cac34875c538a61a6efa592a362ecbfead591013a6162317396e173920e9d88589932b161dd6d2b965b2d05e17602bfa3085032f17a6eba3351edccf3472ab9640a97c68f76989f2c99b2208485adef8943008d96ca1c4bba9dfb89774251c1d50062f4de954a6b956953bf546a142c3f479545d6b01c13f58c78d2b36cec2bc995160b60f0bb8e83c6921d2b87b3b72e396b5"], 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r5, 0x400c6615, &(0x7f0000000300)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r9}, &(0x7f00000000c0), &(0x7f0000000100)=r8}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r9}, &(0x7f0000000200), &(0x7f0000000240)=r8}, 0x20) sendmsg(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000580)}, {&(0x7f0000000ac0)="07d98d396058a855921d034d0fb8034a5317ce586c382c8d41f8212309f82dd261e5f9263338a10244d7b49f8608f304ee79d951cd4ca8c44b84d8b2da6feb009a0d53224f69c7a037105aa12b36d0f2fa926dad5b4a129773ae0025ee2dccc42c4cc23ddd896f77e5b427f7950212eaeb0dd9c789f8def4d9fbf6274bbf72f31c5a548464395d9a68564fc12ef2196d7eac2b93ba137c89c360011aa0c15d2a0db9dfc760b6e069968685b051123d404ba4e94ccfdfebeaa7a30c8de388e00edff56b0c6968ec98e00ad8decf9dec77295a37e60510e906474b55034f7f6594c92e49dd422bb4346631b852e64add94f0ee30da8e199a89d8969df24601639c324ea084f8b00dbb3322aa7b1759fde71e4279841257c589725c12070d0cd41423d566d8b73b2936119519e31f4c8243e9207e688e77550867081b9b685d277a4800", 0xfffffd6b}, {&(0x7f0000000640)="74a892e6122d0e9da29a40f6060049f3ab51554d", 0x14}], 0x3, &(0x7f00000005c0)=ANY=[], 0x158}, 0x0) sendmmsg(r7, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)='r', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000010c0)="f3", 0x1}], 0x1}}], 0x2, 0x20004841) r10 = socket(0x40000000015, 0x5, 0x0) bind$inet(r10, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) 3.190380126s ago: executing program 3 (id=4338): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) ioctl$FICLONE(r1, 0x40049409, r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xc, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b5af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001e00000085000000a000000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x2f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000003c0)="12cdde26e7c496e99a9cf8625ec9", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_emit_ethernet(0xba, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x8, 0xac, 0x67, 0x0, 0x9, 0x1, 0x0, @dev={0xac, 0x14, 0x14, 0xa1}, @remote}, @time_exceeded={0xb, 0x1, 0x0, 0x0, 0x10, 0x0, {0x23, 0x4, 0x3, 0x31, 0x1, 0x65, 0x4b, 0x6, 0x5c, 0x3, @loopback, @multicast1, {[@timestamp={0x44, 0x28, 0x19, 0x0, 0x5, [0x4, 0xe, 0x3, 0x6, 0x7f1e, 0x0, 0x7, 0x3ff, 0x6]}, @end, @ra={0x94, 0x4, 0x1}, @timestamp_prespec={0x44, 0x3c, 0x22, 0x3, 0x8, [{@broadcast, 0x200}, {@rand_addr=0x64010102, 0x8}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x73ea}, {@empty, 0xffff}, {@rand_addr=0x64010100, 0x91f}, {@private=0xa010101, 0x6}, {@private=0xa010100, 0x2}]}, @timestamp_prespec={0x44, 0xc, 0x1f, 0x3, 0x8, [{@broadcast, 0x7}]}]}}, "f1c002b1"}}}}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0900000004000000080000004000000042000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYBLOB="0000000000000000000000000000000000000000000000000000000038b5fb7e6914dfc093235457f25725b81019e5d061ea6f5974b145500c8a5ce3bcffc9853267f44afb8f5de862d03e3bb0dda8c68f15d40cd1edbaac9d5a05906a4786bbfb5ef8312a53d79fe6e2e7aea4b93b8d"], 0x50) r5 = openat$cgroup_ro(r1, &(0x7f00000002c0)='cpuacct.usage_all\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={@cgroup=r1, r0, 0x31, 0x2018, 0x0, @value=r5}, 0x20) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000580), 0x1000, r4}, 0x8b) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000001600)={r4, &(0x7f0000000580), &(0x7f0000001580)=""/92}, 0x20) pwritev(r4, &(0x7f0000000700)=[{&(0x7f00000000c0)="ed0b993c1d928eeffc81da23eaa65fc5cd2d5f77ad47bbe484a28ccba37a60b4d192e5", 0x23}, {&(0x7f0000000100)="bd533e1c08dccb2a51a34c931e28101b595f8783fb9cbdf9fe3516685adbdba727a3fca462026a2a3b24cee8f5716a96d00ab319655474e0b261a760ae0a893ba5701039016625ed4a101ebdd9ecbab828be9b985c1aa9968bcf30bb86ddd28074fa27cbfd83d29f9416cb39f7a5e4ab2eae556b818497447c66833657da558b16e497c47724433e231944932597e9a672000fd54fe4626ee257f4070c2c08c58083d7efa68f0e2fa38c50c5eb908976daf24ffa766b93890aacca36918fd692414a726de079f624cbc4f02ff4f6633a9230509c44f71a41b58d357f01b5a7d2656277b5ad096d6f4e5515fd6b", 0xed}, {&(0x7f0000000600)="7762aaebdedbf3a3b44164eb3175fd64f235a24e343708cd6f3513a2ecc57c599da9cc315b7129162f9ae66c6d8ca0887036b85e74a41273827c2ee1d51f4162c2267370aee2d576676816e1f59491d33d761962b6ad54141592a9cde4d1cf8262588f21feb1cc5277e8b195c0be15913f62f94fee6ab903128d171e1c5f31f750907445299d17d339f2d1e055b4cfc5cff67a8cc5bfaa729b298c1215be344e9721c3c413e78e7273f1a610473d133f4a57413c80937ab9d06ecca7223cb86d60d95e48e877c86b136b4f2ab3356dbcbe4acf28a0495f3b88925d42d3d77fd04acb0a007eb67a70fd9f040d1e50fdaa1cc454f378", 0xf5}], 0x3, 0x9, 0x3) 3.131184361s ago: executing program 4 (id=4339): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r2, 0x4) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000000)="d80000001000810468f70082db44b904021d080b01000000e8fe55a11800150006001400000000120800040043000000a80016000300014006000d00036010fab94dcf5c0461c1d67f6f94000534cf6ee08000a0e408e8d8ef52a9d7c7c0b7a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52a9ecbee", 0xd8}], 0x1}, 0x20000004) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.063960983s ago: executing program 3 (id=4340): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001700)=ANY=[@ANYBLOB="b711000004000000bfa30000000300000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff1d6405000000000065040400210000000404000001e37c60b7040000000000006a0a00fe000000008500000032000000b70000000000000095000000000000000ce0de7621e5e832249c04112cf7af2b75d0d1f034b1b3fb6bd3ce8fa62c7941272ff49142d860010ab162aa2264ab67e55a00000000000000edfe0969a9ddc125b686a1e83c8790c893d713b3295dad0ea697181d1e85b64126b5d72f204754d1d4a93f24215dee354e93cfc3f50ff23f8432c72012f021c84c59a9d4c142f439d3040cfee621589fb3a2f1407c7cbed48e7026f8d52d4bca2608c79aa4a73732028f88ce07ed1075da4a2ef44e3d8b88873f0b1de87dfb6d15936ec0a27cb554def9e27396df6b7851ffa26237ea6730880f06371beb3b290b7d8629a6f0373fefa0acb60888fc14ad2b83ca03ac2aee792482ced58af4140cc4ce3efef26e00c5b2200a91cb80c6065a697d6fc8aa8b65aee0783b04cff0218ce82c9687b4474da89c474c23727555fc5e5f8ad0f2f7a261140440fce1f12cc6df312accd011d888384283092d987c40bbb46f68c2431b97906f00000000349834fa147bd5923bbd4e606708034931a8f1a89bdf77093a0000427aab8e21e1a33d3fe093547532fce6549dd648ad233e05a7b3ea178007c1c32e871ac81f287c4aabbd153390b16d1d41ee433e3a54ea9ee82cf14f3a4cc523ee000000000009e106d6b5289f0000000000000000000000f7bc9f46cb71f6b889d37807865e3b4e9916dd0f72c9d58ea333b90f8886dcbf5ddda0e42ca08e3303632401f2f5212b40c0e88c957fd767dbfc80b07ad668b4f6f92fb209d7c2dbac597843c8eb7bf92fe6d0bb0b72549795c2ed19e441eb69869844152ba9da0588e42cdbc5fcd245ce5e3ef0dca64931276702a312db7956f0a75eb9caa17d47a6331c7c963cbf86a845ce27c26b7136d3e7207318b1df7a6320c64f18ccd926eaeddcde8d5006d6c38db117fb1115221a66169172720ccca770bff37e59511b2606138377eda44b2f288b491ab8aae0e11a98303b0e407e0f9d21f4a3ebbd3fabf6da9a1a1f869a339fab465d8322b7280b0734fd115a19b33c8644fff71b3c62f2e1b827e2663e06a751182e968c8ab05fb1d0115d4b11d944f2c06acc023a02b7416a9a10218d21503cda13bb5df6c992e52e1c01793b728eac000058ab3b3900d279297dadc127e2f38fc60c23af2e1fefa5a83456647191ba1953d335f59aa261fe79613df6bf43884e9649691e32680d75a541c27ffe74f9d13340f2cf1c7dc2b7db01213216cd4ecfd30efe137641471987289b7e23482e026b26eacd1b97443e2ea2d1d6e31a01ee0ae7fa195a2152b2338b086423a3883f2ce3e2f84e04f4d52c985eac4b46336908599564b47db0e6aa97ee51a360f4382fd99745725d44c77d097f69d19fe86f71c38a0226d44ebe0ecbd959f14b540745cd03b8c9f02b825ba45ca85706c73115f70871db9d2a1bc2a517b39f9648123917a5db07ba4e27f961373767e1ea8f7cc558e483abef1a9923c5cfa2081e430680950b7d7c377726b557ad31fdee17ba7057741f39d29d8ab295222f96297a777bb235416e72c84afef2bdb08fb375147b028b89f15af45bc8976b91158c13c9876daa71e7db0f5a17376be39ea79ce1246c547c740e31c64e5d293e0e5a544dd166010061d6ccae46c173b8e11721e4bce22c96af00000021f80ac6c3971006db853e3c40a5417d6eac09eb0e01ac6bd4c6dacdcb1d6d2ef9c8bdea91c984022821e961236d08f8b9072ec6cb5d5a68833fd5b4e80a5ac2bc6ff323f5ce612b59ce8177956c1affcc8baf4c8b59ab959aff9a7bd81f7c7c1f1bb92ddbeed6bce8041c7f0c1c584e6ae027678ce3cfbfea938aecc3c5119c5875b7fb35dc20f5c7aaae1e276104f607a73fe501c1045873a2b1eb80e95c87f099d98028dc82bdc7ef08c871fb3061c3c5ebd613e6e5e8cf099bb6e8c0441a133c85138b36a02c47fbedf7ed1d3ce74c9ec2c676c0b2d4b5eca61dbf5769b483c2a9f6bec666dae4e81960e9bad7f17cfc3d5bcc7b7f437110ca8ffa908c12086b2227eb202a8d56e0925ba994b05c98c39de44d25932449ddf08e5377814a40877eab4440ca01b3f50d2014a61a7d32105254b424238122386424efa3a7041254f686a5faac120942287f75e8e3db569ce47b120059d774a37e11d013be50cd2cbb00f6d2a23af61ec7d30bb7dc33a92f900b6ff1d29dc61cc40b846040dbafd00c6bcfbcf7af8ea5b4bd9593f73c6c95dd6d59483763debf02ea36803976b6cc145338e1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffffe}, 0x48) 2.978382252s ago: executing program 4 (id=4342): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000006c0)={0xa4, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x80, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x40, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}]}, @CTA_EXPECT_NAT={0x10, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 2.884324029s ago: executing program 3 (id=4343): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000001c0)={0x0, 0xfffc, &(0x7f00000000c0)={&(0x7f0000000880)={0x68, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) 1.126574465s ago: executing program 4 (id=4344): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x4}, 0x8) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x4}, 0x8) sendto$inet6(r2, &(0x7f0000000040)="aa", 0x1, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x8, 0x645}, 0x3c) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000340)={'wpan0\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[], 0x48}, 0x4, 0x700000000000000}, 0x20000000) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syz_tun\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) (async) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x202, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {0x13}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29c}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc804}, 0x2) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@delchain={0x24, 0x64, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xf, 0xe}, {0x0, 0xfff1}, {0xc, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008881}, 0x41090) (async) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@delchain={0x24, 0x64, 0x1, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xf, 0xe}, {0x0, 0xfff1}, {0xc, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x20008881}, 0x41090) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$netlink(0x10, 0x3, 0x0) (async) r8 = socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000400)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r11, {0xffff}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) socket$netlink(0x10, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 1.10987552s ago: executing program 3 (id=4345): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x5, [@volatile={0xc, 0x0, 0x0, 0x9, 0x5}, @func={0xd, 0x0, 0x0, 0xc, 0x3}, @ptr={0x10}, @const={0xa, 0x0, 0x0, 0xa, 0x2}]}, {0x0, [0x0, 0x5f, 0x7f]}}, &(0x7f0000000240)=""/28, 0x4d, 0x1c, 0x0, 0x4}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000600)={r1, 0x20, &(0x7f00000005c0)={&(0x7f0000000400)=""/191, 0xbf, 0x0, &(0x7f00000004c0)=""/240, 0xf0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_VOICE(r3, 0x112, 0x13, 0x0, &(0x7f0000000280)=0x2f) setsockopt$inet_int(r0, 0x0, 0x6, 0x0, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x1, &(0x7f0000000700)=@raw=[@alu={0x7, 0x1, 0x5, 0x8, 0x4, 0xb84b276c65e63ab9, 0xfffffffffffffffc}], &(0x7f00000007c0)='syzkaller\x00', 0xfffff153, 0xd, &(0x7f0000000800)=""/13, 0x40f00, 0x16, '\x00', 0x0, 0x25, r1, 0x8, &(0x7f0000000840)={0xa, 0x2}, 0x8, 0x10, &(0x7f0000000880)={0x3, 0x8, 0x5, 0x280000}, 0x10, 0x0, 0x0, 0x8, &(0x7f00000008c0)=[0x1, 0x1, 0x1, 0x1], &(0x7f0000000900)=[{0x1, 0x4, 0x2, 0x3}, {0x4, 0x3, 0x2, 0xa}, {0x1, 0x5, 0x0, 0x3}, {0x5, 0x5, 0xd, 0x9}, {0x0, 0x1, 0x0, 0x7}, {0x5, 0x5, 0xc, 0x2}, {0x2, 0x5, 0x3, 0xb}, {0x3, 0x3, 0x9, 0x4}], 0x10, 0x1ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000024c0)={r4, 0x0, 0xc8, 0x3d, &(0x7f0000000ac0)="b3f1f02783c068aa3100e5389ee1c3d51bf7640f0fa451376be35ba993ff315108ff9428602f769144bc8f7ebbd441edef1f45bbd6c2f0f511dd97467da23b85174b39a5b99e49bb76868c9ed30c3da503fdbcd7df26a3f5a3fcb591d56193279be08ab330f13c7a240f205dbdf69d2979ae91d02e2e4285473fc6522c9d47817aabac6d7c1f8699bbe7b092897522fa83b14d3e676b20065279bb327771d04ba1c4a34e9323b7afc12d703fd3278e587a27aa2a68183ebbaca65548f3edadcc59d49e40e45df3db", &(0x7f0000000bc0)=""/61, 0x1, 0x0, 0xb9, 0x1000, &(0x7f0000000c00)="2475f011ec319689d999a47abbc54a4e6fb09b358603263569713be8e134d328afb06664b28e908e08c1e1c5a105712c27bc2947ca6215edaaba3776e422437790f4b97c0a1ddf150d180309ee68f8ee0c9e1f32a8caed785efff2cb337aa8ba3a060ce8a84b0ca9034639ad1f3397795ffcaa9b7e66cdfee9efde726ea3ad80ead87238c89c02ba52ebd3a1903d4053cd6111d0d1015f181b6505628afb4071c8644d6c31f1f83f5490e920d0dcbd3b5cebe90a059d1f40ee", &(0x7f00000014c0)="b1de6b1acf3bd04a8352c242c06d80fbd16fb4f8671af69d7c75d8351149a7ab18f71a6f9c74e86c820c01398ed9505ce46411f561d8fd6120f1d93946fc3b7c3150fd3a4ea4ed4a8066b3d752a6a3752903a8b468efc43888d6a129152f5293cd54755d3aaa91a9012fab04c7827e7ff1b7f853314b7521cc87b98ea7c4aa39536d51555032a350a03133a0aef7701402fec72f21d4fa1875c4488e8baeb57bc62950c29c152f85a6c7bdf11bb510a92e87bd87b0db053463977dd2168963e3b77a67469d3ed0729d6b69cdfefe04fb3a21959ea76d99dbe3fa9de7f3f1cd9676ab34a563dd0662073de4bac2ae6436b493fbd59a2893c3fd76ae87bd10652b0dc0fb02f633aed9ff177bb6876c1b8706c829a4bf89da1a06fad94ee09479bda1d56c70d0464099921f718dc7e6ab3bd2b3d8a422cd6524e7a71b21964ccfed865e12a2c690073fe76730a08c739983feabfbaaa8cac374e33c4d636adc1bc670adb4f6f2cf5ae43fda4f5c5c8da022de6e1818abcdcd4858c35c1c439aaa0dd76bdea37d9a63b4dc792e0fd69ab15706ad42ef96348f972bdd317148d5c4a9e222b8eba512e6e6490c4d2127302871401177bf72384bb688cdfd2662579ef1de01af6c381640b7c2f4258694f84f05e828a78f02c6869ad4b35914883675e81d7d99269261eaa3f8c210aafff6fabcff6f994043820faf2df5b642b9b47a98b05d4e35dba6113c0f0a1fb1cef7bd845ea53a5affa1ce2c40cc1664a666de8a2ab449147d32c2a3b608b42c3ab43509fae2283ad2e117129bf2388df3cd4935361325a00970399716dfe670b2806ca0c943996f8eaf9a0ddc06a81f18d7f44b6169c6cbe5781547c7a57e0ed1ead7ec3525a51c11e96dd65a171061a60339b81af8ddb58c933a505559fceaf594f78f71e861407c7afb84a5b6b3750b1217e3a704e89094847e10fddeb48417ec4aeeac8bd721db694b6ebdeb3563507ac3f6c5b56eb26904e14de534d1c4a8e1d690a8d654e1b7ad370c3f7c83cc4a3f31a372397ef7c2a61726cc0753080bf84b78e6e5adbbfb8d795f6840509c58b572c1e54f3235567307b677eae6d1f8ca5ea81f6de4fe10e0da74d38cdd363b31da75ffc6ebd799cf136c98a99a1562aa6118acc053f081160da59d54f0a71d084bacb52f878b17d8441f4f7facfa3b5703fdc932e8bfc99d34370dc467a48017ab7a61c54690a23c899a2458bd2f8b345efb148b0d8654c0931b41a1f45fa24aa879c1a2957663518300f6cba5d848513e0b6bf29c0082f2b822f7717b9236c5817ded838b27d083b9e2ecd6563fe8a496158fa3ae905a57f9624c4b421e6032b2bb9c6181caf1354e8a490c4892f1f19ca164ddcd197f364d3a104250155e52eeaefb8779d27c1b6114856d8b5a67fc963851b429152c523e4303fe789cddd0a22d9a9fd052cee173c36bb66278cd8126b2d35d0fa46da22990837411492997bc3ca9cfda1c1550979d69f813712e8a37c39da755ee9e1f6ae71ff2be224bd8927e9645e6e6526cba0567aefef09e18c44a1c4e70cb0e2788711405c266afb6f0b45a1767c466dad943412d76369b3e9b091f9b1f46327069c9673bbc639569bf89af5d9f8ab816634a24f5cd2e13d854a35beadc68577a631ef22e5998a59187751f9192a571bc89ce01dde22d12a3654ac187f21ad66b9096e994f56f17dcf0f77e556e94096f9fc008cb5a1309381fe7e0427e92b35e0ca8a2596eee952aa9b79942925aadba86a2940c2d46a955e260975cc7f54c789f06ca38e2976c7edf3e3c3944bd99ab623b22b882908828bf4fb872c0acbc1a5030aea119b2f29077eb67410f78a94fef0fc55438ba2b00276513feb191ca4c5cd71aecc55db0602ea9fd1c9e1795b54637ef72fac91b965078634301e173cccc2246b84a57a510daaa994e84c63e16ddff5cfbd7bb300d5e10223e1678a5414fadd01e63b26775b39bcf0b73b91545dd027302501f0df7826b4a034e21a0c6bb009e149deb365e8509d2e376f3419c99b39d9e2894f0a88e50a708505c43a5f3979369816344bd1ec70f071895566006b5eea6c480a376d704838bdbc3549c8be062fc2bfd5eb1b1e18976b8e1e4365e02744731b640d43615a93643154c65dc7e130f9f630b2ad3cfe323839879065b8bdd2078cb3c02936ee1eac99f15920eaf8764d7e2c33ae45bb13a3cb1e10aa4993df6330ba48f32dcc9355b8faff689ff511669970d1aaf23ec8dd02eac2b61e244a5462d5947987f5e2631cb6ad3f94a35670fd89abdc4eb183496d0c3e78f37d8a83017d9ccc2ad07a9f3f26867a761736e440153ed4a08e0fc5b2bc83ddfb8a6e390923d9e38514225f911d9802dfcf431249bf89f7618b130e9a08d5acc23af9d053c04fba9a25842ae851ac90eaeb86005d84be05ce8680eccb7361ce835c50a9f1ca1e0c73d622f4d4a06c0296ef0ab095ae962008761221693d9b7e6b0d62f2b3fd5b3540dcb65de105b48555031cde0d648c74a55a63cdcb4d2d634de5bf63cb10771749457d63d5a04099d4420d28f8fa82cfa12c4507ed20fb453167be178e01be221c49d2fccf010eeb347f3ace5c9354d46cc1e5c90094936991d0c7e5c13ecef7a467fb3831da64c322b1a273cb3ab3986d5b9a3e4cb76cc0f1b03b8f79700590d7c5dd8e052ea13173ed9f25b23a851b82aef17219c4158776cb5ac2870017a525d07918d25782514f9a56b4141f26b48356ee13d8ec720b81c6feffb40324818d95cb2125d6c5a7d12dbfaf5ab4ddea643f1dc09ed9bf8c86aa9901b36e5a9f07f277f8772f886c9b95329bc0792557c9748d5e96390e3c29c7040cb16516bce4a8baf44b75a95b884c4741b629e5bbc27f142581facf4fbf2ef5a62d17fd618f15df7981f59c56ec848dd59816f2538849c6f6c94ba0bbe8cebe452330580307e9e9f13d36f9a95b512a6ded791cdc4ab3b5610b1276ff1288f2562259e6b63f0026172dc6f26b4ad2cabe2673dc0be5e6a034cfc2401d80f4c92f379b63fa868bf8242f95e847c9680da9bbbd2e5b5beb69a8ac25c8fad55340dfdffb2da2d81604ba7d193ca58c8821f43358ab19e3eead8bf3a51d907589fec989b888beba65ca0aca762c06aee837ec795fdf633300ef283d544fc9255bb0c12ce77108caeece4ce725443593cd8ee916e232fb2d07b82aa4fafd73f6f9ce4bbf9a6cba7bebc42e7c2e4bddfb7ce95dcc3b6c7847f7a7450d21226b96722cab01f5d47fd146a9fc773e8baa2b453f432adb1dcbf80002aafcf3c42fa33d2e7f9fa6137639bb4eaba7254e379af37f43e3c96050891a1b433ed8a554a6be53ee5b48ae6db90101a666bf97cbf22f56ffcabede8c00a2cde1644b3a40410a3695de9d9b2541635a75d5006c246f8e1dc229ba5b0516cb83e5551aeb19bf777f9bab69df4aa53ed838b9ab010d6a00119d6324df8a64cdef054f1082ce76447df32302404f81ef26df6668783052280dc9f44d40e60a449406b237371dc6da67b16c8ef0b739108ef446de85c3a6b47162fba20303a7cc50d8110caccb00ee8005e93e9758db96209a82375c3d1e4dbde25ae65ee0015a0fad1aee29cd94fa6c9d50f0bcea1e1328dd1bc2c8f3894611775fdfe038aeef1738c636bb1254c446e2b1757a25be7ff879ca75605fc4e5c8eef8c50ddceac719d4d4a551780e9f0020b8fa864509341e56c8d8342da0fe000a0840f470eccd269391360f56faf7c58407b8205da1e02c5fe7009216c4cedfceacd0f1136f086a13b185bc44e31dc340f281bd52ef00ccc12c4ec4367ae9e56d14c83619fe5a9fd34b209a23865c6643f759db1e8a9ae50cdc417bdd91410294670f0e36362213e6a1a675f9352b5735555847c7620268c3ac9a7f0075d484136e8ada5c9292c93b1a1fc96b16f784516e1944eb29ac76cdf15da2294332e2c36e84487b378912244f9fd7d1c70d17479ad3950955db54ca1336f4d8a5dcd6e5fd3063ffeafd3b56216b9bee5f4a173e6ed0d8ab276d3c0e5e1a6c4edfd3ad6dc4e470973d76aaad74b7f9575983218889557f79c8bee5860320735cf4e7ecdc6c1572de3cb0791b77eb33caafcd99020fecb0d5c786c99dd22cd03a9c2a4ae06f2584286da49b1953ab304553e34e7f74c0472adeadb401390fcd57486261a71a52e2367d0a43fba9c1a37af4dec840a5c335ef1b0ff10692d2fc9c42ed5c20f2c5d5ebc1588c49480681bcd7c7d6d131f2244f9980a7f8f70ddae57752ed80efa06d5e92f5e7cdde87b42e77f5603f7d4dc57f8b7adb72d62b2d336b2894f7763da3b9a908a1c5ee841c287db12615c5aed3ca5a6e68788cb7d03a09c4c70b94dbc99f4de9d216f15a44cbb31d9e4374ede79d0079e18224b72f3292d0ad02e071d4806778455d0b0ad57d3d6fe986ac6c3d5c2d5e112cd4d0f507a517757c6ed84580c3c85c00743cfe084761753dcd190f80e1658d94ee40decd10b144f8e1e0256fc4debf8fd48d4f34fee31cfc65d95b4298662e559eb40af53b2cc2374472ad31f1e88288a69a87cbe648932aa190a7eb7a8b510cd3ddff4468f4e8c081aa3412ac41a3923ca229e794187163e9132377dbedb86349ea2d468bb79683b223159357f394697ea352be034a93e002ad035c6f5fb7041c92ce3f185d527507b367c3da2b5e1693704ea38fc16c8c41514c3e448e157e075a51bd6970559d14c3e509fc7e450a2f02a1055550fa1c63dca33b91a6ad8ea1705aca9037210cce5f4a7a3fc9a50ba1fe12362a27220b2c255cfe3cee4646aaad2428a02023580ae4e774d54f7250ccbca2bc14bc6f005ff3d19b5c28926f37690593e52e47626e2108ea8e1cbbbf007a2f3e1727ffa3c9ca9b4ccd00dd1daa30dc2f189c50d1e0e67088b93303931d981b64886ca54b9cb3ec65f0d76e85b919f78ca3d314ff40147ed49be3a6d8f817a89f020206e8ad32700b9965df75bf1cecc611df08d0997d3b812c67070c0e7a3f8129ca370b44095de4411bf4dd793bfa9b2074f1ae42e4e37056a34b60d5b00db31dd09e08383da282c3cb21f0f9801c9190ebf26f52274d0d96c0c75d84991739854051878f49138e8a94674c0809e8285842e1e9ccc13b362189748c0665aec2c00076ae5a93cec5f50b3c8b36cf218d6ebf2e9848dfeef606eea424cac6d5a1e9c635e906debf31e33dc80f18ace6bc70dbc7f3ec29931f853e3f93c98c24c8a18361bc5055ce19647faee0762facc20eb43ad0159e5af2b5126de8188fae098ef222fd4e1e32ade6ca6fe87402afc08bfde90413e234b03e4ce7d2b2a7223eee2910e2184fa5504a29888519d6e4b950470af8d8c29244da58f5a3f30e41ebb92edb7eb9e4bfd3e74acca5c0196f6aadfc018b7df13b4fccc394ab67f107e0d3b3af934eead05e0ba7b01f4ed4f476b7f6a11fa27c505ed4675d6e932377a0ba024feb8275af18fb4f240147b1ef92f11bc403baa4dc7b822efde5ef6ac7fb62fc32e486c01d9a85e89d812ec4a4b72022857e51c257a8e14311dffb8562b15edb3b7ff9950e33741c5cbb8f1c844f223f535abcebd8bbb03847f701b9b24c0d7af82bd08f5524c632bce1141456c50fd280301baadffde3097b40ee9865d6f920cf5705729c87d10b5908854cb85e29b25a2de2259317fd692b3c9516beb47ceafe3907e57d90d8d0bc1f4bc84b176d359b8f03213a237d05d8890f4904fbe14ffac4c3641f6f45b766afe4cf2d5a880a00bc553a7d6916f", 0x4, 0x0, 0x1}, 0x50) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r5, 0x6, 0x1, &(0x7f00000000c0)={0x4, 0x747, 0x3, 0x24, 0xfb, 0x8, 0x101}, 0xc) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) getsockopt$bt_l2cap_L2CAP_CONNINFO(r5, 0x6, 0x2, &(0x7f0000000000), &(0x7f0000000100)=0x6) sendmmsg(r5, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000000) r6 = socket$inet6(0xa, 0x3, 0x80) getsockopt$sock_buf(r6, 0x1, 0x2b, 0x0, &(0x7f0000000100)) socketpair(0x2a, 0x2, 0x0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000"], 0x48) ioctl$F2FS_IOC_GARBAGE_COLLECT(r7, 0x4004f506, &(0x7f0000000640)=0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, r7, 0xa, '\x00', r10, r1, 0x4, 0x0, 0x4}, 0x50) sendmsg$nl_route(r9, &(0x7f0000000980)={0x0, 0x60, &(0x7f0000000180)={&(0x7f0000000cc0)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x19e35}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0xffe}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1a, 0x1a}}]}}}, @IFLA_BROADCAST={0x0, 0x2, @random="24b328b87330"}]}, 0x50}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/syz0\x00', 0x200002, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r11, 0xc020662a, &(0x7f00000002c0)={0xe8a2, 0x8, 0x3, 0x4e, 0x3, 0x0, [{0x401, 0x3, 0x40, '\x00', 0x2}, {0x7, 0x400, 0xfffffffffffffff7, '\x00', 0x3908}, {0xffffffffffffffca, 0x2, 0x80, '\x00', 0x80}]}) 1.056975704s ago: executing program 0 (id=4346): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xf}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x4100, 0x840}, 0x0) 1.056674297s ago: executing program 2 (id=4347): r0 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r0, 0x40109441, &(0x7f0000000000)={0x6, 0x1, 0xffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f00000000c0)={0x4, 0x747, 0x3, 0x4, 0xfb, 0x8, 0x101}, 0xc) connect$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) sendmmsg(r1, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20000000) 1.049966279s ago: executing program 1 (id=4348): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={0x0, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e20, @empty}, {0x2, 0x4e24, @local}, 0x5, 0x0, 0x18, 0x0, 0x3f77, &(0x7f0000000080), 0x4, 0x8, 0xfffb}) 966.577927ms ago: executing program 0 (id=4349): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="1403000030000100000100000400000003"], 0x314}], 0x1}, 0x800) 900.892856ms ago: executing program 2 (id=4350): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001cc0)=ANY=[@ANYBLOB="b702000000f0ff00bfa300000000000007030000f0ffffff7a0af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd844a954b26c933f7e38e52c997b03b72b3d0ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da00000080f24bf901115e17392ac66ad029d1c00000614600d53daeacea799a22812a1b3cab4d785c908c54f7a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b48610e9eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c2815df09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa9a1681989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a62ec45c3af97a8f17da954aff3ec8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde0745db06753a7ac70af2df2c772b0031fe13cab6692402a47e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cac8b4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf1301800000ff14a99202d9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ec7966130b547dbd8b0000f0a77fbcf2cd1d0000002000000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf90040662d7836d252c566f5ee934c679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f64293091c989f72dcbbad3fdcd6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5d81e750d506d7a59a3ad09e8802e8f4f535447cc0fc9d5f89a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d3fcd11642d5577fb9030036bce9c764c714c9402c21d181aa0820d89f235a3f1c5fc853e59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa809000008e1d41e1dcf6e6879545b92bd49000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84937e859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af40fffe0000000000749efd3763655500344bae34137f5ab0d534b8d43e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b850580994484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b00cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe44dc87c92332af00f191b66b6a6f7323e8faffc0886f4af7fc100dcb39c77a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a437367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85cff7f000000002c331fca0e541b7ca211c28ed61c5257080f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce4616d42b07199de8b99231ace58c77819ee2b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e604bae6b13df468ad87a6c769f952283a1f4e3842edb3d40c68a2001000006dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa671e934e94d1eb3de6a5f99f301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6e9a84aebe6e6e79900369c17b0ed16acdce1b12b70000000000f4e8cdbadbec962a7edc91c6b80f53e3b19c372e40e2139ff4c1180365eb5b71d834eb0293e252b96e6c90ec4d23cc42e88d262c1fdc317c7c000000acbc1248f2389d7fbcc10a377cc4e28460c0516534bdb3ff372bfd94efa0d32b214b39cea885557d39265a1c5e08c29914db042aa4fe23a92f387ae6d7565d3ca6ceb040f859de2e47f6c04bc55f3b81249faf3a505ac0d29e053b9c1832e8a25a54ae433e43036b032518200e2875736fc139a344bf3bf4d8f6f57e5c4b7f62a23758cb30e43f1974b14d4f3e1a8ce71995ce28564a50f418af2b6f22a7c70c2213ec629288604aa1a9f418487c864af9368a08bd37eecb0a810c5c24d7a82c07a8e68caa7ff2eaf100f6fd4c3af07d7a86b34f2f4d34abf2f92f1a41a330a4e8fbb4876393b38f79573cb53c263090d620a37ea25cde9445ccb74ebc22156465f4871436b44981455eccc221a8251f71c047203ac4d62b0012cab329a5d9003ceff42b007aa61880da20b0ad83ae368a19d2827840b8d00f92745508e63cddaac6d2d3c6cb03d512c5be9e7fd86e461e1e6a228e630029dbeddf37a6990c75ff6dcb6f32f61e59e3bf97f48954fd7908ab05e74815d909548b277bf5c4570eaeb265f4ffeacc3a4ec2edb261d53d09ebb6bdf811e2a4ef0be6392d86a5285a7fd2e4345e14786abafdd4852d3d62c334760c05e1bba37d0f0742c53242596e13bc22682ae15694aaaadef41bbd7185b74feaf59dea096a23a48c9eb3be5c546eda0f4b07916ab14e12839318e953f15fab94c9ba783015ebb6983d514e3b1f246f0a63c5a58cc2be0cb179791ec1b9a3e7e62c165ae39855182266b36ce9d2943c49a7f9a2a89a948b37f2bb830ea790a2b2c2fcd06bc499434dda842cfa91b2df4368f07eb2410aa387d146bccd22698f8f322fbdf4cddf11fd3b85325af8df473c8f156833e5488f31165e6a56d4c1c661bcbefcefd10f47b2e593b836be67bdc15c3b7fb497ecbca1506a577e81947505553dfdfe963c20c12575c4abc45cf9229af181317fde5262a73600f90e7457280ff4229507178c5df9acc273a7be76f6596b2ac36a2d28627e0012f989d7f7a20f2b38eef5efc339b8784ad5fe6fac77926d83a73e3647a6351c23d7e51cf459e5d169d42566b012193338f67612c22eab89fb14a40edd2694696048f9d51d26fa256eede4a9b5dd3508f9308883194ab3b0661d51b18dbdca9b5f70a91db8fc9b19291664eccc8274340eef00c743588b0ae4e7280db3b7bce3041a5bb9fced08059a2518eaf35df7388a518965a9b4c6ee27872be887b37319370a4587e50f28060b963a6e4d73b338f4e8929bc5ada66b6920c633119d17c090e72daa679c6e5bb155710679660004705fd8d4cac660fc32554a20feb5d74cafe562aff12fe126abf5927205867d5fca4a4ff8c7d0933cdfaf5864f4dae435d1ab9e711f48cd03f4cc130b54e18428341e675968ac19509fe7bff5ef0e55d71987e44027e29d02ac36f3c486bcf22f86170cbeeee2a5eb3adadb7d906f25c73df5cd22a8d1ca00b027a1ab966ab4799e631a21042685fc8c05d5e04ab21a66c5f221dabdac52b43a5980b1efb49d9e03d05f4d1a8756085d0305ff3c4cec8500000000000000000000924f7fdfa25a3331d13a50233f70742f16f6e13bd716905299ab21864ec9d3a93b1de03592b73b327348427508a2dcb953dd23e42adfc18fc891a247ba5c7ebd7fa6da7e3ef3d11d4b1bb534b48064aed03c5850c12abf87240b65221a64ec331c31ce394dad6142619893bff5c810f53dbd875837705ad5139a31ff058aacd51eed21216e0bd179cb00bf02af8dc25be8f318bca707c05a0235b86f37606e1cfbc9ee5cd9741c7648713b24107697039cc40aa538c24e8934cd88238237b21f0a901c488c55178984597ef91e7a8d60081cf34081b5df32ef9a89a25203093b8cbb5cd416d189cffcbdb6a336e3adefa39ea04e2c425864c766283829db5c2beb709da87edcee6b682f18abcac4fb9d785beb2f840079b54dfb9a8ab1a6bf4eea20bb51804ec3d3848bfd11ba6a42bc2823559b70eaed4c673e0e834611b6fec4816ee94c62e88b13037d02cffd561f9bb97d6569114d0e6a7170e229ab9e938c18a568184bd6759e5c3526fbcb46da794c5bcb6303f8a4abfe0d37a0d757c686b0b5171892f867020778fcc567a21b04e684e9da29e86c3e392564f93b38d7bec00e82cd32e2a521a715ae603c12ff286ca67757d74553ce8607a1c5c4856e50094904bf08ecde97b7c513bf64252e839439b65ae0125fd8e9c6d142ee7a6af20cd5370396db6f616fb9e5a2824a5cd9c10000000000000000000000000000fd6a689d6779abe81e6aa2c63fce0faf9531a700c8cc02ea5d83f57fbfaee919668e9ba4776f2d5a1d544ea17288de3895fc39713fe150efeb27d43fcc1b53c00a4ade36652ecdb7fab04afa69e2b6611c0233670808a206578c5a7d0266ccf6c80ec69b22c8c71c6d8a057b71d39b18f15311dd7149a75f91ce676516532c0b89e0a2d4323080444686a790eca0390eea32e6fb0bd40b79e2c86d01435be3ba1224970c7e10e4bc54323decb110fb66f25477e309041ce13c8d8b077ead176bc45c5050a88acae7f8aaf962a990e6269de74cb1a915b85c01019066f2858cf322a21ebec7e060da478e31f943e7c31bbdb43c26702a0257e7103b4d532336dc6f0bd5d33a6f7d1134872859afb35a4e0731b38d3a914ed3aa376917b0bc84f5"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001500192340834b80040d8c560a067fbc45ff810540010000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r0, 0x0, 0xe, 0x0, &(0x7f0000000200)="63eced8e2613c2b346dc3f0a7387", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 825.126975ms ago: executing program 1 (id=4351): r0 = socket(0x10, 0x803, 0x0) recvfrom$unix(r0, &(0x7f00000001c0)=""/153, 0x99, 0x121, &(0x7f00000002c0)=@abs={0x1, 0x0, 0x4e21}, 0x6e) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = socket(0x2, 0x3, 0xff) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, 0x0, 0x0) sendto$inet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, 0x0, 0x810) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r3], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) r5 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=ANY=[@ANYBLOB="1400000004000000080000000600000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000008000"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = socket$inet6(0xa, 0x80002, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@generic={0x0, 0x0, 0x18}, 0x18) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r5, &(0x7f0000000280), &(0x7f0000001840)=@udp6=r6}, 0x20) close(r6) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x4}}}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4}]}]}, 0x3c}}, 0x0) 792.335219ms ago: executing program 3 (id=4352): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$AUDIT_DEL_RULE(r0, &(0x7f0000000ac0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000640)={0x430, 0x3f4, 0x400, 0x70bd2a, 0x25dfdbff, {0x4, 0x1, 0x21, [0x9, 0x101, 0x493, 0xa, 0xfffffa44, 0x8, 0x5, 0x7, 0x7ff, 0x5, 0x2, 0x1, 0xff, 0xfff, 0xffffffff, 0x30f, 0x5, 0x9, 0x0, 0x0, 0x1, 0xff, 0x6, 0x1, 0x6, 0x870f, 0xffffffff, 0x0, 0x1000, 0x1, 0x74, 0x6, 0x6, 0x2, 0x8, 0x9, 0x7ff, 0x5, 0xfffffff0, 0x1, 0x6, 0xd, 0x10001, 0xe, 0xc, 0x7, 0x8, 0x0, 0x8000, 0x100400, 0x5, 0x10, 0x1, 0x3, 0x4, 0x4, 0x1, 0x27e2, 0x4, 0x0, 0x2, 0x8, 0x6, 0x7], [0xfc, 0x7fff, 0x6, 0x7c0, 0xfffffff7, 0x1, 0xe40, 0x5, 0x7, 0x6, 0x1, 0xb99e, 0x8, 0x0, 0x5, 0x7, 0x3ff, 0x9, 0x4, 0x6, 0xc, 0x6, 0x6, 0x3, 0x4fd1, 0x101, 0x8, 0xb, 0x6, 0x2, 0x0, 0x95, 0x6, 0x9, 0xefd, 0x9, 0x64b, 0x6, 0x101, 0x200, 0x5, 0xfffffffd, 0x7, 0xfffff07d, 0x1a, 0x8, 0x5, 0x4, 0x5, 0x2, 0x4, 0xbd, 0x0, 0x5, 0x4, 0x80000001, 0x9, 0xdaf8, 0x9, 0x1, 0x4, 0x9, 0x3, 0x6], [0x5, 0xa, 0x6, 0x0, 0x8, 0x8, 0x5fece633, 0x3, 0x7ff, 0xffffffff, 0x2, 0xffff, 0x4, 0x2, 0x0, 0x8, 0x217f, 0x1000, 0x2, 0x5, 0x10aa, 0xb92, 0x7fffffff, 0x7fff, 0xa4c, 0x8, 0xe27, 0x4, 0x9, 0x3, 0x352379a3, 0x3, 0x4, 0x80, 0x5, 0x1, 0x7ff, 0x81ed, 0x4435, 0x1, 0xfffffffa, 0x0, 0x80000000, 0x200000, 0x80000000, 0x527, 0x6, 0x13a1, 0x4, 0x4, 0x2, 0x81, 0x401, 0x9, 0x1, 0x7, 0x8, 0x4, 0xb564, 0x6, 0x8, 0x3, 0x1, 0x8], [0x1, 0x2, 0x101, 0x6, 0x5f15, 0x10000, 0x7, 0x14, 0x7f, 0x7, 0x81, 0x2, 0xf, 0x7fff, 0x4, 0xff, 0x4, 0x5, 0x3eb9, 0xff, 0x6, 0x0, 0x10001, 0x9, 0x2, 0x10000, 0x2, 0x3, 0x717, 0x6, 0x1, 0x6, 0x4, 0x7fffffff, 0x8, 0x380, 0x0, 0x5, 0xdee9, 0x5, 0x1, 0x5, 0x0, 0x2, 0x5, 0xd4, 0x62f9, 0x0, 0xf, 0x3, 0x6, 0x200, 0x10, 0xcb, 0x81, 0xfffffffc, 0xc, 0x7, 0x66f6, 0xd3, 0xf9, 0x7f, 0x8, 0x2], 0xe, ['bridge\x00', 'bridge\x00']}, [""]}, 0x430}, 0x1, 0x0, 0x0, 0x14804}, 0x84) (async, rerun: 64) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0xb8, 0x0, 0x7, 0x801, 0x0, 0x0, {0x5, 0x0, 0x5}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x3}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0xaae7}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FILTER={0x24, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x3}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x6}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x9}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x7}]}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FILTER={0x34, 0x7, 0x0, 0x1, [@NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x38000}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x2}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x75}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x4}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0xfb}, @NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x6}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x2}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000001) (async, rerun: 64) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)={0x18, 0x2f, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) (async, rerun: 64) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x503, 0x0, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1006}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) (rerun: 64) 782.4091ms ago: executing program 4 (id=4353): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x14, 0x15, 0x301, 0x0, 0x0, {0x5}}, 0x14}}, 0x40) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000c0000004208000040000000c0"], 0x50) r1 = socket$inet(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r2, 0x8983, &(0x7f0000000240)={0x6, 'pim6reg1\x00', {}, 0x8}) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x0, 'veth1_to_hsr\x00', {0x4}, 0x1}) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b04, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) sendmsg$IEEE802154_ADD_IFACE(r4, &(0x7f0000000300)={&(0x7f0000000040), 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x40, r5, 0x1, 0x70bd2a, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x40}, 0x1, 0x0, 0x0, 0xc081}, 0x40) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x5e}]}, &(0x7f00000000c0)='GPL\x00'}, 0x90) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002000000ffff000005"], 0x48) close(r7) bind$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r6, 0x4) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000280), &(0x7f0000000340)=0xc) sendmmsg$inet6(r3, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000540)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) r8 = socket$xdp(0x2c, 0x3, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r9, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 679.767367ms ago: executing program 2 (id=4354): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000006c0)={0xa4, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x80, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x40, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}]}, @CTA_EXPECT_NAT={0x10, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0xc, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4a, 0x0, &(0x7f00000001c0)) sendto(r0, &(0x7f0000000c40)="120000001200e7ef007b0000000000faffa0", 0x12, 0x8800, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 606.542415ms ago: executing program 0 (id=4355): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000003c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r0, &(0x7f00000001c0)={0x0, 0x30000, &(0x7f00000000c0)={&(0x7f0000000880)={0x68, r1, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r2}, @WGDEVICE_A_PEERS={0x4c, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, '\x00', 0x31}}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}]}]}, 0x68}}, 0x0) 533.590868ms ago: executing program 1 (id=4356): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x24, r1, 0x351d4d5b9375e359, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x5, 'syz0\x00'}]}]}, 0x24}, 0x1, 0x0, 0x60}, 0x0) 482.489793ms ago: executing program 2 (id=4357): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x1, 0x4, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r1, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[], 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)='%pI4 \x00'}, 0x20) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x29, 0x1, 0x3, 0x4, 0x58, @dev={0xfe, 0x80, '\x00', 0x3e}, @local, 0x21, 0x700, 0x4, 0x28bcb713}}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000240)={0x0, 0xa2}, 0x8) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x9, 0x0, r3, 0x74, '\x00', r4, r6, 0x2, 0x4, 0x1}, 0x50) setsockopt$IP_VS_SO_SET_ZERO(r2, 0x0, 0x48f, &(0x7f00000000c0)={0x84, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x3, 'lc\x00', 0x3, 0x1, 0x5f}, 0x2c) 392.23381ms ago: executing program 0 (id=4358): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x204001, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r4, 0x0, 0xc884) close(r3) socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x25}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000480)="be", 0x1}], 0x1}, 0x8804) 391.994624ms ago: executing program 2 (id=4359): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmmsg$inet6(r1, &(0x7f00000004c0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="2400000000000000290000003200000000000000000000000000ffffac1414aa", @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00)'], 0x50}}], 0x1, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)={0x18, 0x52, 0x1, 0x0, 0x0, {0x2, 0x3}, [@generic='2']}, 0x18}}, 0x0) 355.187978ms ago: executing program 1 (id=4360): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x20, &(0x7f00000000c0)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x4}}}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4}]}]}, 0x3c}}, 0x0) 152.532212ms ago: executing program 1 (id=4361): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000000c0)={0x0, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x2, 0x4e20, @empty}, {0x2, 0x4e24, @local}, 0x5, 0x0, 0x5c, 0x0, 0x3f77, &(0x7f0000000080), 0x4, 0x8, 0xfffb}) 131.014845ms ago: executing program 2 (id=4362): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c0005006c010000000000000c000200ff7f000000000000400007800c00018008000100", @ANYRES32=r3, @ANYBLOB="0c00018008000100", @ANYRES32=r1], 0x7c}}, 0x20000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xc, 0x1d, &(0x7f00000002c0)=ANY=[@ANYRESHEX], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000010000000ce9b00100000000000184f0900"/36], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r9, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r9}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) splice(r6, 0x0, r8, 0x0, 0x4, 0xf) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r10, 0x0) ioctl$SIOCX25SDTEFACILITIES(r10, 0x89eb, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, "bb67a153cd0e3e4a1aac449e5ad88b56923d9dfe", "b1610538917aa875e9b6000000007aa56a33d100"}) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r11, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000f, 0x12, r11, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) close(r7) write(r5, 0x0, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x100000d, 0x12, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x11, r11, 0x0) r12 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r12, 0x84, 0xc, &(0x7f0000000240)=@assoc_value, &(0x7f0000000080)=0x8) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r14 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000340)=ANY=[@ANYRES32], 0x20) sendmsg$nl_route(r14, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r13, @ANYBLOB="00001700000000001c0037800b0001206970768a616e08000c0002800600010000000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) 130.668797ms ago: executing program 4 (id=4363): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x5, [@volatile={0xc, 0x0, 0x0, 0x9, 0x5}, @func={0xd, 0x0, 0x0, 0xc, 0x3}, @ptr={0x10}, @const={0xa, 0x0, 0x0, 0xa, 0x2}]}, {0x0, [0x0, 0x5f, 0x7f]}}, &(0x7f0000000240)=""/28, 0x4d, 0x1c, 0x0, 0x4}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000600)={r0, 0x20, &(0x7f00000005c0)={&(0x7f0000000400)=""/191, 0xbf, 0x0, &(0x7f00000004c0)=""/240, 0xf0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_VOICE(r2, 0x112, 0x13, 0x0, &(0x7f0000000280)=0x2f) 0s ago: executing program 4 (id=4364): sendmmsg(0xffffffffffffffff, &(0x7f00000022c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{&(0x7f0000000e00)=@phonet={0x23, 0x8, 0x4, 0x2}, 0x80, 0x0}}], 0x4, 0x40000) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000034000)={0x1, {{0xa, 0x4e22, 0x0, @mcast1, 0x1000003}}}, 0x88) getsockopt$inet6_buf(r1, 0x29, 0x10000000000030, &(0x7f0000034000)=""/144, &(0x7f0000002280)=0x90) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0xb9}}, &(0x7f00000001c0)='syzkaller\x00'}, 0x90) kernel console output (not intermixed with test programs): audit: type=1800 audit(1782789358.520:8): pid=15056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2769" name="memory.events" dev="tmpfs" ino=2745 res=0 errno=0 [ 431.829693][ T30] audit: type=1804 audit(1782789358.550:9): pid=15056 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.2769" name="/newroot/536/memory.events" dev="tmpfs" ino=2745 res=1 errno=0 [ 431.883598][T15056] netlink: 'syz.3.2769': attribute type 11 has an invalid length. [ 432.148411][T15076] FAULT_INJECTION: forcing a failure. [ 432.148411][T15076] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 432.161498][T15076] CPU: 0 UID: 0 PID: 15076 Comm: syz.3.2772 Not tainted syzkaller #0 PREEMPT(full) [ 432.161522][T15076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 432.161533][T15076] Call Trace: [ 432.161540][T15076] [ 432.161546][T15076] dump_stack_lvl+0xe8/0x150 [ 432.161573][T15076] should_fail_ex+0x40c/0x560 [ 432.161601][T15076] _copy_from_iter+0x1d3/0x1660 [ 432.161628][T15076] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 432.161657][T15076] ? rcu_is_watching+0x15/0xb0 [ 432.161680][T15076] ? trace_kmem_cache_alloc+0x29/0xe0 [ 432.161709][T15076] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 432.161737][T15076] ? __pfx__copy_from_iter+0x10/0x10 [ 432.161771][T15076] ? __alloc_skb+0x276/0x7a0 [ 432.161787][T15076] ? __alloc_skb+0x276/0x7a0 [ 432.161810][T15076] ? netlink_sendmsg+0x650/0xb40 [ 432.161831][T15076] ? skb_put+0x112/0x210 [ 432.161851][T15076] netlink_sendmsg+0x6c0/0xb40 [ 432.161882][T15076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 432.161925][T15076] ? aa_sock_msg_perm+0xf1/0x1b0 [ 432.161953][T15076] ? __pfx_netlink_sendmsg+0x10/0x10 [ 432.161973][T15076] sock_sendmsg_nosec+0x13a/0x180 [ 432.162001][T15076] ____sys_sendmsg+0x54e/0x850 [ 432.162028][T15076] ? __pfx_____sys_sendmsg+0x10/0x10 [ 432.162057][T15076] ? import_iovec+0x73/0xa0 [ 432.162080][T15076] ___sys_sendmsg+0x2a5/0x360 [ 432.162100][T15076] ? __lock_acquire+0x683/0x2cf0 [ 432.162124][T15076] ? __pfx____sys_sendmsg+0x10/0x10 [ 432.162178][T15076] ? __fget_files+0x2a/0x420 [ 432.162196][T15076] ? __fget_files+0x3a2/0x420 [ 432.162224][T15076] __x64_sys_sendmsg+0x1b1/0x290 [ 432.162247][T15076] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 432.162286][T15076] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.162306][T15076] do_syscall_64+0x174/0x580 [ 432.162324][T15076] ? trace_irq_disable+0x3b/0x140 [ 432.162342][T15076] ? clear_bhb_loop+0x40/0x90 [ 432.162365][T15076] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.162384][T15076] RIP: 0033:0x7f1ce499ce59 [ 432.162402][T15076] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 432.162418][T15076] RSP: 002b:00007f1ce58f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 432.162437][T15076] RAX: ffffffffffffffda RBX: 00007f1ce4c15fa0 RCX: 00007f1ce499ce59 [ 432.162451][T15076] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 432.162463][T15076] RBP: 00007f1ce58f5090 R08: 0000000000000000 R09: 0000000000000000 [ 432.162475][T15076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 432.162486][T15076] R13: 00007f1ce4c16038 R14: 00007f1ce4c15fa0 R15: 00007ffc8afd3988 [ 432.162517][T15076] [ 432.171368][T15078] FAULT_INJECTION: forcing a failure. [ 432.171368][T15078] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 432.390363][T15091] netlink: 'syz.0.2777': attribute type 64 has an invalid length. [ 432.406032][T15078] CPU: 0 UID: 0 PID: 15078 Comm: syz.1.2774 Not tainted syzkaller #0 PREEMPT(full) [ 432.406058][T15078] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 432.406069][T15078] Call Trace: [ 432.406076][T15078] [ 432.406084][T15078] dump_stack_lvl+0xe8/0x150 [ 432.406111][T15078] should_fail_ex+0x40c/0x560 [ 432.406141][T15078] _copy_from_iter+0x1d3/0x1660 [ 432.406166][T15078] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 432.406195][T15078] ? rcu_is_watching+0x15/0xb0 [ 432.406217][T15078] ? trace_kmem_cache_alloc+0x29/0xe0 [ 432.406244][T15078] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 432.406271][T15078] ? __pfx__copy_from_iter+0x10/0x10 [ 432.406296][T15078] ? __alloc_skb+0x276/0x7a0 [ 432.406312][T15078] ? __alloc_skb+0x276/0x7a0 [ 432.406332][T15078] ? netlink_sendmsg+0x650/0xb40 [ 432.406353][T15078] ? skb_put+0x112/0x210 [ 432.406372][T15078] netlink_sendmsg+0x6c0/0xb40 [ 432.406401][T15078] ? __pfx_netlink_sendmsg+0x10/0x10 [ 432.406426][T15078] ? aa_sock_msg_perm+0xf1/0x1b0 [ 432.406452][T15078] ? __pfx_netlink_sendmsg+0x10/0x10 [ 432.406472][T15078] sock_sendmsg_nosec+0x13a/0x180 [ 432.406500][T15078] ____sys_sendmsg+0x54e/0x850 [ 432.406524][T15078] ? __pfx_____sys_sendmsg+0x10/0x10 [ 432.406551][T15078] ? import_iovec+0x73/0xa0 [ 432.406573][T15078] ___sys_sendmsg+0x2a5/0x360 [ 432.406592][T15078] ? __lock_acquire+0x683/0x2cf0 [ 432.406615][T15078] ? __pfx____sys_sendmsg+0x10/0x10 [ 432.406666][T15078] ? __fget_files+0x2a/0x420 [ 432.406683][T15078] ? __fget_files+0x3a2/0x420 [ 432.406710][T15078] __x64_sys_sendmsg+0x1b1/0x290 [ 432.406739][T15078] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 432.406775][T15078] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.406795][T15078] do_syscall_64+0x174/0x580 [ 432.406812][T15078] ? trace_irq_disable+0x3b/0x140 [ 432.406829][T15078] ? clear_bhb_loop+0x40/0x90 [ 432.406852][T15078] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 432.406869][T15078] RIP: 0033:0x7f4756b9ce59 [ 432.406886][T15078] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 432.406903][T15078] RSP: 002b:00007f4757a53028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 432.406922][T15078] RAX: ffffffffffffffda RBX: 00007f4756e15fa0 RCX: 00007f4756b9ce59 [ 432.406936][T15078] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 432.406948][T15078] RBP: 00007f4757a53090 R08: 0000000000000000 R09: 0000000000000000 [ 432.406958][T15078] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 432.406969][T15078] R13: 00007f4756e16038 R14: 00007f4756e15fa0 R15: 00007ffda70b0d98 [ 432.406998][T15078] [ 432.469695][T15088] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2777'. [ 433.063115][T15114] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2782'. [ 433.300543][T15121] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2785'. [ 433.332222][T15124] FAULT_INJECTION: forcing a failure. [ 433.332222][T15124] name failslab, interval 1, probability 0, space 0, times 0 [ 433.355381][T15124] CPU: 0 UID: 0 PID: 15124 Comm: syz.2.2786 Not tainted syzkaller #0 PREEMPT(full) [ 433.355407][T15124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 433.355418][T15124] Call Trace: [ 433.355425][T15124] [ 433.355433][T15124] dump_stack_lvl+0xe8/0x150 [ 433.355462][T15124] should_fail_ex+0x40c/0x560 [ 433.355490][T15124] should_failslab+0xa8/0x100 [ 433.355513][T15124] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 433.355540][T15124] ? local_lock_release+0x9c/0x160 [ 433.355568][T15124] ? __alloc_skb+0x1d7/0x7a0 [ 433.355581][T15124] ? __alloc_skb+0x1d7/0x7a0 [ 433.355600][T15124] __alloc_skb+0x1d7/0x7a0 [ 433.355620][T15124] netlink_ack+0x136/0xb30 [ 433.355636][T15124] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 433.355671][T15124] ? __lock_acquire+0x683/0x2cf0 [ 433.355701][T15124] netlink_rcv_skb+0x2a4/0x4a0 [ 433.355720][T15124] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 433.355751][T15124] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 433.355781][T15124] ? netlink_deliver_tap+0x2e/0x1b0 [ 433.355802][T15124] ? netlink_deliver_tap+0x2e/0x1b0 [ 433.355828][T15124] netlink_unicast+0x7bb/0x940 [ 433.355857][T15124] netlink_sendmsg+0x813/0xb40 [ 433.355888][T15124] ? __pfx_netlink_sendmsg+0x10/0x10 [ 433.355913][T15124] ? aa_sock_msg_perm+0xf1/0x1b0 [ 433.355942][T15124] ? __pfx_netlink_sendmsg+0x10/0x10 [ 433.355962][T15124] sock_sendmsg_nosec+0x13a/0x180 [ 433.355991][T15124] ____sys_sendmsg+0x54e/0x850 [ 433.356017][T15124] ? __pfx_____sys_sendmsg+0x10/0x10 [ 433.356047][T15124] ? import_iovec+0x73/0xa0 [ 433.356070][T15124] ___sys_sendmsg+0x2a5/0x360 [ 433.356090][T15124] ? __lock_acquire+0x683/0x2cf0 [ 433.356113][T15124] ? __pfx____sys_sendmsg+0x10/0x10 [ 433.356163][T15124] ? __fget_files+0x2a/0x420 [ 433.356186][T15124] ? __fget_files+0x3a2/0x420 [ 433.356214][T15124] __x64_sys_sendmsg+0x1b1/0x290 [ 433.356238][T15124] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 433.356274][T15124] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.356290][T15124] do_syscall_64+0x174/0x580 [ 433.356307][T15124] ? trace_irq_disable+0x3b/0x140 [ 433.356323][T15124] ? clear_bhb_loop+0x40/0x90 [ 433.356343][T15124] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.356360][T15124] RIP: 0033:0x7f685fd9ce59 [ 433.356379][T15124] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.356396][T15124] RSP: 002b:00007f6860d09028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 433.356416][T15124] RAX: ffffffffffffffda RBX: 00007f6860015fa0 RCX: 00007f685fd9ce59 [ 433.356430][T15124] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 433.356442][T15124] RBP: 00007f6860d09090 R08: 0000000000000000 R09: 0000000000000000 [ 433.356454][T15124] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.356465][T15124] R13: 00007f6860016038 R14: 00007f6860015fa0 R15: 00007ffeeab6aaa8 [ 433.356495][T15124] [ 433.416674][T15128] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2788'. [ 433.751926][T15144] FAULT_INJECTION: forcing a failure. [ 433.751926][T15144] name failslab, interval 1, probability 0, space 0, times 0 [ 433.764915][T15144] CPU: 1 UID: 0 PID: 15144 Comm: syz.1.2792 Not tainted syzkaller #0 PREEMPT(full) [ 433.764941][T15144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 433.764952][T15144] Call Trace: [ 433.764960][T15144] [ 433.764967][T15144] dump_stack_lvl+0xe8/0x150 [ 433.764997][T15144] should_fail_ex+0x40c/0x560 [ 433.765027][T15144] should_failslab+0xa8/0x100 [ 433.765051][T15144] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 433.765076][T15144] ? local_lock_release+0x9c/0x160 [ 433.765107][T15144] ? __alloc_skb+0x1d7/0x7a0 [ 433.765122][T15144] ? __alloc_skb+0x1d7/0x7a0 [ 433.765146][T15144] __alloc_skb+0x1d7/0x7a0 [ 433.765179][T15144] hci_mgmt_cmd+0x1c1/0xfc0 [ 433.765206][T15144] ? hci_sock_setsockopt+0x5b0/0xa90 [ 433.765242][T15144] hci_sock_sendmsg+0x6e1/0xf50 [ 433.765271][T15144] ? __pfx_aa_sk_perm+0x10/0x10 [ 433.765293][T15144] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 433.765320][T15144] ? aa_sock_msg_perm+0xf1/0x1b0 [ 433.765349][T15144] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 433.765374][T15144] sock_sendmsg_nosec+0x13a/0x180 [ 433.765402][T15144] sock_write_iter+0x2de/0x3e0 [ 433.765428][T15144] ? __pfx_sock_write_iter+0x10/0x10 [ 433.765459][T15144] ? bpf_lsm_file_permission+0x9/0x20 [ 433.765485][T15144] ? security_file_permission+0x75/0x260 [ 433.765523][T15144] vfs_write+0x612/0xba0 [ 433.765554][T15144] ? __pfx_vfs_write+0x10/0x10 [ 433.765592][T15144] ? __fget_files+0x2a/0x420 [ 433.765619][T15144] ksys_write+0x150/0x270 [ 433.765644][T15144] ? __pfx_ksys_write+0x10/0x10 [ 433.765675][T15144] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.765696][T15144] do_syscall_64+0x174/0x580 [ 433.765713][T15144] ? trace_irq_disable+0x3b/0x140 [ 433.765731][T15144] ? clear_bhb_loop+0x40/0x90 [ 433.765753][T15144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.765770][T15144] RIP: 0033:0x7f4756b9ce59 [ 433.765788][T15144] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.765805][T15144] RSP: 002b:00007f4757a53028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 433.765825][T15144] RAX: ffffffffffffffda RBX: 00007f4756e15fa0 RCX: 00007f4756b9ce59 [ 433.765838][T15144] RDX: 0000000000000006 RSI: 0000200000000080 RDI: 0000000000000004 [ 433.765850][T15144] RBP: 00007f4757a53090 R08: 0000000000000000 R09: 0000000000000000 [ 433.765861][T15144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.765873][T15144] R13: 00007f4756e16038 R14: 00007f4756e15fa0 R15: 00007ffda70b0d98 [ 433.765904][T15144] [ 434.102959][T15147] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2793'. [ 434.141800][T15155] syzkaller0: entered promiscuous mode [ 434.151174][T15155] syzkaller0: entered allmulticast mode [ 434.261152][T15161] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2797'. [ 434.266096][T15163] FAULT_INJECTION: forcing a failure. [ 434.266096][T15163] name failslab, interval 1, probability 0, space 0, times 0 [ 434.291646][T15163] CPU: 0 UID: 0 PID: 15163 Comm: syz.4.2798 Not tainted syzkaller #0 PREEMPT(full) [ 434.291670][T15163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 434.291680][T15163] Call Trace: [ 434.291687][T15163] [ 434.291694][T15163] dump_stack_lvl+0xe8/0x150 [ 434.291722][T15163] should_fail_ex+0x40c/0x560 [ 434.291750][T15163] should_failslab+0xa8/0x100 [ 434.291773][T15163] __kmalloc_noprof+0xfe/0x720 [ 434.291803][T15163] ? fib6_info_alloc+0x30/0xf0 [ 434.291824][T15163] ? fib6_info_alloc+0x30/0xf0 [ 434.291850][T15163] fib6_info_alloc+0x30/0xf0 [ 434.291871][T15163] ip6_route_info_create+0x149/0x890 [ 434.291901][T15163] ip6_route_add+0x49/0x1b0 [ 434.291925][T15163] inet6_rtm_newroute+0x267/0x1a30 [ 434.291954][T15163] ? kasan_quarantine_put+0xbb/0x1f0 [ 434.291980][T15163] ? lockdep_hardirqs_on+0x7a/0x110 [ 434.292020][T15163] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 434.292040][T15163] ? nlmon_xmit+0xb0/0x100 [ 434.292055][T15163] ? kmem_cache_free+0x182/0x650 [ 434.292084][T15163] ? __lock_acquire+0x683/0x2cf0 [ 434.292108][T15163] ? __dev_queue_xmit+0x29b/0x37f0 [ 434.292133][T15163] ? __local_bh_enable_ip+0xd0/0x130 [ 434.292160][T15163] ? lockdep_hardirqs_on+0x7a/0x110 [ 434.292212][T15163] ? __pfx_inet6_rtm_newroute+0x10/0x10 [ 434.292232][T15163] rtnetlink_rcv_msg+0x802/0xc00 [ 434.292264][T15163] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 434.292292][T15163] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 434.292317][T15163] ? ref_tracker_free+0x689/0x830 [ 434.292345][T15163] ? __pfx_ref_tracker_free+0x10/0x10 [ 434.292378][T15163] netlink_rcv_skb+0x226/0x4a0 [ 434.292400][T15163] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 434.292430][T15163] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 434.292461][T15163] ? netlink_deliver_tap+0x2e/0x1b0 [ 434.292479][T15163] ? netlink_deliver_tap+0x2e/0x1b0 [ 434.292505][T15163] netlink_unicast+0x7bb/0x940 [ 434.292533][T15163] netlink_sendmsg+0x813/0xb40 [ 434.292562][T15163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.292588][T15163] ? aa_sock_msg_perm+0xf1/0x1b0 [ 434.292615][T15163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 434.292635][T15163] sock_sendmsg_nosec+0x13a/0x180 [ 434.292663][T15163] ____sys_sendmsg+0x54e/0x850 [ 434.292687][T15163] ? __pfx_____sys_sendmsg+0x10/0x10 [ 434.292715][T15163] ? import_iovec+0x73/0xa0 [ 434.292736][T15163] ___sys_sendmsg+0x2a5/0x360 [ 434.292754][T15163] ? __lock_acquire+0x683/0x2cf0 [ 434.292776][T15163] ? __pfx____sys_sendmsg+0x10/0x10 [ 434.292825][T15163] ? __fget_files+0x2a/0x420 [ 434.292842][T15163] ? __fget_files+0x3a2/0x420 [ 434.292866][T15163] __x64_sys_sendmsg+0x1b1/0x290 [ 434.292889][T15163] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 434.292922][T15163] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.292940][T15163] do_syscall_64+0x174/0x580 [ 434.292956][T15163] ? trace_irq_disable+0x3b/0x140 [ 434.292974][T15163] ? clear_bhb_loop+0x40/0x90 [ 434.292996][T15163] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 434.293023][T15163] RIP: 0033:0x7f450779ce59 [ 434.293040][T15163] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 434.293056][T15163] RSP: 002b:00007f45085b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 434.293075][T15163] RAX: ffffffffffffffda RBX: 00007f4507a15fa0 RCX: 00007f450779ce59 [ 434.293089][T15163] RDX: 0000000000000004 RSI: 00002000000004c0 RDI: 0000000000000003 [ 434.293100][T15163] RBP: 00007f45085b4090 R08: 0000000000000000 R09: 0000000000000000 [ 434.293111][T15163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 434.293122][T15163] R13: 00007f4507a16038 R14: 00007f4507a15fa0 R15: 00007ffc673fd468 [ 434.293153][T15163] [ 434.827067][T15161] 8021q: adding VLAN 0 to HW filter on device bond8 [ 434.839232][T15161] bond8 (unregistering): Released all slaves [ 435.439510][T15218] syzkaller0: entered promiscuous mode [ 435.463880][T15218] syzkaller0: entered allmulticast mode [ 435.737305][T15234] IPv6: NLM_F_REPLACE set, but no existing node found! [ 435.744311][T15234] FAULT_INJECTION: forcing a failure. [ 435.744311][T15234] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 435.758120][T15234] CPU: 0 UID: 0 PID: 15234 Comm: syz.0.2815 Not tainted syzkaller #0 PREEMPT(full) [ 435.758145][T15234] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 435.758156][T15234] Call Trace: [ 435.758163][T15234] [ 435.758170][T15234] dump_stack_lvl+0xe8/0x150 [ 435.758199][T15234] should_fail_ex+0x40c/0x560 [ 435.758231][T15234] _copy_to_user+0x31/0xb0 [ 435.758253][T15234] simple_read_from_buffer+0xe1/0x170 [ 435.758277][T15234] proc_fail_nth_read+0x1bb/0x230 [ 435.758301][T15234] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 435.758324][T15234] ? rw_verify_area+0x24a/0x4c0 [ 435.758348][T15234] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 435.758367][T15234] vfs_read+0x213/0xa80 [ 435.758401][T15234] ? __pfx___mutex_lock+0x10/0x10 [ 435.758421][T15234] ? __pfx_vfs_read+0x10/0x10 [ 435.758445][T15234] ? __fget_files+0x2a/0x420 [ 435.758467][T15234] ? __fget_files+0x3a2/0x420 [ 435.758484][T15234] ? __fget_files+0x2a/0x420 [ 435.758511][T15234] ksys_read+0x150/0x270 [ 435.758534][T15234] ? __pfx_ksys_read+0x10/0x10 [ 435.758564][T15234] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.758585][T15234] do_syscall_64+0x174/0x580 [ 435.758601][T15234] ? trace_irq_disable+0x3b/0x140 [ 435.758619][T15234] ? clear_bhb_loop+0x40/0x90 [ 435.758643][T15234] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 435.758662][T15234] RIP: 0033:0x7fc4bdd5d68e [ 435.758679][T15234] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 435.758695][T15234] RSP: 002b:00007fc4bebdefe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 435.758714][T15234] RAX: ffffffffffffffda RBX: 00007fc4bebdf6c0 RCX: 00007fc4bdd5d68e [ 435.758728][T15234] RDX: 000000000000000f RSI: 00007fc4bebdf0a0 RDI: 0000000000000004 [ 435.758740][T15234] RBP: 00007fc4bebdf090 R08: 0000000000000000 R09: 0000000000000000 [ 435.758751][T15234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.758762][T15234] R13: 00007fc4be016038 R14: 00007fc4be015fa0 R15: 00007ffc536b62d8 [ 435.758793][T15234] [ 436.029476][T15236] netlink: 'syz.1.2817': attribute type 32 has an invalid length. [ 436.046499][T15236] netlink: 768 bytes leftover after parsing attributes in process `syz.1.2817'. [ 436.450552][T15252] netlink: 'syz.1.2824': attribute type 4 has an invalid length. [ 436.459273][T15252] netlink: 'syz.1.2824': attribute type 4 has an invalid length. [ 436.663422][T15266] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2828'. [ 436.697454][T15268] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2829'. [ 436.933618][T15279] FAULT_INJECTION: forcing a failure. [ 436.933618][T15279] name failslab, interval 1, probability 0, space 0, times 0 [ 436.991262][T15279] CPU: 1 UID: 0 PID: 15279 Comm: syz.1.2834 Not tainted syzkaller #0 PREEMPT(full) [ 436.991290][T15279] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 436.991301][T15279] Call Trace: [ 436.991308][T15279] [ 436.991316][T15279] dump_stack_lvl+0xe8/0x150 [ 436.991344][T15279] should_fail_ex+0x40c/0x560 [ 436.991375][T15279] should_failslab+0xa8/0x100 [ 436.991399][T15279] __kmalloc_cache_noprof+0xa8/0x660 [ 436.991428][T15279] ? nft_pernet+0x23/0x240 [ 436.991445][T15279] ? nf_tables_newtable+0x43e/0x1950 [ 436.991471][T15279] ? nf_tables_newtable+0x43e/0x1950 [ 436.991504][T15279] nf_tables_newtable+0x43e/0x1950 [ 436.991550][T15279] nfnetlink_rcv+0x1288/0x28c0 [ 436.991603][T15279] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 436.991639][T15279] ? ref_tracker_free+0x689/0x830 [ 436.991689][T15279] ? skb_clone+0x246/0x3a0 [ 436.991713][T15279] ? __netlink_deliver_tap+0x811/0x860 [ 436.991743][T15279] ? netlink_deliver_tap+0x2e/0x1b0 [ 436.991770][T15279] ? netlink_deliver_tap+0x2e/0x1b0 [ 436.991797][T15279] netlink_unicast+0x7bb/0x940 [ 436.991828][T15279] netlink_sendmsg+0x813/0xb40 [ 436.991859][T15279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 436.991885][T15279] ? aa_sock_msg_perm+0xf1/0x1b0 [ 436.991914][T15279] ? __pfx_netlink_sendmsg+0x10/0x10 [ 436.991935][T15279] sock_sendmsg_nosec+0x13a/0x180 [ 436.991963][T15279] ____sys_sendmsg+0x54e/0x850 [ 436.991989][T15279] ? __pfx_____sys_sendmsg+0x10/0x10 [ 436.992019][T15279] ? import_iovec+0x73/0xa0 [ 436.992042][T15279] ___sys_sendmsg+0x2a5/0x360 [ 436.992061][T15279] ? __lock_acquire+0x683/0x2cf0 [ 436.992086][T15279] ? __pfx____sys_sendmsg+0x10/0x10 [ 436.992142][T15279] ? __fget_files+0x2a/0x420 [ 436.992160][T15279] ? __fget_files+0x3a2/0x420 [ 436.992189][T15279] __x64_sys_sendmsg+0x1b1/0x290 [ 436.992213][T15279] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 436.992252][T15279] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.992272][T15279] do_syscall_64+0x174/0x580 [ 436.992290][T15279] ? trace_irq_disable+0x3b/0x140 [ 436.992308][T15279] ? clear_bhb_loop+0x40/0x90 [ 436.992331][T15279] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 436.992350][T15279] RIP: 0033:0x7f4756b9ce59 [ 436.992367][T15279] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 436.992383][T15279] RSP: 002b:00007f4757a53028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 436.992404][T15279] RAX: ffffffffffffffda RBX: 00007f4756e15fa0 RCX: 00007f4756b9ce59 [ 436.992418][T15279] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 436.992429][T15279] RBP: 00007f4757a53090 R08: 0000000000000000 R09: 0000000000000000 [ 436.992441][T15279] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 436.992452][T15279] R13: 00007f4756e16038 R14: 00007f4756e15fa0 R15: 00007ffda70b0d98 [ 436.992484][T15279] [ 437.022889][T15282] syzkaller0: entered promiscuous mode [ 437.319082][T15282] syzkaller0: entered allmulticast mode [ 437.368946][T15289] netlink: 830 bytes leftover after parsing attributes in process `syz.4.2836'. [ 437.655163][T15299] netlink: 80 bytes leftover after parsing attributes in process `syz.2.2841'. [ 437.708787][T15301] FAULT_INJECTION: forcing a failure. [ 437.708787][T15301] name failslab, interval 1, probability 0, space 0, times 0 [ 437.735180][T15301] CPU: 0 UID: 0 PID: 15301 Comm: syz.4.2838 Not tainted syzkaller #0 PREEMPT(full) [ 437.735214][T15301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 437.735223][T15301] Call Trace: [ 437.735228][T15301] [ 437.735235][T15301] dump_stack_lvl+0xe8/0x150 [ 437.735258][T15301] should_fail_ex+0x40c/0x560 [ 437.735283][T15301] should_failslab+0xa8/0x100 [ 437.735301][T15301] __kmalloc_cache_noprof+0xa8/0x660 [ 437.735323][T15301] ? __kmalloc_cache_noprof+0x150/0x660 [ 437.735343][T15301] ? allocate_cgrp_cset_links+0xaa/0x320 [ 437.735363][T15301] ? allocate_cgrp_cset_links+0xaa/0x320 [ 437.735389][T15301] allocate_cgrp_cset_links+0xaa/0x320 [ 437.735414][T15301] find_css_set+0xbde/0x1be0 [ 437.735448][T15301] ? __pfx_find_css_set+0x10/0x10 [ 437.735479][T15301] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 437.735512][T15301] cgroup_migrate_prepare_dst+0x118/0x620 [ 437.735543][T15301] cgroup_attach_task+0x480/0x870 [ 437.735565][T15301] ? __pfx_cgroup_attach_task+0x10/0x10 [ 437.735586][T15301] ? get_task_cred+0x23/0x300 [ 437.735603][T15301] ? get_task_cred+0x23/0x300 [ 437.735617][T15301] ? get_task_cred+0x23/0x300 [ 437.735634][T15301] ? get_task_cred+0x2c1/0x300 [ 437.735649][T15301] ? get_task_cred+0x23/0x300 [ 437.735669][T15301] __cgroup1_procs_write+0x2dc/0x3d0 [ 437.735694][T15301] ? __pfx___cgroup1_procs_write+0x10/0x10 [ 437.735712][T15301] ? kernfs_root+0x1c/0x230 [ 437.735725][T15301] ? kernfs_root+0x1c/0x230 [ 437.735740][T15301] ? kernfs_root+0x1ea/0x230 [ 437.735757][T15301] ? __pfx_cgroup1_procs_write+0x10/0x10 [ 437.735774][T15301] cgroup_file_write+0x331/0x8f0 [ 437.735795][T15301] ? kernfs_fop_write_iter+0x22b/0x540 [ 437.735819][T15301] ? __pfx_cgroup_file_write+0x10/0x10 [ 437.735839][T15301] ? __kmalloc_noprof+0x396/0x720 [ 437.735861][T15301] ? vfs_write+0x22b/0xba0 [ 437.735878][T15301] ? __kmalloc_noprof+0x1ad/0x720 [ 437.735908][T15301] ? __pfx_cgroup_file_write+0x10/0x10 [ 437.735928][T15301] kernfs_fop_write_iter+0x3a4/0x540 [ 437.735955][T15301] vfs_write+0x612/0xba0 [ 437.735984][T15301] ? __pfx_vfs_write+0x10/0x10 [ 437.736016][T15301] ? __fget_files+0x2a/0x420 [ 437.736043][T15301] ksys_write+0x150/0x270 [ 437.736068][T15301] ? __pfx_ksys_write+0x10/0x10 [ 437.736099][T15301] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.736121][T15301] do_syscall_64+0x174/0x580 [ 437.736137][T15301] ? trace_irq_disable+0x3b/0x140 [ 437.736155][T15301] ? clear_bhb_loop+0x40/0x90 [ 437.736180][T15301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 437.736196][T15301] RIP: 0033:0x7f450779ce59 [ 437.736224][T15301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 437.736240][T15301] RSP: 002b:00007f4508593028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 437.736259][T15301] RAX: ffffffffffffffda RBX: 00007f4507a16090 RCX: 00007f450779ce59 [ 437.736273][T15301] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 000000000000000a [ 437.736285][T15301] RBP: 00007f4508593090 R08: 0000000000000000 R09: 0000000000000000 [ 437.736297][T15301] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 437.736308][T15301] R13: 00007f4507a16128 R14: 00007f4507a16090 R15: 00007ffc673fd468 [ 437.736340][T15301] [ 438.197060][T15305] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2844'. [ 438.494892][T15313] syzkaller0: entered promiscuous mode [ 438.500873][T15313] syzkaller0: entered allmulticast mode [ 438.510312][T15320] FAULT_INJECTION: forcing a failure. [ 438.510312][T15320] name failslab, interval 1, probability 0, space 0, times 0 [ 438.539093][T15320] CPU: 0 UID: 0 PID: 15320 Comm: syz.3.2848 Not tainted syzkaller #0 PREEMPT(full) [ 438.539118][T15320] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 438.539129][T15320] Call Trace: [ 438.539136][T15320] [ 438.539144][T15320] dump_stack_lvl+0xe8/0x150 [ 438.539172][T15320] should_fail_ex+0x40c/0x560 [ 438.539199][T15320] ? __rhashtable_init_noprof+0x545/0xaf0 [ 438.539227][T15320] should_failslab+0xa8/0x100 [ 438.539251][T15320] __kvmalloc_node_noprof+0x176/0x860 [ 438.539276][T15320] ? __rhashtable_init_noprof+0x545/0xaf0 [ 438.539309][T15320] __rhashtable_init_noprof+0x545/0xaf0 [ 438.539342][T15320] __rhltable_init_noprof+0x26/0x70 [ 438.539370][T15320] nf_tables_newtable+0x6a7/0x1950 [ 438.539417][T15320] nfnetlink_rcv+0x1288/0x28c0 [ 438.539470][T15320] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 438.539530][T15320] ? netlink_deliver_tap+0x2e/0x1b0 [ 438.539560][T15320] ? netlink_deliver_tap+0x2e/0x1b0 [ 438.539579][T15320] ? netlink_deliver_tap+0x2e/0x1b0 [ 438.539606][T15320] netlink_unicast+0x7bb/0x940 [ 438.539645][T15320] netlink_sendmsg+0x813/0xb40 [ 438.539675][T15320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 438.539701][T15320] ? aa_sock_msg_perm+0xf1/0x1b0 [ 438.539729][T15320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 438.539749][T15320] sock_sendmsg_nosec+0x13a/0x180 [ 438.539777][T15320] ____sys_sendmsg+0x54e/0x850 [ 438.539803][T15320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 438.539833][T15320] ? import_iovec+0x73/0xa0 [ 438.539857][T15320] ___sys_sendmsg+0x2a5/0x360 [ 438.539877][T15320] ? __lock_acquire+0x683/0x2cf0 [ 438.539900][T15320] ? __pfx____sys_sendmsg+0x10/0x10 [ 438.539953][T15320] ? __fget_files+0x2a/0x420 [ 438.539971][T15320] ? __fget_files+0x3a2/0x420 [ 438.540000][T15320] __x64_sys_sendmsg+0x1b1/0x290 [ 438.540023][T15320] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 438.540062][T15320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.540082][T15320] do_syscall_64+0x174/0x580 [ 438.540097][T15320] ? trace_irq_disable+0x3b/0x140 [ 438.540113][T15320] ? clear_bhb_loop+0x40/0x90 [ 438.540133][T15320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.540149][T15320] RIP: 0033:0x7f1ce499ce59 [ 438.540166][T15320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 438.540182][T15320] RSP: 002b:00007f1ce58f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 438.540201][T15320] RAX: ffffffffffffffda RBX: 00007f1ce4c15fa0 RCX: 00007f1ce499ce59 [ 438.540213][T15320] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 438.540223][T15320] RBP: 00007f1ce58f5090 R08: 0000000000000000 R09: 0000000000000000 [ 438.540233][T15320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 438.540243][T15320] R13: 00007f1ce4c16038 R14: 00007f1ce4c15fa0 R15: 00007ffc8afd3988 [ 438.540270][T15320] [ 439.161625][T15339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2854'. [ 439.227544][T15333] netlink: 'syz.4.2850': attribute type 1 has an invalid length. [ 439.537241][T15352] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2860'. [ 439.749551][T15363] FAULT_INJECTION: forcing a failure. [ 439.749551][T15363] name failslab, interval 1, probability 0, space 0, times 0 [ 439.778727][T15363] CPU: 1 UID: 0 PID: 15363 Comm: syz.4.2862 Not tainted syzkaller #0 PREEMPT(full) [ 439.778753][T15363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 439.778765][T15363] Call Trace: [ 439.778772][T15363] [ 439.778780][T15363] dump_stack_lvl+0xe8/0x150 [ 439.778810][T15363] should_fail_ex+0x40c/0x560 [ 439.778838][T15363] ? __rhashtable_init_noprof+0x545/0xaf0 [ 439.778868][T15363] should_failslab+0xa8/0x100 [ 439.778892][T15363] __kvmalloc_node_noprof+0x176/0x860 [ 439.778917][T15363] ? __rhashtable_init_noprof+0x545/0xaf0 [ 439.778952][T15363] __rhashtable_init_noprof+0x545/0xaf0 [ 439.778984][T15363] __rhltable_init_noprof+0x26/0x70 [ 439.779014][T15363] nf_tables_newtable+0x6a7/0x1950 [ 439.779058][T15363] nfnetlink_rcv+0x1288/0x28c0 [ 439.779109][T15363] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 439.779142][T15363] ? ref_tracker_free+0x689/0x830 [ 439.779189][T15363] ? skb_clone+0x246/0x3a0 [ 439.779214][T15363] ? __netlink_deliver_tap+0x811/0x860 [ 439.779244][T15363] ? netlink_deliver_tap+0x2e/0x1b0 [ 439.779265][T15363] ? netlink_deliver_tap+0x2e/0x1b0 [ 439.779291][T15363] netlink_unicast+0x7bb/0x940 [ 439.779321][T15363] netlink_sendmsg+0x813/0xb40 [ 439.779352][T15363] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.779378][T15363] ? aa_sock_msg_perm+0xf1/0x1b0 [ 439.779405][T15363] ? __pfx_netlink_sendmsg+0x10/0x10 [ 439.779425][T15363] sock_sendmsg_nosec+0x13a/0x180 [ 439.779451][T15363] ____sys_sendmsg+0x54e/0x850 [ 439.779475][T15363] ? __pfx_____sys_sendmsg+0x10/0x10 [ 439.779503][T15363] ? import_iovec+0x73/0xa0 [ 439.779525][T15363] ___sys_sendmsg+0x2a5/0x360 [ 439.779554][T15363] ? __lock_acquire+0x683/0x2cf0 [ 439.779579][T15363] ? __pfx____sys_sendmsg+0x10/0x10 [ 439.779634][T15363] ? __fget_files+0x2a/0x420 [ 439.779652][T15363] ? __fget_files+0x3a2/0x420 [ 439.779681][T15363] __x64_sys_sendmsg+0x1b1/0x290 [ 439.779704][T15363] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 439.779743][T15363] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.779764][T15363] do_syscall_64+0x174/0x580 [ 439.779782][T15363] ? trace_irq_disable+0x3b/0x140 [ 439.779800][T15363] ? clear_bhb_loop+0x40/0x90 [ 439.779823][T15363] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 439.779842][T15363] RIP: 0033:0x7f450779ce59 [ 439.779860][T15363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 439.779877][T15363] RSP: 002b:00007f45085b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 439.779897][T15363] RAX: ffffffffffffffda RBX: 00007f4507a15fa0 RCX: 00007f450779ce59 [ 439.779912][T15363] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 439.779923][T15363] RBP: 00007f45085b4090 R08: 0000000000000000 R09: 0000000000000000 [ 439.779935][T15363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 439.779946][T15363] R13: 00007f4507a16038 R14: 00007f4507a15fa0 R15: 00007ffc673fd468 [ 439.779976][T15363] [ 439.813399][T15366] netlink: 'syz.1.2864': attribute type 3 has an invalid length. [ 440.142500][T15366] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2864'. [ 440.370880][T15386] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 440.377478][T15386] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 440.385806][T15386] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2868'. [ 440.395545][T15386] hsr_slave_0: left promiscuous mode [ 440.401143][T15384] sctp: [Deprecated]: syz.2.2872 (pid 15384) Use of int in max_burst socket option deprecated. [ 440.401143][T15384] Use struct sctp_assoc_value instead [ 440.417074][T15386] hsr_slave_1: left promiscuous mode [ 440.812509][T15410] FAULT_INJECTION: forcing a failure. [ 440.812509][T15410] name failslab, interval 1, probability 0, space 0, times 0 [ 440.837771][T15410] CPU: 1 UID: 0 PID: 15410 Comm: syz.3.2877 Not tainted syzkaller #0 PREEMPT(full) [ 440.837798][T15410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 440.837809][T15410] Call Trace: [ 440.837816][T15410] [ 440.837825][T15410] dump_stack_lvl+0xe8/0x150 [ 440.837852][T15410] should_fail_ex+0x40c/0x560 [ 440.837883][T15410] should_failslab+0xa8/0x100 [ 440.837905][T15410] __kmalloc_cache_noprof+0xa8/0x660 [ 440.837935][T15410] ? nft_pernet+0x23/0x240 [ 440.837951][T15410] ? nf_tables_newchain+0xf9c/0x28b0 [ 440.837976][T15410] ? nf_tables_newchain+0xf9c/0x28b0 [ 440.838009][T15410] nf_tables_newchain+0xf9c/0x28b0 [ 440.838052][T15410] ? __pfx_nf_tables_newchain+0x10/0x10 [ 440.838108][T15410] ? nfnl_pernet+0x23/0x240 [ 440.838127][T15410] ? nfnl_pernet+0x23/0x240 [ 440.838154][T15410] ? __nla_parse+0x40/0x60 [ 440.838186][T15410] nfnetlink_rcv+0x1288/0x28c0 [ 440.838240][T15410] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 440.838305][T15410] ? netlink_deliver_tap+0x2e/0x1b0 [ 440.838336][T15410] ? netlink_deliver_tap+0x2e/0x1b0 [ 440.838356][T15410] ? netlink_deliver_tap+0x2e/0x1b0 [ 440.838383][T15410] netlink_unicast+0x7bb/0x940 [ 440.838419][T15410] netlink_sendmsg+0x813/0xb40 [ 440.838450][T15410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 440.838476][T15410] ? aa_sock_msg_perm+0xf1/0x1b0 [ 440.838504][T15410] ? __pfx_netlink_sendmsg+0x10/0x10 [ 440.838524][T15410] sock_sendmsg_nosec+0x13a/0x180 [ 440.838553][T15410] ____sys_sendmsg+0x54e/0x850 [ 440.838580][T15410] ? __pfx_____sys_sendmsg+0x10/0x10 [ 440.838609][T15410] ? import_iovec+0x73/0xa0 [ 440.838633][T15410] ___sys_sendmsg+0x2a5/0x360 [ 440.838652][T15410] ? __lock_acquire+0x683/0x2cf0 [ 440.838676][T15410] ? __pfx____sys_sendmsg+0x10/0x10 [ 440.838731][T15410] ? __fget_files+0x2a/0x420 [ 440.838750][T15410] ? __fget_files+0x3a2/0x420 [ 440.838778][T15410] __x64_sys_sendmsg+0x1b1/0x290 [ 440.838802][T15410] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 440.838841][T15410] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.838861][T15410] do_syscall_64+0x174/0x580 [ 440.838879][T15410] ? trace_irq_disable+0x3b/0x140 [ 440.838897][T15410] ? clear_bhb_loop+0x40/0x90 [ 440.838920][T15410] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 440.838939][T15410] RIP: 0033:0x7f1ce499ce59 [ 440.838957][T15410] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 440.838973][T15410] RSP: 002b:00007f1ce58f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 440.838993][T15410] RAX: ffffffffffffffda RBX: 00007f1ce4c15fa0 RCX: 00007f1ce499ce59 [ 440.839007][T15410] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 440.839019][T15410] RBP: 00007f1ce58f5090 R08: 0000000000000000 R09: 0000000000000000 [ 440.839031][T15410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 440.839042][T15410] R13: 00007f1ce4c16038 R14: 00007f1ce4c15fa0 R15: 00007ffc8afd3988 [ 440.839073][T15410] [ 441.282759][T15413] xt_CT: No such helper "snmp_trap" [ 441.369551][T15420] FAULT_INJECTION: forcing a failure. [ 441.369551][T15420] name failslab, interval 1, probability 0, space 0, times 0 [ 441.382604][T15420] CPU: 0 UID: 0 PID: 15420 Comm: syz.0.2882 Not tainted syzkaller #0 PREEMPT(full) [ 441.382631][T15420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 441.382642][T15420] Call Trace: [ 441.382650][T15420] [ 441.382657][T15420] dump_stack_lvl+0xe8/0x150 [ 441.382686][T15420] should_fail_ex+0x40c/0x560 [ 441.382715][T15420] ? nf_hook_entries_grow+0x287/0x740 [ 441.382742][T15420] should_failslab+0xa8/0x100 [ 441.382766][T15420] __kvmalloc_node_noprof+0x176/0x860 [ 441.382789][T15420] ? __nf_register_net_hook+0x232/0x930 [ 441.382811][T15420] ? nf_hook_entries_grow+0x287/0x740 [ 441.382835][T15420] ? __pfx___mutex_lock+0x10/0x10 [ 441.382867][T15420] nf_hook_entries_grow+0x287/0x740 [ 441.382903][T15420] __nf_register_net_hook+0x2c9/0x930 [ 441.382932][T15420] ? nf_register_net_hook+0xc8/0x190 [ 441.382960][T15420] nf_register_net_hook+0xb2/0x190 [ 441.382983][T15420] nf_register_net_hooks+0x44/0x1b0 [ 441.383010][T15420] nf_ct_netns_do_get+0x3bf/0x5c0 [ 441.383039][T15420] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 441.383062][T15420] ? trace_kmalloc+0x2a/0xf0 [ 441.383098][T15420] ? __bitmap_set+0x12f/0x170 [ 441.383124][T15420] ? nf_ct_netns_get+0xe9/0x320 [ 441.383152][T15420] nft_ct_get_init+0x5bf/0x9c0 [ 441.383182][T15420] nf_tables_newrule+0x179e/0x28a0 [ 441.383225][T15420] ? __pfx_nf_tables_newrule+0x10/0x10 [ 441.383249][T15420] ? nfnl_pernet+0x23/0x240 [ 441.383267][T15420] ? nfnl_pernet+0x23/0x240 [ 441.383295][T15420] ? __nla_parse+0x40/0x60 [ 441.383327][T15420] nfnetlink_rcv+0x1288/0x28c0 [ 441.383378][T15420] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 441.383445][T15420] ? netlink_deliver_tap+0x2e/0x1b0 [ 441.383477][T15420] ? netlink_deliver_tap+0x2e/0x1b0 [ 441.383498][T15420] ? netlink_deliver_tap+0x2e/0x1b0 [ 441.383525][T15420] netlink_unicast+0x7bb/0x940 [ 441.383550][T15420] netlink_sendmsg+0x813/0xb40 [ 441.383578][T15420] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.383606][T15420] ? aa_sock_msg_perm+0xf1/0x1b0 [ 441.383634][T15420] ? __pfx_netlink_sendmsg+0x10/0x10 [ 441.383654][T15420] sock_sendmsg_nosec+0x13a/0x180 [ 441.383683][T15420] ____sys_sendmsg+0x54e/0x850 [ 441.383718][T15420] ? __pfx_____sys_sendmsg+0x10/0x10 [ 441.383748][T15420] ? import_iovec+0x73/0xa0 [ 441.383781][T15420] ___sys_sendmsg+0x2a5/0x360 [ 441.383804][T15420] ? __lock_acquire+0x683/0x2cf0 [ 441.383828][T15420] ? __pfx____sys_sendmsg+0x10/0x10 [ 441.383891][T15420] ? __fget_files+0x2a/0x420 [ 441.383910][T15420] ? __fget_files+0x3a2/0x420 [ 441.383939][T15420] __x64_sys_sendmsg+0x1b1/0x290 [ 441.383961][T15420] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 441.384001][T15420] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.384022][T15420] do_syscall_64+0x174/0x580 [ 441.384039][T15420] ? trace_irq_disable+0x3b/0x140 [ 441.384056][T15420] ? clear_bhb_loop+0x40/0x90 [ 441.384080][T15420] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 441.384099][T15420] RIP: 0033:0x7fc4bdd9ce59 [ 441.384117][T15420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 441.384134][T15420] RSP: 002b:00007fc4bebdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 441.384154][T15420] RAX: ffffffffffffffda RBX: 00007fc4be015fa0 RCX: 00007fc4bdd9ce59 [ 441.384168][T15420] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 441.384179][T15420] RBP: 00007fc4bebdf090 R08: 0000000000000000 R09: 0000000000000000 [ 441.384190][T15420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 441.384201][T15420] R13: 00007fc4be016038 R14: 00007fc4be015fa0 R15: 00007ffc536b62d8 [ 441.384232][T15420] [ 441.541222][T15417] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2880'. [ 441.635285][T15430] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 442.174327][T15450] x_tables: unsorted underflow at hook 1 [ 442.427415][T15463] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2895'. [ 442.436416][T15463] openvswitch: netlink: Flow actions attr not present in new flow. [ 442.821682][T15490] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 442.919412][T15495] syzkaller0: entered promiscuous mode [ 442.924938][T15495] syzkaller0: entered allmulticast mode [ 442.974757][T15497] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 443.049052][T15495] tipc: Enabled bearer , priority 0 [ 443.131998][T15501] FAULT_INJECTION: forcing a failure. [ 443.131998][T15501] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 443.161594][T15501] CPU: 1 UID: 0 PID: 15501 Comm: syz.2.2911 Not tainted syzkaller #0 PREEMPT(full) [ 443.161622][T15501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 443.161633][T15501] Call Trace: [ 443.161640][T15501] [ 443.161648][T15501] dump_stack_lvl+0xe8/0x150 [ 443.161677][T15501] should_fail_ex+0x40c/0x560 [ 443.161707][T15501] _copy_from_user+0x2d/0xb0 [ 443.161729][T15501] kstrtouint_from_user+0xd6/0x180 [ 443.161756][T15501] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 443.161804][T15501] proc_fail_nth_write+0x8e/0x210 [ 443.161824][T15501] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 443.161850][T15501] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 443.161868][T15501] vfs_write+0x296/0xba0 [ 443.161899][T15501] ? __pfx_vfs_write+0x10/0x10 [ 443.161921][T15501] ? __fget_files+0x2a/0x420 [ 443.161942][T15501] ? __fget_files+0x3a2/0x420 [ 443.161958][T15501] ? __fget_files+0x2a/0x420 [ 443.161983][T15501] ksys_write+0x150/0x270 [ 443.162008][T15501] ? __pfx_ksys_write+0x10/0x10 [ 443.162037][T15501] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.162057][T15501] do_syscall_64+0x174/0x580 [ 443.162075][T15501] ? trace_irq_disable+0x3b/0x140 [ 443.162092][T15501] ? clear_bhb_loop+0x40/0x90 [ 443.162116][T15501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.162135][T15501] RIP: 0033:0x7f685fd5d68e [ 443.162152][T15501] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 443.162168][T15501] RSP: 002b:00007f6860d08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 443.162188][T15501] RAX: ffffffffffffffda RBX: 00007f6860d096c0 RCX: 00007f685fd5d68e [ 443.162201][T15501] RDX: 0000000000000001 RSI: 00007f6860d090a0 RDI: 0000000000000004 [ 443.162213][T15501] RBP: 00007f6860d09090 R08: 0000000000000000 R09: 0000000000000000 [ 443.162225][T15501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 443.162236][T15501] R13: 00007f6860016038 R14: 00007f6860015fa0 R15: 00007ffeeab6aaa8 [ 443.162267][T15501] [ 443.164612][T15506] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2910'. [ 443.510087][T15518] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 443.565893][T15516] FAULT_INJECTION: forcing a failure. [ 443.565893][T15516] name failslab, interval 1, probability 0, space 0, times 0 [ 443.579743][T15516] CPU: 1 UID: 0 PID: 15516 Comm: syz.4.2915 Not tainted syzkaller #0 PREEMPT(full) [ 443.579776][T15516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 443.579787][T15516] Call Trace: [ 443.579795][T15516] [ 443.579802][T15516] dump_stack_lvl+0xe8/0x150 [ 443.579831][T15516] should_fail_ex+0x40c/0x560 [ 443.579862][T15516] should_failslab+0xa8/0x100 [ 443.579886][T15516] kmem_cache_alloc_lru_noprof+0xa7/0x5f0 [ 443.579917][T15516] ? alloc_inode+0x6a/0x1b0 [ 443.579942][T15516] ? alloc_inode+0x6a/0x1b0 [ 443.579974][T15516] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 443.580000][T15516] alloc_inode+0x6a/0x1b0 [ 443.580028][T15516] new_inode+0x1f/0x170 [ 443.580050][T15516] __debugfs_create_file+0xb8/0x400 [ 443.580081][T15516] debugfs_create_file_full+0x3f/0x60 [ 443.580110][T15516] ref_tracker_dir_debugfs+0x197/0x360 [ 443.580138][T15516] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 443.580191][T15516] ? __kvmalloc_node_noprof+0x55a/0x860 [ 443.580214][T15516] ? __kvmalloc_node_noprof+0x35c/0x860 [ 443.580238][T15516] ? __raw_spin_lock_init+0x45/0x100 [ 443.580266][T15516] alloc_netdev_mqs+0x275/0x12b0 [ 443.580288][T15516] ? __pfx_snprintf+0x10/0x10 [ 443.580311][T15516] ? __pfx_ipgre_tap_setup+0x10/0x10 [ 443.580340][T15516] rtnl_create_link+0x321/0xd70 [ 443.580371][T15516] rtnl_newlink_create+0x25f/0xb00 [ 443.580398][T15516] ? __mutex_lock+0x5d4/0x1550 [ 443.580421][T15516] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 443.580446][T15516] ? __pfx___mutex_lock+0x10/0x10 [ 443.580475][T15516] ? ns_capable+0x89/0xe0 [ 443.580505][T15516] rtnl_newlink+0x167f/0x1bd0 [ 443.580541][T15516] ? __pfx_rtnl_newlink+0x10/0x10 [ 443.580557][T15516] ? do_syscall_64+0x174/0x580 [ 443.580573][T15516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.580629][T15516] ? kasan_quarantine_put+0xbb/0x1f0 [ 443.580658][T15516] ? lockdep_hardirqs_on+0x7a/0x110 [ 443.580690][T15516] ? nlmon_xmit+0xb0/0x100 [ 443.580706][T15516] ? kmem_cache_free+0x182/0x650 [ 443.580736][T15516] ? __lock_acquire+0x683/0x2cf0 [ 443.580767][T15516] ? __dev_queue_xmit+0x29b/0x37f0 [ 443.580792][T15516] ? __local_bh_enable_ip+0xd0/0x130 [ 443.580819][T15516] ? lockdep_hardirqs_on+0x7a/0x110 [ 443.580846][T15516] ? __dev_queue_xmit+0x29b/0x37f0 [ 443.580865][T15516] ? __local_bh_enable_ip+0xd0/0x130 [ 443.580911][T15516] ? __dev_queue_xmit+0x29b/0x37f0 [ 443.580940][T15516] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 443.580986][T15516] ? __pfx_rtnl_newlink+0x10/0x10 [ 443.581003][T15516] rtnetlink_rcv_msg+0x802/0xc00 [ 443.581036][T15516] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 443.581065][T15516] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 443.581091][T15516] ? ref_tracker_free+0x689/0x830 [ 443.581120][T15516] ? __pfx_ref_tracker_free+0x10/0x10 [ 443.581158][T15516] netlink_rcv_skb+0x226/0x4a0 [ 443.581181][T15516] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 443.581212][T15516] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 443.581248][T15516] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.581268][T15516] ? netlink_deliver_tap+0x2e/0x1b0 [ 443.581296][T15516] netlink_unicast+0x7bb/0x940 [ 443.581327][T15516] netlink_sendmsg+0x813/0xb40 [ 443.581359][T15516] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.581386][T15516] ? aa_sock_msg_perm+0xf1/0x1b0 [ 443.581415][T15516] ? __pfx_netlink_sendmsg+0x10/0x10 [ 443.581436][T15516] sock_sendmsg_nosec+0x13a/0x180 [ 443.581465][T15516] ____sys_sendmsg+0x54e/0x850 [ 443.581493][T15516] ? __pfx_____sys_sendmsg+0x10/0x10 [ 443.581524][T15516] ? import_iovec+0x73/0xa0 [ 443.581548][T15516] ___sys_sendmsg+0x2a5/0x360 [ 443.581567][T15516] ? __lock_acquire+0x683/0x2cf0 [ 443.581591][T15516] ? __pfx____sys_sendmsg+0x10/0x10 [ 443.581651][T15516] ? __fget_files+0x2a/0x420 [ 443.581669][T15516] ? __fget_files+0x3a2/0x420 [ 443.581699][T15516] __x64_sys_sendmsg+0x1b1/0x290 [ 443.581723][T15516] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 443.581769][T15516] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.581790][T15516] do_syscall_64+0x174/0x580 [ 443.581807][T15516] ? trace_irq_disable+0x3b/0x140 [ 443.581826][T15516] ? clear_bhb_loop+0x40/0x90 [ 443.581850][T15516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.581869][T15516] RIP: 0033:0x7f450779ce59 [ 443.581887][T15516] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.581903][T15516] RSP: 002b:00007f45085b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 443.581923][T15516] RAX: ffffffffffffffda RBX: 00007f4507a15fa0 RCX: 00007f450779ce59 [ 443.581938][T15516] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 443.581950][T15516] RBP: 00007f45085b4090 R08: 0000000000000000 R09: 0000000000000000 [ 443.581962][T15516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.581973][T15516] R13: 00007f4507a16038 R14: 00007f4507a15fa0 R15: 00007ffc673fd468 [ 443.582005][T15516] [ 443.582039][T15516] debugfs: out of free dentries, can not create file 'netdev@ffff888030f6c700' [ 444.080136][T15489] tipc: Resetting bearer [ 444.107366][T15489] tipc: Disabling bearer [ 444.130322][T15535] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 444.445327][T15548] netlink: 768 bytes leftover after parsing attributes in process `syz.1.2926'. [ 444.551740][T15552] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2930'. [ 444.654660][T15559] IPv6: NLM_F_REPLACE set, but no existing node found! [ 444.755658][T15568] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2933'. [ 444.838258][T15571] syzkaller1: entered promiscuous mode [ 444.860102][T15571] syzkaller1: entered allmulticast mode [ 445.367551][T15603] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2951'. [ 445.416622][T15606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2950'. [ 445.425530][T15606] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2950'. [ 445.614044][T15613] syzkaller1: entered promiscuous mode [ 445.619668][T15613] syzkaller1: entered allmulticast mode [ 445.910121][T15642] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2963'. [ 445.977083][T15647] FAULT_INJECTION: forcing a failure. [ 445.977083][T15647] name failslab, interval 1, probability 0, space 0, times 0 [ 445.989530][T15649] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 445.990048][T15647] CPU: 1 UID: 0 PID: 15647 Comm: syz.4.2967 Not tainted syzkaller #0 PREEMPT(full) [ 445.990072][T15647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 445.990083][T15647] Call Trace: [ 445.990092][T15647] [ 445.990099][T15647] dump_stack_lvl+0xe8/0x150 [ 445.990126][T15647] should_fail_ex+0x40c/0x560 [ 445.990157][T15647] should_failslab+0xa8/0x100 [ 445.990179][T15647] kmem_cache_alloc_noprof+0xa6/0x5f0 [ 445.990207][T15647] ? security_file_alloc+0x34/0x310 [ 445.990233][T15647] ? security_file_alloc+0x34/0x310 [ 445.990266][T15647] security_file_alloc+0x34/0x310 [ 445.990296][T15647] init_file+0x90/0x2b0 [ 445.990325][T15647] alloc_empty_file+0x74/0x1d0 [ 445.990353][T15647] alloc_file_pseudo+0x115/0x1e0 [ 445.990382][T15647] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 445.990411][T15647] ? _raw_spin_unlock+0x28/0x50 [ 445.990434][T15647] ? alloc_fd+0x651/0x6c0 [ 445.990463][T15647] sock_alloc_file+0xb8/0x2e0 [ 445.990486][T15647] ? sctp_getsockopt_peeloff_common+0x525/0x7e0 [ 445.990509][T15647] sctp_getsockopt_peeloff_common+0x536/0x7e0 [ 445.990534][T15647] ? __pfx_sctp_getsockopt_peeloff_common+0x10/0x10 [ 445.990563][T15647] sctp_getsockopt_peeloff_flags+0x14b/0x240 [ 445.990592][T15647] ? __pfx_sctp_getsockopt_peeloff_flags+0x10/0x10 [ 445.990615][T15647] ? sctp_getsockopt+0x12f/0xb90 [ 445.990635][T15647] ? __local_bh_enable_ip+0xd0/0x130 [ 445.990665][T15647] sctp_getsockopt+0x3a5/0xb90 [ 445.990684][T15647] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 445.990709][T15647] do_sock_getsockopt+0x51d/0x7e0 [ 445.990734][T15647] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 445.990768][T15647] ? __fget_files+0x3a2/0x420 [ 445.990785][T15647] ? __fget_files+0x2a/0x420 [ 445.990809][T15647] __x64_sys_getsockopt+0x1a4/0x240 [ 445.990834][T15647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.990854][T15647] do_syscall_64+0x174/0x580 [ 445.990870][T15647] ? trace_irq_disable+0x3b/0x140 [ 445.990887][T15647] ? clear_bhb_loop+0x40/0x90 [ 445.990909][T15647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 445.990928][T15647] RIP: 0033:0x7f450779ce59 [ 445.990945][T15647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 445.990966][T15647] RSP: 002b:00007f45085b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 445.990985][T15647] RAX: ffffffffffffffda RBX: 00007f4507a15fa0 RCX: 00007f450779ce59 [ 445.990999][T15647] RDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003 [ 445.991010][T15647] RBP: 00007f45085b4090 R08: 0000200000000040 R09: 0000000000000000 [ 445.991022][T15647] R10: 0000200000000340 R11: 0000000000000246 R12: 0000000000000002 [ 445.991033][T15647] R13: 00007f4507a16038 R14: 00007f4507a15fa0 R15: 00007ffc673fd468 [ 445.991062][T15647] [ 446.519320][T15656] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 446.716898][T15674] FAULT_INJECTION: forcing a failure. [ 446.716898][T15674] name failslab, interval 1, probability 0, space 0, times 0 [ 446.748155][T15674] CPU: 1 UID: 0 PID: 15674 Comm: syz.0.2975 Not tainted syzkaller #0 PREEMPT(full) [ 446.748183][T15674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 446.748194][T15674] Call Trace: [ 446.748201][T15674] [ 446.748209][T15674] dump_stack_lvl+0xe8/0x150 [ 446.748238][T15674] should_fail_ex+0x40c/0x560 [ 446.748270][T15674] should_failslab+0xa8/0x100 [ 446.748294][T15674] __kmalloc_cache_noprof+0xa8/0x660 [ 446.748326][T15674] ? __hw_addr_create+0x62/0x240 [ 446.748345][T15674] ? __hw_addr_create+0x62/0x240 [ 446.748371][T15674] __hw_addr_create+0x62/0x240 [ 446.748403][T15674] __hw_addr_add_ex+0x1ce/0x520 [ 446.748431][T15674] dev_addr_init+0x15a/0x240 [ 446.748453][T15674] ? __pfx_dev_addr_init+0x10/0x10 [ 446.748478][T15674] ? __kvmalloc_node_noprof+0x35c/0x860 [ 446.748506][T15674] alloc_netdev_mqs+0x2b4/0x12b0 [ 446.748529][T15674] ? __pfx_snprintf+0x10/0x10 [ 446.748552][T15674] ? __pfx_ipgre_tap_setup+0x10/0x10 [ 446.748581][T15674] rtnl_create_link+0x321/0xd70 [ 446.748612][T15674] rtnl_newlink_create+0x25f/0xb00 [ 446.748643][T15674] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 446.748668][T15674] ? __pfx___mutex_lock+0x10/0x10 [ 446.748696][T15674] ? ns_capable+0x89/0xe0 [ 446.748726][T15674] rtnl_newlink+0x167f/0x1bd0 [ 446.748761][T15674] ? __pfx_rtnl_newlink+0x10/0x10 [ 446.748779][T15674] ? __lock_acquire+0x683/0x2cf0 [ 446.748805][T15674] ? __lock_acquire+0x683/0x2cf0 [ 446.748838][T15674] ? unwind_next_frame+0x8f/0x2550 [ 446.748871][T15674] ? is_bpf_text_address+0x26/0x2b0 [ 446.748899][T15674] ? is_bpf_text_address+0x26/0x2b0 [ 446.748920][T15674] ? __lock_acquire+0x683/0x2cf0 [ 446.748943][T15674] ? kernel_text_address+0xa5/0xe0 [ 446.748967][T15674] ? __kernel_text_address+0xd/0x30 [ 446.748988][T15674] ? unwind_get_return_address+0x4d/0x90 [ 446.749012][T15674] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 446.749041][T15674] ? arch_stack_walk+0xfb/0x150 [ 446.749076][T15674] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 446.749121][T15674] ? __pfx_rtnl_newlink+0x10/0x10 [ 446.749137][T15674] rtnetlink_rcv_msg+0x802/0xc00 [ 446.749162][T15674] ? netlink_sendmsg+0x5d4/0xb40 [ 446.749184][T15674] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 446.749210][T15674] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 446.749239][T15674] ? __lock_acquire+0x683/0x2cf0 [ 446.749270][T15674] netlink_rcv_skb+0x226/0x4a0 [ 446.749291][T15674] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 446.749320][T15674] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 446.749350][T15674] ? netlink_deliver_tap+0x2e/0x1b0 [ 446.749371][T15674] ? netlink_deliver_tap+0x2e/0x1b0 [ 446.749404][T15674] netlink_unicast+0x7bb/0x940 [ 446.749433][T15674] netlink_sendmsg+0x813/0xb40 [ 446.749463][T15674] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.749488][T15674] ? aa_sock_msg_perm+0xf1/0x1b0 [ 446.749516][T15674] ? __pfx_netlink_sendmsg+0x10/0x10 [ 446.749537][T15674] sock_sendmsg_nosec+0x13a/0x180 [ 446.749564][T15674] ____sys_sendmsg+0x54e/0x850 [ 446.749591][T15674] ? __pfx_____sys_sendmsg+0x10/0x10 [ 446.749621][T15674] ? import_iovec+0x73/0xa0 [ 446.749644][T15674] ___sys_sendmsg+0x2a5/0x360 [ 446.749663][T15674] ? __lock_acquire+0x683/0x2cf0 [ 446.749686][T15674] ? __pfx____sys_sendmsg+0x10/0x10 [ 446.749742][T15674] ? __fget_files+0x2a/0x420 [ 446.749760][T15674] ? __fget_files+0x3a2/0x420 [ 446.749787][T15674] __x64_sys_sendmsg+0x1b1/0x290 [ 446.749808][T15674] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 446.749845][T15674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.749864][T15674] do_syscall_64+0x174/0x580 [ 446.749878][T15674] ? trace_irq_disable+0x3b/0x140 [ 446.749895][T15674] ? clear_bhb_loop+0x40/0x90 [ 446.749917][T15674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.749936][T15674] RIP: 0033:0x7fc4bdd9ce59 [ 446.749954][T15674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 446.749971][T15674] RSP: 002b:00007fc4bebdf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.749991][T15674] RAX: ffffffffffffffda RBX: 00007fc4be015fa0 RCX: 00007fc4bdd9ce59 [ 446.750005][T15674] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 446.750017][T15674] RBP: 00007fc4bebdf090 R08: 0000000000000000 R09: 0000000000000000 [ 446.750029][T15674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 446.750040][T15674] R13: 00007fc4be016038 R14: 00007fc4be015fa0 R15: 00007ffc536b62d8 [ 446.750072][T15674] [ 447.243505][T15678] netlink: 'syz.2.2977': attribute type 32 has an invalid length. [ 447.271520][T15678] bridge_slave_1: left allmulticast mode [ 447.277223][T15678] bridge_slave_1: left promiscuous mode [ 447.283015][T15678] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.313897][T15678] bridge_slave_0: left allmulticast mode [ 447.320459][T15678] bridge_slave_0: left promiscuous mode [ 447.327165][T15678] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.377534][T15688] IPv6: NLM_F_REPLACE set, but no existing node found! [ 447.460850][T15681] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 447.473761][T15681] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 447.482486][T15681] gretap3: entered promiscuous mode [ 447.503582][T15681] gretap3: entered allmulticast mode [ 447.556449][T15685] syzkaller1: entered promiscuous mode [ 447.581439][T15685] syzkaller1: entered allmulticast mode [ 447.654473][T15699] __nla_validate_parse: 2 callbacks suppressed [ 447.654491][T15699] netlink: 516 bytes leftover after parsing attributes in process `syz.3.2984'. [ 447.693569][T15699] openvswitch: netlink: Missing key (keys=40, expected=100) [ 447.767388][T15708] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2988'. [ 447.778328][T15708] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2988'. [ 447.787595][T15709] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2988'. [ 447.841656][T15711] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2989'. [ 448.076460][T15723] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2994'. [ 448.217588][T15739] FAULT_INJECTION: forcing a failure. [ 448.217588][T15739] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 448.248987][T15739] CPU: 1 UID: 0 PID: 15739 Comm: syz.0.2998 Not tainted syzkaller #0 PREEMPT(full) [ 448.249012][T15739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 448.249023][T15739] Call Trace: [ 448.249031][T15739] [ 448.249038][T15739] dump_stack_lvl+0xe8/0x150 [ 448.249064][T15739] should_fail_ex+0x40c/0x560 [ 448.249094][T15739] _copy_to_user+0x31/0xb0 [ 448.249116][T15739] simple_read_from_buffer+0xe1/0x170 [ 448.249142][T15739] proc_fail_nth_read+0x1bb/0x230 [ 448.249165][T15739] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 448.249186][T15739] ? rw_verify_area+0x24a/0x4c0 [ 448.249207][T15739] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 448.249225][T15739] vfs_read+0x213/0xa80 [ 448.249251][T15739] ? __pfx___mutex_lock+0x10/0x10 [ 448.249270][T15739] ? __pfx_vfs_read+0x10/0x10 [ 448.249294][T15739] ? __fget_files+0x2a/0x420 [ 448.249317][T15739] ? __fget_files+0x3a2/0x420 [ 448.249333][T15739] ? __fget_files+0x2a/0x420 [ 448.249368][T15739] ksys_read+0x150/0x270 [ 448.249392][T15739] ? __pfx_ksys_read+0x10/0x10 [ 448.249420][T15739] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.249440][T15739] do_syscall_64+0x174/0x580 [ 448.249455][T15739] ? trace_irq_disable+0x3b/0x140 [ 448.249472][T15739] ? clear_bhb_loop+0x40/0x90 [ 448.249495][T15739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 448.249514][T15739] RIP: 0033:0x7fc4bdd5d68e [ 448.249529][T15739] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 448.249544][T15739] RSP: 002b:00007fc4bebbdfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 448.249563][T15739] RAX: ffffffffffffffda RBX: 00007fc4bebbe6c0 RCX: 00007fc4bdd5d68e [ 448.249575][T15739] RDX: 000000000000000f RSI: 00007fc4bebbe0a0 RDI: 000000000000000b [ 448.249585][T15739] RBP: 00007fc4bebbe090 R08: 0000000000000000 R09: 0000000000000000 [ 448.249595][T15739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 448.249604][T15739] R13: 00007fc4be016128 R14: 00007fc4be016090 R15: 00007ffc536b62d8 [ 448.249633][T15739] [ 448.254797][T15743] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3001'. [ 448.334262][T15745] syzkaller1: entered promiscuous mode [ 448.516691][T15745] syzkaller1: entered allmulticast mode [ 448.592696][T15750] h: entered promiscuous mode [ 448.795615][T15769] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3008'. [ 448.815595][T15769] netlink: 6 bytes leftover after parsing attributes in process `syz.2.3008'. [ 448.947239][T15777] IPv6: NLM_F_REPLACE set, but no existing node found! [ 449.038181][T15782] IPv6: NLM_F_REPLACE set, but no existing node found! [ 449.056817][T15774] bond8: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 449.094861][T15774] bond8 (unregistering): Released all slaves [ 449.340181][T15801] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3018'. [ 449.492220][T15805] syzkaller1: entered promiscuous mode [ 449.499433][T15805] syzkaller1: entered allmulticast mode [ 449.763397][T15819] team0: Device ipvlan2 failed to register rx_handler [ 450.309737][T15844] openvswitch: netlink: IP tunnel dst address not specified [ 450.436566][T15850] syzkaller1: entered promiscuous mode [ 450.442083][T15850] syzkaller1: entered allmulticast mode [ 450.673620][T15860] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 451.244410][T15896] syzkaller1: entered promiscuous mode [ 451.249998][T15896] syzkaller1: entered allmulticast mode [ 451.251533][T15898] IPv6: NLM_F_REPLACE set, but no existing node found! [ 451.370316][T15902] team0: Device gtp2 is up. Set it down before adding it as a team port [ 451.426236][T15903] netlink: 'syz.2.3057': attribute type 1 has an invalid length. [ 452.482240][T15946] syzkaller1: entered promiscuous mode [ 452.488591][T15946] syzkaller1: entered allmulticast mode [ 452.604789][T15947] bond8: entered promiscuous mode [ 452.656850][T15947] bond8: entered allmulticast mode [ 452.667197][T15956] x_tables: duplicate underflow at hook 4 [ 452.680119][T15947] 8021q: adding VLAN 0 to HW filter on device bond8 [ 453.275059][T15992] __nla_validate_parse: 16 callbacks suppressed [ 453.275077][T15992] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3087'. [ 453.516198][T16005] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3090'. [ 455.299240][T15987] bond0: (slave bond_slave_1): Error: Device is in use and cannot be enslaved [ 455.321137][T16002] dvmrp0: left allmulticast mode [ 455.754724][T16020] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 456.195062][T16040] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3104'. [ 456.292492][T16040] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 456.331735][T16043] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 456.340809][T16046] netlink: 'syz.2.3103': attribute type 1 has an invalid length. [ 456.834751][T16063] netlink: 'syz.3.3110': attribute type 29 has an invalid length. [ 459.179416][T16088] x_tables: duplicate underflow at hook 3 [ 459.336617][T16101] netlink: 'syz.4.3123': attribute type 2 has an invalid length. [ 459.773458][T16121] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 459.790058][T16121] xt_SECMARK: invalid mode: 9 [ 459.904766][T16130] netlink: 'syz.4.3133': attribute type 1 has an invalid length. [ 459.942476][T16132] netlink: 340 bytes leftover after parsing attributes in process `syz.3.3136'. [ 459.961605][T16130] netlink: 'syz.4.3133': attribute type 2 has an invalid length. [ 460.000790][T16130] netlink: 'syz.4.3133': attribute type 1 has an invalid length. [ 460.025421][T16130] netlink: 'syz.4.3133': attribute type 2 has an invalid length. [ 460.035076][T16130] netlink: 'syz.4.3133': attribute type 2 has an invalid length. [ 460.115867][T16139] IPv6: NLM_F_REPLACE set, but no existing node found! [ 460.210653][T16148] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3140'. [ 460.223470][T16148] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.009985][T16188] Cannot find del_set index 3 as target [ 461.257585][T16201] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3159'. [ 461.590312][T16221] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3167'. [ 461.614203][T16221] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3167'. [ 461.701346][T16224] bridge6: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 461.771034][T16228] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3170'. [ 461.780041][T16228] netlink: 'syz.2.3170': attribute type 7 has an invalid length. [ 461.801678][T16228] netlink: 'syz.2.3170': attribute type 8 has an invalid length. [ 461.809458][T16228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3170'. [ 462.088327][T16249] syzkaller0: entered promiscuous mode [ 462.093892][T16249] syzkaller0: entered allmulticast mode [ 462.179532][T16258] netlink: 'syz.4.3177': attribute type 30 has an invalid length. [ 462.205092][T16258] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 462.654652][T16287] bond8: entered promiscuous mode [ 462.671222][T16287] 8021q: adding VLAN 0 to HW filter on device bond8 [ 462.736575][T16287] macvtap3: entered allmulticast mode [ 462.764987][T16287] macvtap4: entered allmulticast mode [ 462.791170][T16287] bridge7: entered promiscuous mode [ 462.799826][T16287] bond8: (slave bridge7): Enslaving as an active interface with an up link [ 463.048042][T16304] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3190'. [ 463.068391][T16304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3190'. [ 463.359731][T16321] netlink: 'syz.1.3192': attribute type 4 has an invalid length. [ 463.521152][T16333] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3198'. [ 463.556179][T16334] tipc: Enabled bearer , priority 0 [ 463.564480][T16334] syzkaller0: entered promiscuous mode [ 463.574561][T16334] syzkaller0: entered allmulticast mode [ 463.583062][T16334] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 463.608496][T16334] tipc: Resetting bearer [ 463.683047][T16341] tipc: Enabling of bearer rejected, failed to enable media [ 464.265903][T16326] tipc: Resetting bearer [ 464.269786][T16376] netlink: 'syz.3.3213': attribute type 1 has an invalid length. [ 464.309832][T16326] tipc: Disabling bearer [ 464.396665][T16376] 8021q: adding VLAN 0 to HW filter on device bond10 [ 464.482138][T16376] bond10: (slave geneve4): making interface the new active one [ 464.499303][T16376] bond10: (slave geneve4): Enslaving as an active interface with an up link [ 464.508618][ T6169] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.527018][ T6169] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.548609][ T6169] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.557782][ T6169] netdevsim netdevsim3 netdevsim3: set [1, 1] type 2 family 0 port 6081 - 0 [ 464.837459][T16403] pim6reg: entered allmulticast mode [ 464.861973][T16403] pim6reg: left allmulticast mode [ 465.331882][T16442] netlink: 'syz.3.3232': attribute type 17 has an invalid length. [ 465.434360][T16442] __nla_validate_parse: 4 callbacks suppressed [ 465.434376][T16442] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3232'. [ 465.532062][T16452] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3236'. [ 465.596388][T16457] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3239'. [ 465.894798][T16475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3246'. [ 465.936123][T16475] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3246'. [ 466.076234][T16484] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3250'. [ 466.221076][T16490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3251'. [ 466.539211][T16510] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3261'. [ 466.563422][T16510] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3261'. [ 466.579035][T16513] netlink: 'syz.4.3259': attribute type 10 has an invalid length. [ 466.599201][T16513] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3259'. [ 466.638588][T16513] A link change request failed with some changes committed already. Interface geneve1 may have been left with an inconsistent configuration, please check. [ 466.966190][T16536] tipc: Enabled bearer , priority 0 [ 466.992720][T16537] syzkaller0: MTU too low for tipc bearer [ 467.003256][T16537] tipc: Disabling bearer [ 467.715495][T16589] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 467.769369][T16589] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 467.896308][ T48] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.371125][T16640] lo speed is unknown, defaulting to 1000 [ 468.403735][T16637] syzkaller0: entered promiscuous mode [ 468.429114][T16637] syzkaller0: entered allmulticast mode [ 468.934277][T16640] lo speed is unknown, defaulting to 1000 [ 468.934289][T16644] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 468.980335][T16644] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 469.076526][ T5289] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 469.122893][T16640] lo speed is unknown, defaulting to 1000 [ 469.135912][T16640] smbdirect: ib_dev[syú2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 469.151264][T16640] smbdirect: ib_dev[syú2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 469.182106][T16640] smbdirect: ib_dev[syú2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 469.307758][T16640] infiniband syú2: RDMA CMA: cma_listen_on_dev, error -98 [ 469.493450][T16640] lo speed is unknown, defaulting to 1000 [ 469.550546][T16640] lo speed is unknown, defaulting to 1000 [ 469.593188][T16640] lo speed is unknown, defaulting to 1000 [ 469.607891][T16640] lo speed is unknown, defaulting to 1000 [ 469.617425][T16640] lo speed is unknown, defaulting to 1000 [ 469.859454][T16699] syzkaller0: entered promiscuous mode [ 469.875503][T16699] syzkaller0: entered allmulticast mode [ 469.982820][T16707] netlink: 'syz.2.3328': attribute type 33 has an invalid length. [ 470.179266][T16707] bond8: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 470.191212][T16707] bond8 (unregistering): Released all slaves [ 470.539208][T16735] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 470.578643][T16735] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 470.609077][T16735] batman_adv: batadv0: Removing interface: gretap1 [ 470.693813][T16750] netlink: 'syz.0.3344': attribute type 21 has an invalid length. [ 471.122690][T16752] __nla_validate_parse: 11 callbacks suppressed [ 471.122710][T16752] netlink: 68 bytes leftover after parsing attributes in process `syz.4.3345'. [ 471.400662][T16783] syzkaller0: entered promiscuous mode [ 471.408551][T16783] syzkaller0: entered allmulticast mode [ 471.466939][T16783] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3355'. [ 471.919661][T16817] syzkaller0: entered promiscuous mode [ 471.926067][T16817] syzkaller0: entered allmulticast mode [ 471.938383][T16821] tipc: Enabling of bearer rejected, failed to enable media [ 471.964268][T16821] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3369'. [ 472.619815][T16861] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3381'. [ 472.665054][T16861] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3381'. [ 472.722129][T16861] 8021q: adding VLAN 0 to HW filter on device bond9 [ 472.836078][T16883] netlink: 'syz.3.3388': attribute type 4 has an invalid length. [ 472.843902][T16883] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3388'. [ 472.859300][T16883] .`: renamed from bond0 [ 472.901627][T16884] netlink: 'syz.3.3388': attribute type 4 has an invalid length. [ 472.951589][T16884] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3388'. [ 473.056944][T16895] netlink: 'syz.2.3391': attribute type 1 has an invalid length. [ 473.079344][T16900] A link change request failed with some changes committed already. Interface 26±ÿª¨úrBº“ may have been left with an inconsistent configuration, please check. [ 473.100960][T16895] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3391'. [ 473.163650][T16895] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3391'. [ 473.223110][T16907] veth1_to_bond: entered allmulticast mode [ 473.260945][T16901] veth1_to_bond: entered promiscuous mode [ 473.281710][T16891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3390'. [ 473.369686][T16910] syzkaller0: entered promiscuous mode [ 473.375274][T16910] syzkaller0: entered allmulticast mode [ 473.391422][T16891] veth1_to_bond (unregistering): left allmulticast mode [ 473.400313][T16891] veth1_to_bond (unregistering): left promiscuous mode [ 473.414699][T16891] bond0: (slave bond_slave_1): Releasing backup interface [ 473.550531][T16923] netlink: 'syz.4.3399': attribute type 24 has an invalid length. [ 476.170453][T16978] syzkaller0: entered promiscuous mode [ 476.178078][T16978] syzkaller0: entered allmulticast mode [ 476.522449][T17001] netlink: 'syz.4.3419': attribute type 1 has an invalid length. [ 476.531396][T17001] __nla_validate_parse: 1 callbacks suppressed [ 476.531414][T17001] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3419'. [ 476.546888][T17001] NCSI netlink: No device for ifindex 0 [ 478.066493][T17005] netlink: 'syz.4.3421': attribute type 7 has an invalid length. [ 478.405851][T17030] netlink: 'syz.2.3429': attribute type 21 has an invalid length. [ 478.441586][T17030] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3429'. [ 478.664796][T17047] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3435'. [ 479.058413][T17069] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3444'. [ 479.088230][T17071] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3443'. [ 479.250191][T17081] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 479.258718][T17077] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3443'. [ 479.567490][T17097] sctp: [Deprecated]: syz.0.3454 (pid 17097) Use of int in maxseg socket option. [ 479.567490][T17097] Use struct sctp_assoc_value instead [ 479.588239][T17095] syzkaller0: entered promiscuous mode [ 479.615209][T17095] syzkaller0: entered allmulticast mode [ 480.572592][T17161] syzkaller0: entered promiscuous mode [ 480.579079][T17161] syzkaller0: entered allmulticast mode [ 480.587177][T17167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3473'. [ 480.610760][T17168] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3471'. [ 480.648521][T17169] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3471'. [ 481.152200][T17198] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3480'. [ 481.259317][T17215] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 481.266650][T17215] IPv6: NLM_F_CREATE should be set when creating new route [ 481.274018][T17215] IPv6: NLM_F_CREATE should be set when creating new route [ 481.281318][T17215] IPv6: NLM_F_CREATE should be set when creating new route [ 481.583047][T17223] syzkaller0: entered promiscuous mode [ 481.603713][T17223] syzkaller0: entered allmulticast mode [ 481.641707][T17237] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 483.613452][T17245] pim6reg: entered allmulticast mode [ 483.893516][T17273] syzkaller0: entered promiscuous mode [ 483.920995][T17273] syzkaller0: entered allmulticast mode [ 483.963243][T17284] __nla_validate_parse: 4 callbacks suppressed [ 483.963262][T17284] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3503'. [ 484.040792][T17290] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3506'. [ 484.252454][T17296] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 484.318436][T17293] syzkaller0: entered promiscuous mode [ 484.332314][T17293] syzkaller0: entered allmulticast mode [ 484.358935][T17311] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3512'. [ 486.352656][T17331] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3516'. [ 486.396193][T17331] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3516'. [ 486.446783][T17331] geneve3: entered promiscuous mode [ 486.795072][T17367] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.3528'. [ 486.969364][T17385] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3532'. [ 487.012935][T17392] erspan0: entered promiscuous mode [ 487.054015][T17392] bond_slave_0: mtu greater than device maximum [ 487.628294][T17431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3550'. [ 488.271918][T17472] IPv6: NLM_F_REPLACE set, but no existing node found! [ 488.422320][T17481] syzkaller0: entered promiscuous mode [ 488.430345][T17481] syzkaller0: entered allmulticast mode [ 488.473776][T17482] syzkaller0: entered promiscuous mode [ 488.479724][T17482] syzkaller0: entered allmulticast mode [ 488.536511][T17488] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3572'. [ 488.651085][T17491] gtp0: entered allmulticast mode [ 488.676737][T17491] team0: Port device gtp0 added [ 489.073101][T17516] syzkaller0: entered promiscuous mode [ 489.079228][T17516] syzkaller0: entered allmulticast mode [ 489.342575][T17528] syzkaller0: entered promiscuous mode [ 489.349049][T17528] syzkaller0: entered allmulticast mode [ 489.647281][T17554] netlink: 'syz.2.3593': attribute type 1 has an invalid length. [ 491.247854][T17555] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 491.248903][T17554] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 491.426130][T17564] syzkaller1: entered promiscuous mode [ 491.465387][T17564] syzkaller1: entered allmulticast mode [ 491.498412][T17564] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3596'. [ 491.541371][T17570] FAULT_INJECTION: forcing a failure. [ 491.541371][T17570] name failslab, interval 1, probability 0, space 0, times 0 [ 491.560353][T17571] sctp: [Deprecated]: syz.2.3596 (pid 17571) Use of int in max_burst socket option. [ 491.560353][T17571] Use struct sctp_assoc_value instead [ 491.584273][T17570] CPU: 1 UID: 0 PID: 17570 Comm: syz.4.3599 Not tainted syzkaller #0 PREEMPT(full) [ 491.584299][T17570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 491.584309][T17570] Call Trace: [ 491.584316][T17570] [ 491.584325][T17570] dump_stack_lvl+0xe8/0x150 [ 491.584353][T17570] should_fail_ex+0x40c/0x560 [ 491.584384][T17570] should_failslab+0xa8/0x100 [ 491.584408][T17570] __kmalloc_noprof+0xfe/0x720 [ 491.584437][T17570] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 491.584464][T17570] ? genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 491.584495][T17570] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 491.584527][T17570] genl_family_rcv_msg_doit+0xda/0x340 [ 491.584559][T17570] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 491.584592][T17570] ? apparmor_capable+0x126/0x170 [ 491.584620][T17570] ? bpf_lsm_capable+0x9/0x20 [ 491.584637][T17570] ? security_capable+0x7e/0x2c0 [ 491.584665][T17570] genl_rcv_msg+0x614/0x7a0 [ 491.584696][T17570] ? __pfx_genl_rcv_msg+0x10/0x10 [ 491.584719][T17570] ? __pfx_wg_set_device_doit+0x10/0x10 [ 491.584745][T17570] ? __pfx_ref_tracker_free+0x10/0x10 [ 491.584782][T17570] netlink_rcv_skb+0x226/0x4a0 [ 491.584804][T17570] ? __pfx_genl_rcv_msg+0x10/0x10 [ 491.584829][T17570] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 491.584862][T17570] ? down_read+0x2be/0x330 [ 491.584886][T17570] genl_rcv+0x28/0x40 [ 491.584910][T17570] netlink_unicast+0x7bb/0x940 [ 491.584940][T17570] netlink_sendmsg+0x813/0xb40 [ 491.584972][T17570] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.584996][T17570] ? aa_sock_msg_perm+0xf1/0x1b0 [ 491.585031][T17570] ? __pfx_netlink_sendmsg+0x10/0x10 [ 491.585051][T17570] sock_sendmsg_nosec+0x13a/0x180 [ 491.585080][T17570] ____sys_sendmsg+0x54e/0x850 [ 491.585104][T17570] ? __pfx_____sys_sendmsg+0x10/0x10 [ 491.585134][T17570] ? import_iovec+0x73/0xa0 [ 491.585156][T17570] ___sys_sendmsg+0x2a5/0x360 [ 491.585173][T17570] ? __lock_acquire+0x683/0x2cf0 [ 491.585195][T17570] ? __pfx____sys_sendmsg+0x10/0x10 [ 491.585247][T17570] ? __fget_files+0x2a/0x420 [ 491.585265][T17570] ? __fget_files+0x3a2/0x420 [ 491.585292][T17570] __x64_sys_sendmsg+0x1b1/0x290 [ 491.585315][T17570] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 491.585350][T17570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.585370][T17570] do_syscall_64+0x174/0x580 [ 491.585388][T17570] ? trace_irq_disable+0x3b/0x140 [ 491.585405][T17570] ? clear_bhb_loop+0x40/0x90 [ 491.585429][T17570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.585447][T17570] RIP: 0033:0x7f450779ce59 [ 491.585465][T17570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 491.585481][T17570] RSP: 002b:00007f45085b4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 491.585501][T17570] RAX: ffffffffffffffda RBX: 00007f4507a15fa0 RCX: 00007f450779ce59 [ 491.585515][T17570] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 491.585526][T17570] RBP: 00007f45085b4090 R08: 0000000000000000 R09: 0000000000000000 [ 491.585537][T17570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 491.585548][T17570] R13: 00007f4507a16038 R14: 00007f4507a15fa0 R15: 00007ffc673fd468 [ 491.585580][T17570] [ 491.634863][T17574] Unsupported ieee802154 address type: 0 [ 491.936632][T17579] bridge7: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 492.376899][T17610] FAULT_INJECTION: forcing a failure. [ 492.376899][T17610] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 492.384593][T17608] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3613'. [ 492.431829][T17608] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3613'. [ 492.437006][T17610] CPU: 0 UID: 0 PID: 17610 Comm: syz.0.3612 Not tainted syzkaller #0 PREEMPT(full) [ 492.437035][T17610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 492.437045][T17610] Call Trace: [ 492.437052][T17610] [ 492.437066][T17610] dump_stack_lvl+0xe8/0x150 [ 492.437095][T17610] should_fail_ex+0x40c/0x560 [ 492.437123][T17610] _copy_from_user+0x2d/0xb0 [ 492.437146][T17610] ___sys_sendmsg+0x1c6/0x360 [ 492.437165][T17610] ? __lock_acquire+0x683/0x2cf0 [ 492.437188][T17610] ? __pfx____sys_sendmsg+0x10/0x10 [ 492.437213][T17610] ? kstrtouint+0x6e/0xe0 [ 492.437260][T17610] ? __fget_files+0x2a/0x420 [ 492.437277][T17610] ? __fget_files+0x3a2/0x420 [ 492.437304][T17610] __sys_sendmmsg+0x273/0x4d0 [ 492.437329][T17610] ? __pfx___sys_sendmmsg+0x10/0x10 [ 492.437357][T17610] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 492.437399][T17610] ? ksys_write+0x242/0x270 [ 492.437422][T17610] ? __pfx_ksys_write+0x10/0x10 [ 492.437450][T17610] __x64_sys_sendmmsg+0xa0/0xc0 [ 492.437470][T17610] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.437489][T17610] do_syscall_64+0x174/0x580 [ 492.437505][T17610] ? trace_irq_disable+0x3b/0x140 [ 492.437522][T17610] ? clear_bhb_loop+0x40/0x90 [ 492.437545][T17610] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.437562][T17610] RIP: 0033:0x7fc4bdd9ce59 [ 492.437579][T17610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.437595][T17610] RSP: 002b:00007fc4bebdf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 492.437614][T17610] RAX: ffffffffffffffda RBX: 00007fc4be015fa0 RCX: 00007fc4bdd9ce59 [ 492.437628][T17610] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000004 [ 492.437640][T17610] RBP: 00007fc4bebdf090 R08: 0000000000000000 R09: 0000000000000000 [ 492.437650][T17610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.437661][T17610] R13: 00007fc4be016038 R14: 00007fc4be015fa0 R15: 00007ffc536b62d8 [ 492.437690][T17610] [ 492.991880][T17640] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3620'. [ 493.042699][T17645] sch_fq: defrate 0 ignored. [ 493.100842][T17650] netlink: 'syz.1.3624': attribute type 17 has an invalid length. [ 493.134260][T17650] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3624'. [ 493.164051][T17650] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3624'. [ 493.384938][T17667] FAULT_INJECTION: forcing a failure. [ 493.384938][T17667] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 493.404135][T17667] CPU: 1 UID: 0 PID: 17667 Comm: syz.1.3631 Not tainted syzkaller #0 PREEMPT(full) [ 493.404163][T17667] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 493.404174][T17667] Call Trace: [ 493.404182][T17667] [ 493.404190][T17667] dump_stack_lvl+0xe8/0x150 [ 493.404217][T17667] should_fail_ex+0x40c/0x560 [ 493.404248][T17667] _copy_from_user+0x2d/0xb0 [ 493.404269][T17667] __copy_msghdr+0x390/0x590 [ 493.404296][T17667] ___sys_sendmsg+0x213/0x360 [ 493.404315][T17667] ? __lock_acquire+0x683/0x2cf0 [ 493.404339][T17667] ? __pfx____sys_sendmsg+0x10/0x10 [ 493.404365][T17667] ? kstrtouint+0x6e/0xe0 [ 493.404420][T17667] ? __fget_files+0x2a/0x420 [ 493.404438][T17667] ? __fget_files+0x3a2/0x420 [ 493.404469][T17667] __sys_sendmmsg+0x273/0x4d0 [ 493.404496][T17667] ? __pfx___sys_sendmmsg+0x10/0x10 [ 493.404525][T17667] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 493.404567][T17667] ? ksys_write+0x242/0x270 [ 493.404593][T17667] ? __pfx_ksys_write+0x10/0x10 [ 493.404622][T17667] __x64_sys_sendmmsg+0xa0/0xc0 [ 493.404642][T17667] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.404662][T17667] do_syscall_64+0x174/0x580 [ 493.404679][T17667] ? trace_irq_disable+0x3b/0x140 [ 493.404697][T17667] ? clear_bhb_loop+0x40/0x90 [ 493.404721][T17667] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.404740][T17667] RIP: 0033:0x7f4756b9ce59 [ 493.404757][T17667] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 493.404774][T17667] RSP: 002b:00007f4757a53028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 493.404794][T17667] RAX: ffffffffffffffda RBX: 00007f4756e15fa0 RCX: 00007f4756b9ce59 [ 493.404808][T17667] RDX: 0000000000000001 RSI: 0000200000000440 RDI: 0000000000000004 [ 493.404820][T17667] RBP: 00007f4757a53090 R08: 0000000000000000 R09: 0000000000000000 [ 493.404832][T17667] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 493.404843][T17667] R13: 00007f4756e16038 R14: 00007f4756e15fa0 R15: 00007ffda70b0d98 [ 493.404873][T17667] [ 493.725468][T17674] 8021q: adding VLAN 0 to HW filter on device bond8 [ 493.911977][T17688] syzkaller0: entered promiscuous mode [ 493.918358][T17688] syzkaller0: entered allmulticast mode [ 493.971075][T17696] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3641'. [ 494.210253][T17706] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3645'. [ 494.221176][T17706] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3645'. [ 494.232288][T17706] netlink: 31 bytes leftover after parsing attributes in process `syz.3.3645'. [ 494.242694][T17706] netlink: 'syz.3.3645': attribute type 2 has an invalid length. [ 494.293464][T17711] FAULT_INJECTION: forcing a failure. [ 494.293464][T17711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 494.325516][T17711] CPU: 0 UID: 0 PID: 17711 Comm: syz.2.3646 Not tainted syzkaller #0 PREEMPT(full) [ 494.325544][T17711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 494.325556][T17711] Call Trace: [ 494.325563][T17711] [ 494.325570][T17711] dump_stack_lvl+0xe8/0x150 [ 494.325598][T17711] should_fail_ex+0x40c/0x560 [ 494.325628][T17711] _copy_to_user+0x31/0xb0 [ 494.325648][T17711] simple_read_from_buffer+0xe1/0x170 [ 494.325673][T17711] proc_fail_nth_read+0x1bb/0x230 [ 494.325695][T17711] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 494.325718][T17711] ? rw_verify_area+0x24a/0x4c0 [ 494.325740][T17711] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 494.325768][T17711] vfs_read+0x213/0xa80 [ 494.325794][T17711] ? __pfx___mutex_lock+0x10/0x10 [ 494.325813][T17711] ? __pfx_vfs_read+0x10/0x10 [ 494.325834][T17711] ? __fget_files+0x2a/0x420 [ 494.325855][T17711] ? __fget_files+0x3a2/0x420 [ 494.325871][T17711] ? __fget_files+0x2a/0x420 [ 494.325896][T17711] ksys_read+0x150/0x270 [ 494.325918][T17711] ? __pfx_ksys_read+0x10/0x10 [ 494.325945][T17711] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.325965][T17711] do_syscall_64+0x174/0x580 [ 494.325982][T17711] ? trace_irq_disable+0x3b/0x140 [ 494.326001][T17711] ? clear_bhb_loop+0x40/0x90 [ 494.326024][T17711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.326043][T17711] RIP: 0033:0x7f685fd5d68e [ 494.326060][T17711] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 494.326077][T17711] RSP: 002b:00007f6860d08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 494.326096][T17711] RAX: ffffffffffffffda RBX: 00007f6860d096c0 RCX: 00007f685fd5d68e [ 494.326110][T17711] RDX: 000000000000000f RSI: 00007f6860d090a0 RDI: 0000000000000007 [ 494.326123][T17711] RBP: 00007f6860d09090 R08: 0000000000000000 R09: 0000000000000000 [ 494.326134][T17711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 494.326146][T17711] R13: 00007f6860016038 R14: 00007f6860015fa0 R15: 00007ffeeab6aaa8 [ 494.326175][T17711] [ 494.639972][T17716] Cannot find add_set index 46338 as target [ 496.743710][T17761] netlink: 'syz.0.3660': attribute type 1 has an invalid length. [ 496.771004][T17761] netlink: 'syz.0.3660': attribute type 3 has an invalid length. [ 496.790547][T17761] __nla_validate_parse: 1 callbacks suppressed [ 496.790565][T17761] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3660'. [ 497.015497][T17776] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3667'. [ 497.024561][T17776] netlink: 'syz.2.3667': attribute type 5 has an invalid length. [ 497.032851][T17776] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3667'. [ 497.054170][T17770] syzkaller0: entered promiscuous mode [ 497.061829][T17770] syzkaller0: entered allmulticast mode [ 497.074649][T17780] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3668'. [ 497.082898][T17776] geneve4: entered promiscuous mode [ 497.089397][T17776] geneve4: entered allmulticast mode [ 497.101391][ T145] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 497.124653][ T145] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 497.725371][T17822] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3675'. [ 497.734608][T17822] openvswitch: netlink: Missing key (keys=40, expected=100) [ 499.173253][ T145] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 499.393437][T17812] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 499.421300][ T145] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 500.280681][T17885] syzkaller0: entered promiscuous mode [ 500.286391][T17885] syzkaller0: entered allmulticast mode [ 502.950560][T17942] netlink: 'syz.4.3703': attribute type 1 has an invalid length. [ 503.224590][T17942] 8021q: adding VLAN 0 to HW filter on device bond10 [ 503.324326][T17955] bond10: (slave geneve2): making interface the new active one [ 503.336923][T17955] bond10: (slave geneve2): Enslaving as an active interface with an up link [ 503.858278][T17987] syzkaller0: entered promiscuous mode [ 503.867581][T17987] syzkaller0: entered allmulticast mode [ 504.583041][T18005] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3717'. [ 504.623383][T18005] netlink: zone id is out of range [ 504.635220][T18005] netlink: zone id is out of range [ 504.656058][T18005] netlink: zone id is out of range [ 504.673476][T18005] netlink: zone id is out of range [ 504.680710][T18005] netlink: get zone limit has 4 unknown bytes [ 506.752362][T18012] bond_slave_0: mtu greater than device maximum [ 506.790063][T17833] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 506.823358][T17833] syz2: Port: 1 Link ACTIVE [ 507.033392][T18048] netlink: 'syz.0.3730': attribute type 17 has an invalid length. [ 507.042103][T18044] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3727'. [ 507.052047][T18048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3730'. [ 507.066434][T18048] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3730'. [ 507.091350][T18049] vxlan0: entered promiscuous mode [ 507.096870][T18051] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3731'. [ 507.107947][T18049] vxlan0: entered allmulticast mode [ 507.119798][T17386] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.139577][T17386] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.158262][T17386] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.184213][T17386] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 507.348632][T18068] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3737'. [ 507.389256][T18060] syzkaller0: entered promiscuous mode [ 507.394759][T18060] syzkaller0: entered allmulticast mode [ 507.553411][T18082] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3741'. [ 508.409603][T18103] openvswitch: netlink: Message has 4 unknown bytes. [ 508.416716][T18103] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 509.693968][T18116] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 509.893476][T18127] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3754'. [ 510.057260][T18135] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3758'. [ 510.120089][T18141] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3761'. [ 510.137132][T18142] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3762'. [ 510.167721][T18142] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3762'. [ 510.218451][T18142] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3762'. [ 510.269413][T18142] 8021q: adding VLAN 0 to HW filter on device bond9 [ 510.458863][T18157] veth9: entered promiscuous mode [ 510.530922][T18167] syzkaller1: entered promiscuous mode [ 510.551990][T18167] syzkaller1: entered allmulticast mode [ 510.582008][T18172] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3772'. [ 510.601754][T18172] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3772'. [ 510.617339][T18172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3772'. [ 510.690474][T18180] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3774'. [ 510.711775][T18172] macsec2: entered promiscuous mode [ 510.726979][T18172] bridge0: entered promiscuous mode [ 510.741223][T18172] macsec2: entered allmulticast mode [ 510.754983][T18172] bridge0: entered allmulticast mode [ 510.772214][T18172] bridge0: port 3(macsec2) entered blocking state [ 510.786549][T18172] bridge0: port 3(macsec2) entered disabled state [ 510.819658][T18172] bridge0: left allmulticast mode [ 510.857910][T17833] bridge0: left promiscuous mode [ 511.356425][T18218] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.156740][T18233] netlink: 'syz.1.3794': attribute type 22 has an invalid length. [ 513.199050][T18233] netlink: 'syz.1.3794': attribute type 22 has an invalid length. [ 513.245995][T18233] sch_tbf: burst 0 is lower than device lo mtu (18) ! [ 513.395646][T18248] IPv6: NLM_F_REPLACE set, but no existing node found! [ 513.924195][T18288] IPv6: NLM_F_REPLACE set, but no existing node found! [ 514.177774][T18295] syzkaller0: entered promiscuous mode [ 514.190315][T18295] syzkaller0: entered allmulticast mode [ 514.236990][T18304] bridge0: port 3(vlan2) entered blocking state [ 514.243428][T18304] bridge0: port 3(vlan2) entered forwarding state [ 514.320048][T18304] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 514.828285][T18337] netlink: 'syz.1.3834': attribute type 32 has an invalid length. [ 514.867344][T18347] netlink: 'syz.3.3836': attribute type 21 has an invalid length. [ 516.500084][T18337] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 516.503214][T18346] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 516.528398][T18347] workqueue: Failed to create a rescuer kthread for wq "bond0": -EINTR [ 517.079993][T18381] syzkaller0: entered promiscuous mode [ 517.095091][T18381] syzkaller0: entered allmulticast mode [ 517.313368][T18397] IPv6: NLM_F_REPLACE set, but no existing node found! [ 517.470805][T18403] __nla_validate_parse: 12 callbacks suppressed [ 517.470827][T18403] netlink: 768 bytes leftover after parsing attributes in process `syz.0.3854'. [ 519.428432][T18394] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 519.443926][T18394] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 519.467644][T18394] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 519.566466][T18431] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3862'. [ 519.585002][T18432] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 519.722986][T18439] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3866'. [ 519.891128][T18443] syzkaller1: entered promiscuous mode [ 519.899077][T18443] syzkaller1: entered allmulticast mode [ 520.088991][T18458] bond0: entered promiscuous mode [ 520.094459][T18458] bond0: entered allmulticast mode [ 520.110230][T18458] 8021q: adding VLAN 0 to HW filter on device bond0 [ 520.184492][T18460] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3867'. [ 520.383470][T18473] IPv6: NLM_F_REPLACE set, but no existing node found! [ 520.459694][T18477] netlink: 768 bytes leftover after parsing attributes in process `syz.2.3880'. [ 520.501067][T18479] nbd: must specify a device to reconfigure [ 520.742550][T18501] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3891'. [ 521.151311][T18521] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 521.567305][T18521] lo speed is unknown, defaulting to 1000 [ 521.752554][T18567] netlink: 'syz.4.3907': attribute type 30 has an invalid length. [ 521.774874][T18563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3906'. [ 521.788843][T18563] netlink: 'syz.0.3906': attribute type 1 has an invalid length. [ 521.797688][T18563] netlink: 'syz.0.3906': attribute type 2 has an invalid length. [ 521.811744][T18563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3906'. [ 521.822106][T18563] netlink: 'syz.0.3906': attribute type 1 has an invalid length. [ 521.830462][T18563] netlink: 'syz.0.3906': attribute type 2 has an invalid length. [ 521.839954][T18567] netlink: 'syz.4.3907': attribute type 30 has an invalid length. [ 521.926825][T18567] netlink: 'syz.4.3907': attribute type 30 has an invalid length. [ 522.020299][T18567] netlink: 'syz.4.3907': attribute type 30 has an invalid length. [ 522.033678][T18574] netlink: 'syz.0.3909': attribute type 13 has an invalid length. [ 522.136467][T18567] netlink: 'syz.4.3907': attribute type 30 has an invalid length. [ 522.253403][T18578] 8021q: adding VLAN 0 to HW filter on device .` [ 522.264741][T18578] 8021q: adding VLAN 0 to HW filter on device team0 [ 522.400735][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 522.407991][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 522.439708][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 522.446962][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 522.574555][T18591] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3916'. [ 522.633072][T18595] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3918'. [ 522.657055][T18596] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3915'. [ 522.659907][T18597] ipvlan1: Caught tx_queue_len zero misconfig [ 522.712724][T18599] syzkaller1: entered promiscuous mode [ 522.721599][T18599] syzkaller1: entered allmulticast mode [ 522.775107][T18603] openvswitch: netlink: Key type 159 is out of range max 32 [ 522.923613][T18615] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3923'. [ 522.964973][T18615] vlan2: entered promiscuous mode [ 523.082537][T18618] syzkaller0: entered promiscuous mode [ 523.097066][T18618] syzkaller0: entered allmulticast mode [ 523.510242][T18638] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 525.338306][T18653] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3935'. [ 525.381629][T18657] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3937'. [ 525.609514][T18670] bridge8: entered promiscuous mode [ 525.628638][T18673] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3939'. [ 525.633869][T18670] bridge8: entered allmulticast mode [ 525.654007][T18670] team0: Port device bridge8 added [ 525.660347][T18676] bridge0: port 3(team0) entered blocking state [ 525.667068][T18676] bridge0: port 3(team0) entered disabled state [ 525.673616][T18676] team0: entered allmulticast mode [ 525.680053][T18676] team_slave_0: entered allmulticast mode [ 525.686289][T18676] team_slave_1: entered allmulticast mode [ 525.693907][T18676] team0: entered promiscuous mode [ 525.699618][T18676] team_slave_0: entered promiscuous mode [ 525.708493][T18681] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3945'. [ 525.709413][T18676] team_slave_1: entered promiscuous mode [ 525.723930][T18676] bridge0: port 3(team0) entered blocking state [ 525.730289][T18676] bridge0: port 3(team0) entered forwarding state [ 525.741948][T18677] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3944'. [ 525.748547][T18670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3942'. [ 525.925958][T18685] syzkaller0: entered promiscuous mode [ 525.931752][T18685] syzkaller0: entered allmulticast mode [ 526.029713][T18693] openvswitch: netlink: EtherType 0 is less than min 600 [ 528.337710][T18734] Cannot find add_set index 65532 as target [ 528.354002][T18736] FAULT_INJECTION: forcing a failure. [ 528.354002][T18736] name fail_futex, interval 1, probability 0, space 0, times 1 [ 528.383199][T18736] CPU: 0 UID: 0 PID: 18736 Comm: syz.3.3956 Not tainted syzkaller #0 PREEMPT(full) [ 528.383227][T18736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 528.383238][T18736] Call Trace: [ 528.383245][T18736] [ 528.383253][T18736] dump_stack_lvl+0xe8/0x150 [ 528.383282][T18736] should_fail_ex+0x40c/0x560 [ 528.383311][T18736] get_futex_key+0x1b3/0x1580 [ 528.383335][T18736] ? perf_lock_task_context+0x79b/0x850 [ 528.383360][T18736] ? perf_lock_task_context+0xfe/0x850 [ 528.383381][T18736] ? __pfx_get_futex_key+0x10/0x10 [ 528.383400][T18736] ? __lock_acquire+0x683/0x2cf0 [ 528.383429][T18736] futex_wake+0x119/0x5f0 [ 528.383459][T18736] ? __pfx_futex_wake+0x10/0x10 [ 528.383492][T18736] ? exit_mm_release+0x1a/0x30 [ 528.383521][T18736] do_futex+0x458/0x4e0 [ 528.383547][T18736] ? __pfx_do_futex+0x10/0x10 [ 528.383573][T18736] ? __might_fault+0xaf/0x130 [ 528.383601][T18736] mm_release+0x101/0x290 [ 528.383628][T18736] exit_mm+0x4d/0x2d0 [ 528.383651][T18736] do_exit+0x6cd/0x2360 [ 528.383676][T18736] ? tcp_recvmsg+0x288/0x7f0 [ 528.383697][T18736] ? __pfx_do_exit+0x10/0x10 [ 528.383721][T18736] ? do_raw_spin_lock+0x12b/0x2f0 [ 528.383764][T18736] do_group_exit+0x22d/0x2f0 [ 528.383784][T18736] ? _raw_spin_unlock_irq+0x23/0x50 [ 528.383813][T18736] get_signal+0x121b/0x12c0 [ 528.383859][T18736] arch_do_signal_or_restart+0xbb/0x860 [ 528.383892][T18736] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 528.383940][T18736] exit_to_user_mode_loop+0x104/0x730 [ 528.383959][T18736] ? rcu_is_watching+0x15/0xb0 [ 528.383982][T18736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.384002][T18736] do_syscall_64+0x353/0x580 [ 528.384019][T18736] ? trace_irq_disable+0x3b/0x140 [ 528.384036][T18736] ? clear_bhb_loop+0x40/0x90 [ 528.384060][T18736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 528.384078][T18736] RIP: 0033:0x7f1ce499ce59 [ 528.384096][T18736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 528.384113][T18736] RSP: 002b:00007f1ce58b3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002d [ 528.384133][T18736] RAX: fffffffffffffe00 RBX: 00007f1ce4c16180 RCX: 00007f1ce499ce59 [ 528.384147][T18736] RDX: fffffffffffffd0b RSI: 0000200000000080 RDI: 0000000000000004 [ 528.384160][T18736] RBP: 00007f1ce58b3090 R08: 0000000000000000 R09: fffffffffffffd25 [ 528.384174][T18736] R10: 00000000c9100120 R11: 0000000000000246 R12: 0000000000000001 [ 528.384186][T18736] R13: 00007f1ce4c16218 R14: 00007f1ce4c16180 R15: 00007ffc8afd3988 [ 528.384215][T18736] [ 528.707681][T18749] __nla_validate_parse: 3 callbacks suppressed [ 528.707701][T18749] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3963'. [ 528.729146][T18748] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3965'. [ 528.811354][T18748] team_slave_0 (unregistering): left promiscuous mode [ 528.818392][T18748] team_slave_0 (unregistering): left allmulticast mode [ 528.840757][T18748] team0: Port device team_slave_0 removed [ 528.974849][T18758] syzkaller0: entered promiscuous mode [ 528.981117][T18758] syzkaller0: entered allmulticast mode [ 529.107175][T18772] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3972'. [ 530.953480][T18782] syzkaller1: entered promiscuous mode [ 530.970179][T18782] syzkaller1: entered allmulticast mode [ 531.019757][T18793] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3977'. [ 531.391420][T18820] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3985'. [ 531.556483][T18827] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3991'. [ 531.638445][T18824] syzkaller0: entered promiscuous mode [ 531.649360][T18824] syzkaller0: entered allmulticast mode [ 531.678685][T18835] syzkaller1: entered promiscuous mode [ 531.684385][T18835] syzkaller1: entered allmulticast mode [ 531.859316][T18842] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 532.315471][T18852] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3998'. [ 533.611364][T18840] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 533.777682][T18866] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4001'. [ 533.804666][T18869] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4003'. [ 533.817021][T18866] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4001'. [ 534.066985][T18882] netlink: 768 bytes leftover after parsing attributes in process `syz.1.4009'. [ 534.088476][T18884] lo: Caught tx_queue_len zero misconfig [ 534.159235][T18884] netlink: 184 bytes leftover after parsing attributes in process `syz.0.4008'. [ 534.246701][T18886] syzkaller0: entered promiscuous mode [ 534.272496][T18886] syzkaller0: entered allmulticast mode [ 535.286018][T18923] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4017'. [ 535.297021][T18923] validate_nla: 10 callbacks suppressed [ 535.297039][T18923] netlink: 'syz.3.4017': attribute type 10 has an invalid length. [ 535.316303][T18923] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4017'. [ 536.498076][T18931] netlink: 768 bytes leftover after parsing attributes in process `syz.4.4021'. [ 536.524589][T18917] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 536.556376][T18917] syzkaller0: entered promiscuous mode [ 536.561996][T18917] syzkaller0: entered allmulticast mode [ 536.578549][T18923] geneve5: entered promiscuous mode [ 536.583946][T18923] geneve5: entered allmulticast mode [ 536.679782][T18937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4022'. [ 536.785377][T18945] FAULT_INJECTION: forcing a failure. [ 536.785377][T18945] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 536.829670][T18945] CPU: 0 UID: 0 PID: 18945 Comm: syz.2.4023 Not tainted syzkaller #0 PREEMPT(full) [ 536.829694][T18945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 536.829703][T18945] Call Trace: [ 536.829708][T18945] [ 536.829714][T18945] dump_stack_lvl+0xe8/0x150 [ 536.829738][T18945] should_fail_ex+0x40c/0x560 [ 536.829766][T18945] _copy_from_user+0x2d/0xb0 [ 536.829787][T18945] kstrtouint_from_user+0xd6/0x180 [ 536.829816][T18945] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 536.829858][T18945] proc_fail_nth_write+0x8e/0x210 [ 536.829876][T18945] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 536.829903][T18945] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 536.829920][T18945] vfs_write+0x296/0xba0 [ 536.829948][T18945] ? __pfx_vfs_write+0x10/0x10 [ 536.829971][T18945] ? __fget_files+0x2a/0x420 [ 536.829994][T18945] ? __fget_files+0x3a2/0x420 [ 536.830011][T18945] ? __fget_files+0x2a/0x420 [ 536.830036][T18945] ksys_write+0x150/0x270 [ 536.830059][T18945] ? __pfx_ksys_write+0x10/0x10 [ 536.830087][T18945] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.830106][T18945] do_syscall_64+0x174/0x580 [ 536.830121][T18945] ? trace_irq_disable+0x3b/0x140 [ 536.830137][T18945] ? clear_bhb_loop+0x40/0x90 [ 536.830160][T18945] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 536.830178][T18945] RIP: 0033:0x7f685fd5d68e [ 536.830196][T18945] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 536.830211][T18945] RSP: 002b:00007f6860d08fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 536.830231][T18945] RAX: ffffffffffffffda RBX: 00007f6860d096c0 RCX: 00007f685fd5d68e [ 536.830244][T18945] RDX: 0000000000000001 RSI: 00007f6860d090a0 RDI: 0000000000000003 [ 536.830254][T18945] RBP: 00007f6860d09090 R08: 0000000000000000 R09: 0000000000000000 [ 536.830264][T18945] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 536.830273][T18945] R13: 00007f6860016038 R14: 00007f6860015fa0 R15: 00007ffeeab6aaa8 [ 536.830302][T18945] [ 537.329133][T18958] syzkaller0: entered promiscuous mode [ 537.355306][T18958] syzkaller0: entered allmulticast mode [ 537.462468][T18964] syzkaller1: entered promiscuous mode [ 537.491614][T18964] syzkaller1: entered allmulticast mode [ 539.948085][T19013] syzkaller1: entered promiscuous mode [ 539.957858][T19013] syzkaller1: entered allmulticast mode [ 539.994645][T19019] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4050'. [ 540.014992][T19018] syzkaller0: entered promiscuous mode [ 540.026339][T19018] syzkaller0: entered allmulticast mode [ 540.151500][T19025] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20001 [ 540.335296][T19035] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4055'. [ 540.800032][T19064] IPv6: NLM_F_REPLACE set, but no existing node found! [ 540.897790][T19066] 8021q: adding VLAN 0 to HW filter on device bond11 [ 540.910595][T19066] bond0: (slave bond11): Enslaving as an active interface with a down link [ 540.921147][T19073] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4070'. [ 540.956378][T19070] syzkaller0: entered promiscuous mode [ 540.979986][T19070] syzkaller0: entered allmulticast mode [ 541.479507][T19107] netlink: 76 bytes leftover after parsing attributes in process `syz.4.4084'. [ 541.498717][T19107] nbd: illegal input index 65508 [ 541.591792][T19116] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4086'. [ 541.901345][T19139] x_tables: duplicate underflow at hook 2 [ 541.929252][T19143] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4095'. [ 542.032452][T19146] IPv6: NLM_F_REPLACE set, but no existing node found! [ 542.072531][T19150] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4097'. [ 542.364303][T19162] syzkaller0: entered promiscuous mode [ 542.394614][T19162] syzkaller0: entered allmulticast mode [ 542.743284][T19198] xt_hashlimit: invalid rate [ 543.141252][T19222] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4121'. [ 543.464400][T19244] A link change request failed with some changes committed already. Interface 26±ÿª¨úrBº“ may have been left with an inconsistent configuration, please check. [ 543.619438][T19248] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4128'. [ 543.644986][T19252] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4130'. [ 544.607913][T19313] netlink: 'syz.4.4156': attribute type 1 has an invalid length. [ 544.736207][T19323] veth0: entered promiscuous mode [ 544.755315][T19322] veth0: left promiscuous mode [ 545.212702][T19353] IPVS: length: 8 != 1152 [ 545.355556][T19361] IPv6: NLM_F_REPLACE set, but no existing node found! [ 545.575547][T19374] tipc: Enabled bearer , priority 0 [ 545.610548][T19374] syzkaller0: entered promiscuous mode [ 545.626242][T19374] syzkaller0: entered allmulticast mode [ 545.673299][T19374] syzkaller0: mtu less than device minimum [ 545.780499][T19372] tipc: Resetting bearer [ 545.812247][T19386] __nla_validate_parse: 4 callbacks suppressed [ 545.812263][T19386] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4179'. [ 545.844789][T19372] tipc: Disabling bearer [ 545.925974][T19395] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4181'. [ 546.395801][T19422] netlink: 'syz.2.4193': attribute type 27 has an invalid length. [ 546.405591][T19420] syzkaller0: entered promiscuous mode [ 546.414084][T19424] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4192'. [ 546.416450][T19422] netlink: 'syz.2.4193': attribute type 4 has an invalid length. [ 546.424799][T19420] syzkaller0: entered allmulticast mode [ 546.432929][T19422] netlink: 144 bytes leftover after parsing attributes in process `syz.2.4193'. [ 546.458699][T19425] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4193'. [ 546.481562][T19422] dummy0: left allmulticast mode [ 546.487156][T19422] dummy0: left promiscuous mode [ 546.492319][T19422] bridge2: port 1(dummy0) entered disabled state [ 546.502277][T19422] bond0: (slave bond_slave_0): Releasing backup interface [ 546.512172][T19422] bond0: (slave bond_slave_1): Releasing backup interface [ 546.524498][T19422] team0: Port device team_slave_0 removed [ 546.533282][T19422] team0: Port device team_slave_1 removed [ 546.543862][T19422] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 546.758122][T19434] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 546.774734][T19434] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 547.014769][T19449] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4204'. [ 547.139318][T19455] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4206'. [ 547.171799][T19455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4206'. [ 547.193294][T19455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4206'. [ 547.214164][T19455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4206'. [ 547.632454][T19482] syzkaller1: entered promiscuous mode [ 547.649017][T19482] syzkaller1: entered allmulticast mode [ 548.212389][T19527] netlink: 'syz.1.4224': attribute type 5 has an invalid length. [ 548.534303][T19539] netlink: 'syz.3.4228': attribute type 12 has an invalid length. [ 548.563548][T19539] netlink: 'syz.3.4228': attribute type 29 has an invalid length. [ 548.606196][T19539] netlink: 'syz.3.4228': attribute type 1 has an invalid length. [ 549.332661][T19582] xt_hashlimit: size too large, truncated to 1048576 [ 549.387126][T19585] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 549.408204][T19585] 0ªX¹¦Dö»: entered allmulticast mode [ 549.481988][T19588] openvswitch: netlink: EtherType 0 is less than min 600 [ 549.667777][T19597] bond10: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 549.706400][T19597] bond10 (unregistering): Released all slaves [ 549.870529][T19607] syzkaller0: entered promiscuous mode [ 549.876317][T19607] syzkaller0: entered allmulticast mode [ 552.481571][T19680] __nla_validate_parse: 13 callbacks suppressed [ 552.481590][T19680] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4262'. [ 552.596603][T19687] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4265'. [ 552.658840][T19691] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4265'. [ 552.703476][T19687] tipc: Failed to remove unknown binding: 66,0,0/1267207312:1817368499/1817368500 [ 552.718687][T19683] tipc: Failed to remove unknown binding: 66,0,0/1267207312:1817368499/1817368500 [ 552.887100][T19697] bond10: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 552.909680][T19697] bond10 (unregistering): Released all slaves [ 553.040550][T19707] sch_tbf: burst 823 is lower than device syzkaller0 mtu (1500) ! [ 553.053017][T19707] syzkaller0: entered promiscuous mode [ 553.059319][T19707] syzkaller0: entered allmulticast mode [ 553.353145][T19721] syzkaller0: entered promiscuous mode [ 553.358835][T19721] syzkaller0: entered allmulticast mode [ 553.511031][T19735] netlink: 'syz.2.4280': attribute type 1 has an invalid length. [ 555.623944][T19735] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 555.900877][T19783] veth0_macvtap: Caught tx_queue_len zero misconfig [ 556.095600][T19801] bond0: Error: Cannot enslave bond to itself. [ 556.108432][T19802] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4296'. [ 556.139839][T19802] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4296'. [ 556.333542][T19805] syzkaller0: entered promiscuous mode [ 556.350906][T19805] syzkaller0: entered allmulticast mode [ 556.372125][T19807] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4301'. [ 558.467912][T19825] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4305'. [ 558.589593][T19826] syzkaller0: entered promiscuous mode [ 558.601523][T19826] syzkaller0: entered allmulticast mode [ 558.637482][T19845] netlink: 48 bytes leftover after parsing attributes in process `syz.0.4308'. [ 558.843098][T19861] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4312'. [ 558.854914][T19861] netlink: 'syz.1.4312': attribute type 7 has an invalid length. [ 558.863018][T19861] netlink: 'syz.1.4312': attribute type 8 has an invalid length. [ 558.872141][T19861] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4312'. [ 558.973521][T19867] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 560.683881][T19866] bond9 (unregistering): Released all slaves [ 561.012582][T19890] syzkaller0: entered promiscuous mode [ 561.024586][T19890] syzkaller0: entered allmulticast mode [ 561.035631][T19893] Bluetooth: MGMT ver 1.23 [ 561.405206][T19886] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4317'. [ 561.515561][T19928] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4330'. [ 561.891015][T19943] netlink: 'syz.3.4334': attribute type 10 has an invalid length. [ 561.932765][T19943] dummy0: entered promiscuous mode [ 561.946967][T19943] dummy0: entered allmulticast mode [ 561.958727][T19943] team0: Port device dummy0 added [ 562.117769][T19944] syzkaller0: entered promiscuous mode [ 562.135588][T19944] syzkaller0: entered allmulticast mode [ 564.286103][T19980] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4345'. [ 564.427533][T19994] netlink: 768 bytes leftover after parsing attributes in process `syz.0.4349'. [ 564.598470][T20006] netlink: 'syz.3.4352': attribute type 1 has an invalid length. [ 564.619722][T20000] netlink: 'syz.1.4351': attribute type 11 has an invalid length. [ 564.680433][T20006] bond11: entered promiscuous mode [ 564.686271][T20006] 8021q: adding VLAN 0 to HW filter on device bond11 [ 564.694034][T20006] netlink: 'syz.3.4352': attribute type 1 has an invalid length. [ 564.921188][T20006] bond12: entered promiscuous mode [ 564.936904][T20006] 8021q: adding VLAN 0 to HW filter on device bond12 [ 564.956221][T20006] netlink: 'syz.3.4352': attribute type 1 has an invalid length. [ 564.970677][T20027] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4359'. [ 565.076021][T20006] bond13: entered promiscuous mode [ 565.089769][T20006] 8021q: adding VLAN 0 to HW filter on device bond13 [ 565.099027][T20006] netlink: 'syz.3.4352': attribute type 1 has an invalid length. [ 565.217102][T20033] syzkaller0: entered promiscuous mode [ 565.222651][T20033] syzkaller0: entered allmulticast mode [ 565.273220][T20006] bond14: entered promiscuous mode [ 565.278916][T20006] 8021q: adding VLAN 0 to HW filter on device bond14 [ 565.289215][T20006] netlink: 'syz.3.4352': attribute type 1 has an invalid length. [ 565.292150][T20039] [ 565.299284][T20039] ====================================================== [ 565.306296][T20039] WARNING: possible circular locking dependency detected [ 565.313322][T20039] syzkaller #0 Not tainted [ 565.317727][T20039] ------------------------------------------------------ [ 565.324730][T20039] syz.2.4362/20039 is trying to acquire lock: [ 565.330776][T20039] ffff888020f53d68 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 565.340179][T20039] [ 565.340179][T20039] but task is already holding lock: [ 565.347530][T20039] ffff888020f53840 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 565.357716][T20039] [ 565.357716][T20039] which lock already depends on the new lock. [ 565.357716][T20039] [ 565.368104][T20039] [ 565.368104][T20039] the existing dependency chain (in reverse order) is: [ 565.377112][T20039] [ 565.377112][T20039] -> #6 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 565.385711][T20039] blk_alloc_queue+0x544/0x690 [ 565.390997][T20039] __blk_mq_alloc_disk+0x194/0x390 [ 565.396617][T20039] nbd_dev_add+0x494/0xb60 [ 565.401544][T20039] nbd_init+0x15f/0x1e0 [ 565.406210][T20039] do_one_initcall+0x250/0x870 [ 565.411483][T20039] do_initcall_level+0x10a/0x1a0 [ 565.416933][T20039] do_initcalls+0x59/0xa0 [ 565.421768][T20039] kernel_init_freeable+0x29d/0x3e0 [ 565.427491][T20039] kernel_init+0x1d/0x1d0 [ 565.432347][T20039] ret_from_fork+0x514/0xb70 [ 565.437460][T20039] ret_from_fork_asm+0x1a/0x30 [ 565.442746][T20039] [ 565.442746][T20039] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 565.449947][T20039] fs_reclaim_acquire+0x71/0x100 [ 565.455398][T20039] __kmalloc_noprof+0xbc/0x720 [ 565.460674][T20039] tls_sw_sendmsg+0x599/0x2860 [ 565.465947][T20039] sock_sendmsg_nosec+0x90/0x180 [ 565.471399][T20039] sock_sendmsg+0x1ca/0x2d0 [ 565.476413][T20039] splice_to_socket+0xb5e/0x12a0 [ 565.481857][T20039] direct_splice_actor+0x101/0x160 [ 565.487485][T20039] splice_direct_to_actor+0x57b/0xcb0 [ 565.493408][T20039] do_splice_direct+0x195/0x290 [ 565.498779][T20039] do_sendfile+0x52e/0x7c0 [ 565.503716][T20039] __se_sys_sendfile64+0x144/0x1a0 [ 565.509344][T20039] do_syscall_64+0x174/0x580 [ 565.514446][T20039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.520856][T20039] [ 565.520856][T20039] -> #4 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 565.528926][T20039] lock_sock_nested+0x41/0x100 [ 565.534205][T20039] inet_shutdown+0x6a/0x390 [ 565.539223][T20039] nbd_mark_nsock_dead+0x2cb/0x550 [ 565.544842][T20039] recv_work+0x1cee/0x1e10 [ 565.549765][T20039] process_scheduled_works+0xa8e/0x14e0 [ 565.555821][T20039] worker_thread+0xa47/0xfb0 [ 565.560922][T20039] kthread+0x388/0x470 [ 565.565494][T20039] ret_from_fork+0x514/0xb70 [ 565.570595][T20039] ret_from_fork_asm+0x1a/0x30 [ 565.575868][T20039] [ 565.575868][T20039] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 565.583503][T20039] __mutex_lock+0x19d/0x1550 [ 565.588601][T20039] nbd_queue_rq+0x373/0x1150 [ 565.593698][T20039] blk_mq_dispatch_rq_list+0x499/0x1990 [ 565.599756][T20039] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 565.606593][T20039] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 565.613077][T20039] blk_mq_run_work_fn+0x16c/0x300 [ 565.618611][T20039] process_scheduled_works+0xa8e/0x14e0 [ 565.624667][T20039] worker_thread+0xa47/0xfb0 [ 565.629767][T20039] kthread+0x388/0x470 [ 565.634340][T20039] ret_from_fork+0x514/0xb70 [ 565.639436][T20039] ret_from_fork_asm+0x1a/0x30 [ 565.644708][T20039] [ 565.644708][T20039] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 565.651904][T20039] __mutex_lock+0x19d/0x1550 [ 565.657002][T20039] nbd_queue_rq+0xc1/0x1150 [ 565.662013][T20039] blk_mq_dispatch_rq_list+0x499/0x1990 [ 565.668072][T20039] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 565.674904][T20039] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 565.681391][T20039] blk_mq_run_work_fn+0x16c/0x300 [ 565.686931][T20039] process_scheduled_works+0xa8e/0x14e0 [ 565.692990][T20039] worker_thread+0xa47/0xfb0 [ 565.698094][T20039] kthread+0x388/0x470 [ 565.702669][T20039] ret_from_fork+0x514/0xb70 [ 565.707767][T20039] ret_from_fork_asm+0x1a/0x30 [ 565.713045][T20039] [ 565.713045][T20039] -> #1 (set->srcu){.+.+}-{0:0}: [ 565.720154][T20039] __synchronize_srcu+0xc9/0x2f0 [ 565.725599][T20039] elevator_switch+0x1e8/0x7b0 [ 565.730874][T20039] elevator_change+0x2fa/0x480 [ 565.736147][T20039] elevator_set_default+0x375/0x440 [ 565.741862][T20039] blk_register_queue+0x3f3/0x4e0 [ 565.747406][T20039] __add_disk+0x6cb/0xe30 [ 565.752265][T20039] add_disk_fwnode+0xfb/0x4b0 [ 565.757453][T20039] nbd_dev_add+0x733/0xb60 [ 565.762390][T20039] nbd_init+0x15f/0x1e0 [ 565.767066][T20039] do_one_initcall+0x250/0x870 [ 565.772338][T20039] do_initcall_level+0x10a/0x1a0 [ 565.777785][T20039] do_initcalls+0x59/0xa0 [ 565.782625][T20039] kernel_init_freeable+0x29d/0x3e0 [ 565.788330][T20039] kernel_init+0x1d/0x1d0 [ 565.793166][T20039] ret_from_fork+0x514/0xb70 [ 565.798261][T20039] ret_from_fork_asm+0x1a/0x30 [ 565.803535][T20039] [ 565.803535][T20039] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 565.811338][T20039] __lock_acquire+0x1520/0x2cf0 [ 565.816698][T20039] lock_acquire+0x106/0x350 [ 565.821731][T20039] __mutex_lock+0x19d/0x1550 [ 565.826825][T20039] elevator_change+0x1af/0x480 [ 565.832101][T20039] elevator_set_none+0xb5/0x140 [ 565.837461][T20039] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 565.843797][T20039] nbd_start_device+0x189/0xb30 [ 565.849155][T20039] nbd_genl_connect+0x1597/0x1c10 [ 565.854684][T20039] genl_family_rcv_msg_doit+0x233/0x340 [ 565.860741][T20039] genl_rcv_msg+0x614/0x7a0 [ 565.865754][T20039] netlink_rcv_skb+0x226/0x4a0 [ 565.871023][T20039] genl_rcv+0x28/0x40 [ 565.875514][T20039] netlink_unicast+0x7bb/0x940 [ 565.880781][T20039] netlink_sendmsg+0x813/0xb40 [ 565.886050][T20039] sock_sendmsg_nosec+0x13a/0x180 [ 565.891582][T20039] ____sys_sendmsg+0x54e/0x850 [ 565.896850][T20039] ___sys_sendmsg+0x2a5/0x360 [ 565.902035][T20039] __x64_sys_sendmsg+0x1b1/0x290 [ 565.907477][T20039] do_syscall_64+0x174/0x580 [ 565.912577][T20039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 565.918974][T20039] [ 565.918974][T20039] other info that might help us debug this: [ 565.918974][T20039] [ 565.929184][T20039] Chain exists of: [ 565.929184][T20039] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#50 [ 565.929184][T20039] [ 565.942907][T20039] Possible unsafe locking scenario: [ 565.942907][T20039] [ 565.950340][T20039] CPU0 CPU1 [ 565.955689][T20039] ---- ---- [ 565.961037][T20039] lock(&q->q_usage_counter(io)#50); [ 565.966402][T20039] lock(fs_reclaim); [ 565.972888][T20039] lock(&q->q_usage_counter(io)#50); [ 565.980856][T20039] lock(&q->elevator_lock); [ 565.985430][T20039] [ 565.985430][T20039] *** DEADLOCK *** [ 565.985430][T20039] [ 565.993553][T20039] 6 locks held by syz.2.4362/20039: [ 565.998730][T20039] #0: ffffffff8fe5b2e8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 566.006910][T20039] #1: ffffffff8fe5b120 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 566.015870][T20039] #2: ffff88802131f9c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xab/0x19f0 [ 566.027254][T20039] #3: ffff88802131f8d0 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xbe/0x19f0 [ 566.038201][T20039] #4: ffff888020f53840 (&q->q_usage_counter(io)#50){++++}-{0:0}, at: elevator_change+0x194/0x480 [ 566.048815][T20039] #5: ffff888020f53878 (&q->q_usage_counter(queue)#34){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 566.059689][T20039] [ 566.059689][T20039] stack backtrace: [ 566.065565][T20039] CPU: 0 UID: 0 PID: 20039 Comm: syz.2.4362 Not tainted syzkaller #0 PREEMPT(full) [ 566.065583][T20039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 566.065593][T20039] Call Trace: [ 566.065598][T20039] [ 566.065604][T20039] dump_stack_lvl+0xe8/0x150 [ 566.065624][T20039] print_circular_bug+0x2e1/0x300 [ 566.065644][T20039] check_noncircular+0x12e/0x150 [ 566.065665][T20039] __lock_acquire+0x1520/0x2cf0 [ 566.065687][T20039] ? elevator_change+0x1af/0x480 [ 566.065708][T20039] lock_acquire+0x106/0x350 [ 566.065722][T20039] ? elevator_change+0x1af/0x480 [ 566.065747][T20039] __mutex_lock+0x19d/0x1550 [ 566.065761][T20039] ? elevator_change+0x1af/0x480 [ 566.065782][T20039] ? rcu_is_watching+0x15/0xb0 [ 566.065802][T20039] ? elevator_change+0x1af/0x480 [ 566.065823][T20039] ? __pfx___mutex_lock+0x10/0x10 [ 566.065835][T20039] ? enable_work+0x17f/0x230 [ 566.065850][T20039] ? lockdep_hardirqs_on+0x7a/0x110 [ 566.065874][T20039] ? __cancel_work_sync+0xf7/0x110 [ 566.065889][T20039] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 566.065906][T20039] elevator_change+0x1af/0x480 [ 566.065930][T20039] elevator_set_none+0xb5/0x140 [ 566.065951][T20039] ? __pfx_elevator_set_none+0x10/0x10 [ 566.065977][T20039] ? __pfx_elevator_set_none+0x10/0x10 [ 566.065999][T20039] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 566.066016][T20039] ? kernfs_add_one+0x480/0x5e0 [ 566.066034][T20039] ? nbd_start_device+0x17d/0xb30 [ 566.066053][T20039] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 566.066073][T20039] ? sysfs_add_file_mode_ns+0x258/0x300 [ 566.066097][T20039] nbd_start_device+0x189/0xb30 [ 566.066115][T20039] ? device_create_file+0xf4/0x1b0 [ 566.066133][T20039] nbd_genl_connect+0x1597/0x1c10 [ 566.066152][T20039] ? __pfx_nbd_genl_connect+0x10/0x10 [ 566.066168][T20039] ? rcu_is_watching+0x15/0xb0 [ 566.066184][T20039] ? trace_kmalloc+0x2a/0xf0 [ 566.066207][T20039] ? __kmalloc_noprof+0x396/0x720 [ 566.066229][T20039] ? __nla_parse+0x40/0x60 [ 566.066251][T20039] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 566.066273][T20039] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 566.066296][T20039] genl_family_rcv_msg_doit+0x233/0x340 [ 566.066319][T20039] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 566.066343][T20039] ? __lock_acquire+0x683/0x2cf0 [ 566.066361][T20039] genl_rcv_msg+0x614/0x7a0 [ 566.066382][T20039] ? __pfx_genl_rcv_msg+0x10/0x10 [ 566.066401][T20039] ? __pfx_nbd_genl_connect+0x10/0x10 [ 566.066421][T20039] netlink_rcv_skb+0x226/0x4a0 [ 566.066437][T20039] ? __pfx_genl_rcv_msg+0x10/0x10 [ 566.066457][T20039] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 566.066483][T20039] ? down_read+0x2be/0x330 [ 566.066498][T20039] genl_rcv+0x28/0x40 [ 566.066516][T20039] netlink_unicast+0x7bb/0x940 [ 566.066533][T20039] netlink_sendmsg+0x813/0xb40 [ 566.066553][T20039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 566.066570][T20039] ? aa_sock_msg_perm+0xf1/0x1b0 [ 566.066589][T20039] ? __pfx_netlink_sendmsg+0x10/0x10 [ 566.066605][T20039] sock_sendmsg_nosec+0x13a/0x180 [ 566.066626][T20039] ____sys_sendmsg+0x54e/0x850 [ 566.066644][T20039] ? __pfx_____sys_sendmsg+0x10/0x10 [ 566.066661][T20039] ? import_iovec+0x73/0xa0 [ 566.066678][T20039] ___sys_sendmsg+0x2a5/0x360 [ 566.066692][T20039] ? __lock_acquire+0x683/0x2cf0 [ 566.066708][T20039] ? __pfx____sys_sendmsg+0x10/0x10 [ 566.066724][T20039] ? futex_wake+0x51b/0x5f0 [ 566.066753][T20039] ? __fget_files+0x2a/0x420 [ 566.066767][T20039] ? __fget_files+0x3a2/0x420 [ 566.066784][T20039] __x64_sys_sendmsg+0x1b1/0x290 [ 566.066800][T20039] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 566.066821][T20039] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.066837][T20039] do_syscall_64+0x174/0x580 [ 566.066849][T20039] ? trace_irq_disable+0x3b/0x140 [ 566.066863][T20039] ? clear_bhb_loop+0x40/0x90 [ 566.066880][T20039] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.066894][T20039] RIP: 0033:0x7f685fd9ce59 [ 566.066909][T20039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.066923][T20039] RSP: 002b:00007f6860d09028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 566.066938][T20039] RAX: ffffffffffffffda RBX: 00007f6860015fa0 RCX: 00007f685fd9ce59 [ 566.066949][T20039] RDX: 0000000020000000 RSI: 0000200000001ac0 RDI: 0000000000000004 [ 566.066959][T20039] RBP: 00007f685fe32e6f R08: 0000000000000000 R09: 0000000000000000 [ 566.066969][T20039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 566.066978][T20039] R13: 00007f6860016038 R14: 00007f6860015fa0 R15: 00007ffeeab6aaa8 [ 566.066994][T20039] [ 566.538977][T20006] workqueue: Failed to create a rescuer kthread for wq "bond15": -EINTR [ 566.600018][ T4943] block nbd1: Receive control failed (result -107) [ 566.626112][T20039] nbd1: detected capacity change from 0 to 63 [ 566.633414][T20048] netlink: 768 bytes leftover after parsing attributes in process `syz.4.4365'. [ 566.649044][T20040] netlink: 'syz.2.4362': attribute type 2 has an invalid length. [ 566.657824][ T5632] block nbd1: Receive control failed (result -104)