last executing test programs: 8.016813453s ago: executing program 4 (id=9870): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0xa, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x800, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xc, 0xc}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x4008000) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x5, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0xfffffffc, 0x4}}}}]}, 0x78}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd624ace8e8f5ede07f3fa810200e85a973be1ff00003bfffe80000000000000000000000000896c24b50000000000000000000000000001"], 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@deltclass={0xd4, 0x29, 0x400, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x10, 0x4}, {0xffee, 0x1}, {0xc, 0xd}}, [@tclass_kind_options=@c_taprio={0xb}, @TCA_RATE={0x6, 0x5, {0x3, 0x7}}, @tclass_kind_options=@c_ingress={0xc}, @tclass_kind_options=@c_hfsc={{0x9}, {0x54, 0x2, [@TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xffffff0d, 0x5}}, @TCA_HFSC_FSC={0x10, 0x2, {0x3, 0x8, 0x4}}, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x6, 0x7a0}}, @TCA_HFSC_RSC={0x10, 0x1, {0x401, 0x2, 0x2004}}, @TCA_HFSC_USC={0x10, 0x3, {0x0, 0x400}}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @tclass_kind_options=@c_multiq={0xb}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_skbprio={0xc}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20008941}, 0x8080) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0xb, 0x1, 0x6}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r9 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) unshare(0x70020d80) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r10, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) bpf$MAP_CREATE(0x0, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000100001000200"/20, @ANYRES32=0x0, @ANYBLOB="070000000100000008001b0000000000"], 0x28}}, 0x0) read(r9, 0x0, 0x0) sendto$packet(r7, &(0x7f00000002c0)="05031c00d3fc142efd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) 5.335235302s ago: executing program 1 (id=9883): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWSET={0x318, 0x9, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_DESC={0x2d8, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x3835}, @NFTA_SET_DESC_CONCAT={0x13c, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0xfffffffffffffecb, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x25ca}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6b1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000001}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xf07}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x95}]}, {0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x800}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}]}, @NFTA_SET_DESC_CONCAT={0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffffc0}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffd}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}]}, @NFTA_SET_DESC_CONCAT={0x94, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xbe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfd17}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x4}, {0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x400}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x80000000}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xc6a4}, @NFTA_SET_DESC_CONCAT={0xac, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x101}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x239}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7f5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2000000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x69}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3d}]}]}]}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0xffff}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x340}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) recvmmsg(r0, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f0000000380)=""/81, 0x51}], 0x2, 0x0, 0x0, 0xa1}}], 0x400000000000296, 0x1c9cec64ad5a28b, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) socket(0x10, 0x3, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x840000000002, 0x3, 0x100) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) close(0x3) sendmsg$nl_xfrm(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r4, &(0x7f0000004d00)=[{{0x0, 0x6000, 0x0, 0x0, 0x0, 0x0, 0x30000}}], 0x400000000000284, 0xf00) sendmmsg$inet(r2, &(0x7f0000005240), 0x4000095, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r5, &(0x7f0000000240)={0x1f, 0x0, @none, 0x0, 0x1}, 0xe) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x8, 0x3, 0x248, 0x0, 0xe138, 0x198, 0x0, 0x198, 0x270, 0x358, 0x358, 0x270, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'pimreg0\x00', 'veth0_to_bond\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0x98, 0xe0, 0x0, {}, [@common=@inet=@tos={{0x28}, {0x6, 0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x3078, 0x5, 'syz1\x00', {0x5}}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @local, 0xc, 0x6, [0x97f4, 0x15, 0x33, 0x29, 0x7, 0x3c, 0x4, 0x26, 0x9, 0xc, 0xf, 0x1d, 0x3e, 0x1e, 0x30], 0x0, 0x0, 0x3}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a8) openat$cgroup_ro(r5, &(0x7f0000000140)='cgroup.controllers\x00', 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) r6 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @dev={0xac, 0x14, 0x14, 0x2a}}, 0xc) socket$inet_mptcp(0x2, 0x1, 0x106) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0xdfbd5000) 4.264910209s ago: executing program 4 (id=9886): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000040000000160a01000900000000000000010000000900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000048000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000001c00038018000380140002"], 0xd0}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x70, 0x500}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x5865}}}}}}}, 0xfdef) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x29, 0x2, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1e, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}]}, &(0x7f0000000640)=0x10) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000000)={r7, r5}) 4.255525664s ago: executing program 1 (id=9887): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000c40)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000000)="fe55fc2733656cd94cd632f708d5edc9bbe8b3ec7b6726cb94dd7ef916602cfa318a03da4cd0bcbe6074bdf1dc41427cb05cdcc0a6bf308e382bd3b0a7", 0x3d}], 0x1, 0x0, 0x0, 0x20000000}], 0x5, 0xc0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000000)="1c0000001a005f0214f9f407000901ff80000000fe03000100000000", 0x1c) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)="ddac4a45", 0x4}, {0x0, 0x34}], 0x2) recvmmsg(r1, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000940)=""/53, 0x35}], 0x1}, 0x7fff}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000840)=""/116, 0x74}], 0x1}, 0x9}], 0x2, 0x10000, 0x0) 4.055130937s ago: executing program 0 (id=9889): bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYRES32, @ANYBLOB="0b1b0500000000004c0012800b00010069703667726500003c00028008000100", @ANYRES32], 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000014) r1 = socket$kcm(0x2, 0x5, 0x84) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89e1, 0x0) socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r1, 0x84, 0x10, &(0x7f0000000000), 0x8) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.events\x00', 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r2, &(0x7f00000003c0)="7101dbea6f30f50a8ca4aaeb0ccfc01919fcda98d40bfa42e8b3ce7ffb9d8b1855d52fa435fca1470e9bbf4a58f372144457f49c77d453cdf3cbcc36a33e1bf78d01d838bf23f9165e46d5c39c124ab66e79ba1ffd8c60621ede6a311943012447c304661d77a8efb97a6eb7af3de02a8aee4d8f418b62694d331ea2e0b624e0d8ad81137f748ba1e7b3b5a51ee50c99c62f2e9dbfa4bd7d6e86010747256a670352b3a82315", &(0x7f0000000480)=@tcp}, 0x20) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="58000000100009042abd70000000001000000000", @ANYRES32=0x0, @ANYBLOB="9980030004000000380012800b00010069703667726500002800028014000600fc010000000000000000000000000000060010004e240000060011004e210000"], 0x58}, 0x1, 0x0, 0x0, 0x8c1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000040)=""/32, &(0x7f0000000080)=0x20) write$bt_hci(r5, &(0x7f0000000080)=ANY=[], 0x6) r6 = epoll_create(0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x60000}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x2}]}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r4, &(0x7f00000000c0)={0x2000}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1, 0x0, 0x300}, 0x1f00) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)}, 0x0) unshare(0x20000400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r8, 0xc004743e, 0x110e22fff6) ioctl$PPPIOCGNPMODE(r8, 0xc008744c, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @private1={0xfc, 0x1, '\x00', 0x81}}, 0x1c) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f000000c840)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x3c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, @NFT_MSG_NEWRULE={0x104, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0xdc, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x4}}}, {0x1c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x2}]}}}, {0x34, 0x1, 0x0, 0x1, @reject={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x36}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0x3}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0xc}, @NFTA_REJECT_ICMP_CODE={0x5, 0x2, 0xc}]}}}, {0x14, 0x1, 0x0, 0x1, @connlimit={{0xe}, @void}}, {0x60, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x54, 0x2, 0x0, 0x1, [@NFTA_OSF_TTL={0x5, 0x2, 0x1}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_TTL={0x5, 0x2, 0x1}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_OSF_FLAGS={0x8}, @NFTA_OSF_FLAGS={0x8}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x188}, 0x1, 0x0, 0x0, 0x20004000}, 0x10) 4.049875227s ago: executing program 1 (id=9890): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001e00)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="500000002e00030500000400000000003c0000800c00"], 0x50}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="060000000400000008000000080000000c000000", @ANYRES32, @ANYBLOB="ffffffff"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x51}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xa0}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) 4.032549129s ago: executing program 3 (id=9891): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2004c8d8) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) r1 = socket(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f00000001c0)={'dvmrp1\x00', {0x2, 0x0, @empty}}) 3.896021234s ago: executing program 2 (id=9892): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40088c5}, 0x0) 3.759991065s ago: executing program 1 (id=9893): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x0) sendmsg$kcm(r1, &(0x7f0000000380)={&(0x7f0000000040)=@nfc_llcp={0x27, r2, 0x1, 0x1, 0x1, 0x1, "1e17a2c3c02cb8a0b6a86c9503836a6be243e4143ab7f6469e5965514447956b4f5d85e97d4700af07de8b8ab2fa7a07ba11e80fbaa3fbe4778c98cb15860d", 0x1c}, 0x80, &(0x7f0000000340)=[{&(0x7f00000001c0)="568a4cdceb67444087e8d618e7394aadbe0696078df221df73bf8a09621b0820a845cc0dd75c0a48b015976b9c8c2b6e90f6159d7b303f33d36289eb5321fc84e43987a40a91c0deb46a6cf0612bcd8f5dd2f8113a7a5d65f95a77146f06ad523373fe6d3da64e2c68257061e42b5fc998d881ae67de9d4bc996a6ad030421a6d83e3b7e019966c6946ee4e535b2a7d4ce4b792484d462b523be885d43ee90ab4c95054bde137eef3f304ff6262ab1db980199a0a1328aa7adddb1528d0127e1b501a5e5a47a8f5d5ee8bf87df9b0efb", 0xd0}, {&(0x7f00000002c0)="360c9a82bcdb425a2b8a8624c800ee125f173788fb624218c76a479fb70e5c41aa2a2fb2b44e282bcfeaa32566352b2052f74371151e09826a1cb5285b79b6b33c9f3f08ccddffc98adbb086db263eb408410de7ee4c7d8259af24d3ec44b9cb7ecf44a576885008057f09b04fe818822772", 0x72}], 0x2}, 0x800) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 3.688033676s ago: executing program 2 (id=9894): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$inet_sctp(r1, 0x0, 0x0, 0x40840) recvmmsg$unix(r1, 0x0, 0x0, 0x40012102, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00"/14], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0e0000000400000004"], 0x48) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0x64, 0xd, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x1}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x80}, 0x44000) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd23, 0x25dfdbf8, {0x0, 0x0, 0x0, 0x0, 0x35a38, 0x4522f}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY={0x8}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20040044) 3.588356393s ago: executing program 3 (id=9895): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a010100000000000000000100000c0900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) 3.499263856s ago: executing program 3 (id=9896): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0xa, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x800, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xc, 0xc}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x4008000) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x5, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0xfffffffc, 0x4}}}}]}, 0x78}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd624ace8e8f5ede07f3fa810200e85a973be1ff00003bfffe80000000000000000000000000896c24b50000000000000000000000000001"], 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@deltclass={0xd4, 0x29, 0x400, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x10, 0x4}, {0xffee, 0x1}, {0xc, 0xd}}, [@tclass_kind_options=@c_taprio={0xb}, @TCA_RATE={0x6, 0x5, {0x3, 0x7}}, @tclass_kind_options=@c_ingress={0xc}, @tclass_kind_options=@c_hfsc={{0x9}, {0x54, 0x2, [@TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xffffff0d, 0x5}}, @TCA_HFSC_FSC={0x10, 0x2, {0x3, 0x8, 0x4}}, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x6, 0x7a0}}, @TCA_HFSC_RSC={0x10, 0x1, {0x401, 0x2, 0x2004}}, @TCA_HFSC_USC={0x10, 0x3, {0x0, 0x400}}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @tclass_kind_options=@c_multiq={0xb}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_skbprio={0xc}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20008941}, 0x8080) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0xb, 0x1, 0x6}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r9 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) unshare(0x70020d80) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r10, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) bpf$MAP_CREATE(0x0, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000100001000200"/20, @ANYRES32=0x0, @ANYBLOB="070000000100000008001b0000000000"], 0x28}}, 0x0) read(r9, 0x0, 0x0) sendto$packet(r7, &(0x7f00000002c0)="05031c00d3fc142efd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) 3.423026501s ago: executing program 4 (id=9897): bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xf, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000002000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000005000000850000005000000095"], 0x0, 0x47e, 0x12, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000004"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000a00)=@newtaction={0x64, 0x30, 0xb, 0x5, 0x25dfdbfc, {}, [{0x50, 0x1, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0x0, 0x0, 0x0, 0x400}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x8890}, 0x40) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x8, 0x3, 0x3d0, 0xf0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x300, 0xffffffff, 0xffffffff, 0x300, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@socket2={{0x28}, 0x2}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0x1c8, 0x210, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x3, 0x2, 0x1, 'syz0\x00'}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x8, 0x8, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000180)=0x3) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x8000) (async) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x8000) r4 = socket$kcm(0x2, 0x4, 0x2) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) (async) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) (async) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xfd01}, 0x8) (async) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xfd01}, 0x8) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x1, 0x5, &(0x7f0000000b40)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) splice(r7, 0x0, r8, 0x0, 0x10500, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000400)={r6, 0x0, 0x13, 0x0, &(0x7f00000005c0)="07ec0c191cd2749bf8ffc2c4257f078b3909d0", 0xfffffffffffffffd, 0x8003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x24048044}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x24048044}, 0x0) sendmsg$inet(r4, 0x0, 0x40008) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f0000000040)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r10, &(0x7f0000000200)=0x80000002, 0x12) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_route(0x10, 0x3, 0x0) 3.312154074s ago: executing program 2 (id=9898): bind$inet(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000100)={'macsec0\x00', 0x200}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000240)={'macsec0\x00', 0x1}) r2 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffff, 0x10}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x460, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffd}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFTA_SET_EXPR={0x424, 0x11, 0x0, 0x1, @cmp={{0x8}, @val={0x418, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_CMP_DATA={0x2b0, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa0, 0x1, "5a2618ed2c0cb44ec9c0b36c0d393c45bc65f2cde127c8e7904d7a13bfd660dfdec0abcabf4d17673241ebc5b2896189e4cddc017500682f64006f26b2c09b0fc0b85d6bffe0229fa792ada271ae251d6ac35fa510e21c5155acd67a4a8cc797e478e4276b4367e4b1393ddda9cf9f4de91b102eff0c8eb3fc243438351c58b48be5488a90fd322a0ebd1cedb1cf14d9004d6c72dc2bc35dab592d3a"}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x7ffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x40, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x28, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xb7, 0x1, "abae9ac41fcb8b8f35156a282b91964a28f88518173306bed1d1b93f72ef146ee8db05cba5e1769c7f3d78b7cdc471f48c3d33e9d857cc361adaad21ee08292032fefc1683f5d06f6a6b2f15a82d7cf3d72b927f9480ddac4bf1816647689f688a1dc4f5379eac3feb91046e7974a997ffd94e9856f69a55aad68a56e8c0339143bb67eeb07cf8b4cd3a89c405e0caa2dad01a7a13eefb2716b10478ee020385999d1544e709ffd211cb2f0bac46b5f708ddaa"}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_CMP_DATA={0x14c, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9a, 0x1, "921608d995cb1a77f2f9198255357b80317970184fa5f074e1d0cdf92da70669f53b5bc053f070643246ca7b138cda4e9df5768b2f1fc375175740f884519d3391fda9844ae216ccf4947fdcc5988ce051c7ed802c9c4227c40662acfc3d96d6dece140e6b0c22ba06dc61e01ae85b6407d1126edf8bee40b8b35e1c8777ebcecfa26baf877001fb5d517c3b620952545bad260b7358"}, @NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x5c, 0x1, "d87ac19842aced6da357141e436dfdcad9b55aed8629c63ca928d41ad9a6a15b598fcbd18c77750a9391a8cfbb580a0fa4d98cf1dbfdc53eaf98b35327142f02f6f83964c46e2bed6e31158d46ccbb342f59e7e61d466dd4"}]}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}}, 0x4d4}}, 0x0) close(r2) 3.119082405s ago: executing program 0 (id=9899): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c", 0x30}, {&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}], 0x3, 0x0, 0x0, 0x40088c5}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r0, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=""/72, 0x48}, 0x81}, {{0x0, 0x0, 0x0}, 0x400002}], 0x2, 0x20000020, 0x0) 3.099682822s ago: executing program 2 (id=9900): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x8, 0x1010, &(0x7f0000002500)=""/4112, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x8, 0x1010, &(0x7f0000002500)=""/4112, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x600, 0x0) write$rfkill(r3, &(0x7f00000000c0)={0x40, 0x7, 0x1, 0x0, 0x1}, 0x8) (async) write$rfkill(r3, &(0x7f00000000c0)={0x40, 0x7, 0x1, 0x0, 0x1}, 0x8) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x50) (async) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x3}, 0x50) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000580)={'syztnl2\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x4, 0x9, 0x1e, 0x7, 0x60, @local, @local, 0x7a0, 0x1, 0xf, 0x1}}) socket(0xa, 0x5, 0x0) (async) r6 = socket(0xa, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0x3e, &(0x7f0000000040)=0x10f7a, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000f40)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)) socketpair(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1f, 0x10, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRESOCT=r7, @ANYBLOB="0000000000000000b702000003f80000850000008600000018010000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bind$inet6(r6, &(0x7f0000000000)={0xa, 0x4e20, 0x13, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x5, 0x9, 0xfffffffd, 0x2, r4, 0xfffffff7, '\x00', r5, r3, 0x0, 0x4, 0x5, 0x2}, 0x50) socket$nl_route(0x10, 0x3, 0x0) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010029bd7400fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b00000000000800040002050000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) (async) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="300000001000010029bd7400fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b00000000000800040002050000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000140)=[{0x20, 0x0, 0x0, 0xfffff024}, {0xb1, 0x0, 0x0, 0xffeff024}, {0x6, 0x0, 0x4}]}, 0x10) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r6, 0x84, 0xc, &(0x7f0000000100), &(0x7f00000001c0)=0x4) r11 = socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r11, 0x111, 0x4, 0x0, 0x4) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) 2.813914188s ago: executing program 0 (id=9901): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x34, 0x2a, 0x107, 0x3, 0x0, {0x1, 0x7c}, [@typed={0x1f, 0x28e, 0x0, 0x0, @str='hm\xf33)\xf3\xff\x00\x00uqv]L\xcc\xe8\x99\xacdf\xb2\x05\x95\x00\x00\x00\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0x884) unshare(0x20400) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@abs={0x1, 0x0, 0x4e21}, 0x6e) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) socket$inet(0xa, 0x801, 0x84) unshare(0x40030a00) close(r1) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x48800, 0x0) 2.719993131s ago: executing program 1 (id=9902): syz_emit_ethernet(0x4e, &(0x7f0000000400)=ANY=[@ANYBLOB="aaaaaaaaaabbaaaaaaaaaaaa0100000035f200182c00fe8000000000000000000000000000bbfe800000bf35ce68e77462de68eb210000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5010ffff907800006ae0228d"], 0x0) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x25) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000000)="d800000010008104685fa3aa7143a0f8c81ded0b25000000e8fe09a118001500060014ea000000120800030043000040a8002b00", 0x34}], 0x1}, 0x20000880) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfe33) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="60000000020601040000000000004a0000000000140007800800064000000009080008400000009e0500010006000000050005000a00000005000400000000000900020073797a310000000011000300686173683a69702c6d61726b"], 0x60}, 0x1, 0x0, 0x0, 0x24000000}, 0x8001) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x2000000, 0x12, r3, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01f3ff000000f3ffffff01"], 0x2c}, 0x1, 0x40030000000000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x19, &(0x7f0000000840)=ANY=[@ANYBLOB="180000008b100000000000000000000000000000d810cc71debeeb84d5b494a04606c60fde9430a3b8093ce7ffd3a98f8c5d6ad1481cad0f633f2c741a04d7b6bd8d9bcb760a1f760bcf8ff32ef8eced96588ba17ff1d87ec007248455e6464cd8ead6eb8169352661cf8f338fa60e9d6f1f3526fba179d1e579a7393723e0ef6b09d813dca2065624b54aa10636c78a54b79e580c13cc958b52f5145712", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000086000000bf0900000000000055090100000000009500000000000000ad0a060000000000b500ffffdf070ae91801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000050008008500000006000000bf91000000000000b702000003000000850000002a000000b700000000000000950000000000", @ANYRESOCT=r2], &(0x7f0000000080)='GPL\x00', 0x6, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41000, 0x24}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000010000000850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x50) listen(r0, 0x3) write$tun(r3, &(0x7f0000000780)=ANY=[@ANYBLOB="00008847482700a40067000000029078000000006401010000088fa697b9ab1f9404010015f79078e000002697f95b4ec56a90c00e00000000000000a10b8bb0e4bf9d8098cafb158d18fbd8a8ad59b13a8b727860fd1e6cae81740b34b0f41764ddafd810532adb79eb12e88e1a42a15cbb60ea58fe1218030ae85d13add168c0a8f80129a205738ff49656570bebbadbb591f9fdf1038633c960d9c57ddbc587db25122d5c0000"], 0xa8) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000200)=0x1, &(0x7f0000000380)=0x4) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x87a2f, 0x0, 0x0) r10 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="01000000070000000500000007"], 0x50) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="63812bbd7000fcdbdf25030000000800010000000000280007800c00018008000100", @ANYRES32=r11, @ANYBLOB="0c00018008000100", @ANYRES32=r12, @ANYBLOB="0c00ee7b0800e900", @ANYRES32=r11, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x440c0}, 0x40040) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000180)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000e400000035337b5f4febdd2ccff38c603ef30fee6e891187a50bb57e95ef76c7789318a7a9532cf5dc4d0d63d8155a9e7467289a7d7b64178c451cda62c56b13ee6badb8db2436fb09289f5cd63ed15398fcab97c4e4475cfc2f037d8e0000478a65290b2cee303c014f3e3c159a77dee3c8411bed02ec1522dd47c0010a0407e2b2a2650f25c863e58ac1c0d138b1c77dd7587bc744b0252af941f2e458cdf23aec04dcc8a64ad45ef1df60cd431142ad211dcdf667fa893282edaa6ee2d3a2fe03cdfea855a236388a2a41823532b10d101f49c1cdcd465905c0b786ed5b3979dcb27a6ea2e8e82fd99b39"], &(0x7f0000000140)=0x108) 578.470732ms ago: executing program 0 (id=9903): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x20700, 0x2000000, {0x0, 0x0, 0x0, 0x0, 0x8203}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x6000000, 0x20004885}, 0x4054) 554.000905ms ago: executing program 3 (id=9904): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40088c5}, 0x0) 509.664237ms ago: executing program 1 (id=9905): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x2004c8d8) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) r1 = socket(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, 0x0) 460.667677ms ago: executing program 2 (id=9906): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000003}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200000700003b0000000000800000850000007500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01200000004000000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 453.075591ms ago: executing program 4 (id=9907): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a010100000000000000000100000e0900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}, 0x1, 0x0, 0x0, 0x20040080}, 0x0) 404.973961ms ago: executing program 2 (id=9908): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x94, 0x10, 0x401, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x9, 0x20804}, [@IFLA_IFNAME={0x14, 0x3, 'veth0_to_hsr\x00'}, @IFLA_AF_SPEC={0x60, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x2, 0x0, 0x1, {0xc, 0x1, 0x0, 0x1, [{0x8, 0x17, 0x0, 0x0, 0x1}]}}, @AF_BRIDGE={0x4}, @AF_INET={0x48, 0x2, 0x0, 0x1, {0x44, 0x1, 0x0, 0x1, [{0x8, 0x18, 0x0, 0x0, 0x4}, {0x8, 0x10, 0x0, 0x0, 0x3}, {0x8, 0x1, 0x0, 0x0, 0x7c6d31d6}, {0x8, 0x10, 0x0, 0x0, 0x10000}, {0x8, 0x14, 0x0, 0x0, 0xf}, {0x8, 0x17, 0x0, 0x0, 0x4}, {0x8, 0x1a, 0x0, 0x0, 0xcb}, {0x8, 0x1e, 0x0, 0x0, 0x4}]}}]}]}, 0x94}}, 0x40100d0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000002900)=r4, 0x4) bind$inet(r2, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r2, 0x0, 0x19, 0x0, 0x0) r5 = accept(r0, &(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000540)=0x80) sendmsg$NFNL_MSG_ACCT_DEL(r5, &(0x7f00000007c0)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x54, 0x3, 0x7, 0x5, 0x0, 0x0, {0xa, 0x0, 0x9}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x3c}, @NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4040004}, 0x800) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f00000001c0), r6) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) r10 = socket$inet_sctp(0x2, 0x1, 0x84) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@newtaction={0x894, 0x30, 0xffff, 0x70bd27, 0x0, {}, [{0x880, 0x1, [@m_police={0x87c, 0x1, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8001, 0x3, 0x8ec, 0xed, 0x9, 0x4, 0x11, 0x6, 0x4, 0x80, 0xaa, 0x4, 0x81, 0x9, 0x4, 0x7, 0x7, 0xac3b, 0x5, 0x4, 0x1000, 0x2, 0xffff, 0x8, 0xe, 0xc0, 0x0, 0xc, 0x5, 0x7, 0x3, 0x2, 0x4, 0xc, 0xf, 0x9, 0xfff, 0x10000, 0x3, 0xe, 0x3, 0x9, 0x7ff, 0x8001, 0x0, 0x6, 0xc6e, 0x8, 0xb9, 0xe, 0x800, 0x9, 0x1d, 0x2, 0x1, 0x101, 0x8, 0x80, 0x6927307f, 0x3, 0x2, 0x0, 0x6, 0xc21e, 0x9, 0x9, 0x0, 0x5, 0x6, 0x3, 0xa69, 0x200, 0x6, 0x4, 0x8, 0x54d3, 0x1, 0x7d27, 0x6, 0x7, 0x6, 0x7012, 0x40, 0x0, 0x2, 0x10001, 0x105, 0x0, 0xc, 0xffff8001, 0x40, 0x2, 0xffffffff, 0x9, 0x7d8f, 0x2, 0x9, 0x0, 0x5, 0x7, 0x3ff, 0xfffffffd, 0x8, 0x81, 0x0, 0xfffffffc, 0x0, 0x400, 0x3, 0x8f61, 0x7, 0x8, 0x6, 0x3ff, 0x2, 0x6, 0x6, 0x3, 0x6, 0x3, 0x8, 0x2, 0x6, 0x10000, 0x1, 0x7, 0xd38, 0x0, 0x8, 0x101, 0x2, 0x2cc8c0, 0xffff, 0x1000, 0xf, 0x8000, 0x0, 0x2, 0x7, 0x9, 0xb2fab80, 0xffff565c, 0x0, 0xf, 0x8, 0x1, 0xf, 0x5, 0x5, 0x6, 0x1, 0x2, 0x2, 0x10, 0x7, 0xfffff541, 0x7, 0x200d, 0x8001, 0x2, 0x4627, 0x7, 0x1, 0x1, 0xffff, 0x80000001, 0xd576, 0x8, 0x4c000000, 0x1, 0x1000, 0x8, 0x0, 0x1c, 0x6, 0x9, 0x80000001, 0x7, 0x40, 0x4, 0xbe8, 0x6, 0x9, 0x0, 0x9, 0x5, 0xffffd8e1, 0x2, 0x0, 0x8001, 0x80000001, 0x8, 0xca2b, 0x4, 0x1, 0x80000000, 0x830, 0x6, 0x5, 0x9, 0xc, 0x9, 0xffff, 0x7, 0x0, 0x4, 0x80000000, 0x6, 0x2, 0x5, 0x8, 0x3, 0x1, 0x2, 0x308, 0x94, 0x8, 0x1, 0xbc, 0x6c22, 0x2, 0x3, 0x9, 0x400, 0x3, 0x0, 0x8, 0x530, 0x401, 0xf51d, 0xfffffff5, 0x6, 0x9, 0xc, 0x62b, 0x8, 0xe, 0x4, 0x7fffffff, 0x7, 0x80000000, 0xfffffff7, 0x1ed7ce29, 0x1ea1, 0x6, 0x1, 0xfffffffb, 0x6, 0x40, 0x6, 0x3, 0x7fffffff, 0x6, 0x554, 0x100, 0x7]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x101, 0x5, 0x7f, 0xfffffeff, 0xfffffffe, 0x9, 0x10000, 0x7, 0x3d8, 0x7ff, 0x0, 0x4, 0x6, 0x1, 0x7fffffff, 0x6, 0x40, 0x0, 0x10001, 0x1, 0x6, 0x4, 0x9, 0x7, 0xc7d, 0x80, 0x919, 0xc1d, 0x2, 0x5, 0x6, 0x5, 0x2, 0x8, 0x3ff, 0x1, 0xfffffff8, 0x2, 0x400, 0x4, 0x63, 0x8, 0x88c0, 0xc59, 0x4, 0x7, 0x8, 0x0, 0x80000001, 0xfffffd12, 0x8, 0x5, 0x5, 0x1b0d2671, 0x3, 0x5, 0x5, 0x1000, 0x5, 0x3, 0xfffffffc, 0x0, 0xfffffff8, 0x47, 0xffff, 0x0, 0x200, 0x4, 0x5, 0x0, 0x7, 0x5092, 0x1, 0xe, 0x6, 0xfffff801, 0x40, 0x1, 0x10001, 0xfffffff7, 0x2, 0x6, 0x9, 0xe, 0x7ff, 0x80000001, 0x8, 0x7caa, 0xe198, 0x6, 0x6, 0x1, 0x8000, 0x1, 0xd, 0x5, 0xd0a, 0x1, 0x0, 0x4b, 0xef9, 0x200, 0x401, 0x3, 0x101, 0x917, 0x4, 0x7, 0x3, 0xffff, 0x5, 0xe34, 0x7, 0x2, 0xfffffff2, 0x0, 0x3ff, 0x80000000, 0x2, 0xed4, 0x5, 0x9661, 0xd29377d, 0x4, 0x101, 0x398, 0x2, 0x0, 0x3, 0x7, 0x2, 0x8, 0xa7, 0x3, 0x0, 0x8, 0x5, 0xe, 0xfffffff8, 0x8000, 0xc, 0x3, 0x6, 0xf, 0x3, 0x4, 0x6, 0x4, 0x0, 0xae31, 0x0, 0x3, 0x5557, 0x10000, 0x1, 0x99ba, 0x84, 0x0, 0x7, 0xb, 0x10000, 0x1a3, 0x1ff, 0x0, 0x100, 0xf, 0x6, 0x5, 0x2, 0x3ff, 0x2, 0x4, 0x401, 0x3, 0x6, 0x9, 0x2, 0x7, 0xbf1f, 0x3, 0x6b0c, 0xd55, 0x2, 0x2a3, 0x8, 0x80, 0x7, 0x2, 0x4, 0x0, 0x7fff, 0xfffffffc, 0x7fffffff, 0x11, 0x7, 0x5, 0x9, 0x9, 0xfffffffe, 0x10, 0xb, 0x81, 0xffff, 0x800, 0x3b, 0x7, 0x4, 0x5, 0x1, 0xffffffff, 0xf, 0x800, 0x9, 0x0, 0x0, 0xe, 0x2, 0x59, 0x38, 0x2, 0x8, 0x85, 0x6, 0x443b, 0x1, 0x1, 0x4, 0x6, 0x4d09, 0x1, 0xc482, 0x4, 0x2, 0x7, 0xfffffffe, 0x4d, 0x6, 0xe1, 0x1, 0x0, 0x101, 0x7, 0xffffff7f, 0xfd, 0x1, 0x3, 0x2, 0x2, 0x7fff, 0x7, 0xffff, 0xda3, 0x3, 0x3, 0x7, 0x2]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8c9, 0x0, 0x80000001, 0x7fff, 0x2, {0x1, 0x1, 0xff, 0xffff, 0x3, 0x1a9e}, {0x9, 0x2, 0x40, 0x2, 0xff, 0x7}, 0x4, 0x3ff, 0xfffffff9}}, @TCA_POLICE_AVRATE={0x8, 0x4, 0x4}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x894}}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x2}, 0x8) sendmsg$inet_sctp(r10, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)='\fJR-', 0x4}], 0x1, 0x0, 0x0, 0x2804c044}, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r10, 0x84, 0x7c, &(0x7f00000001c0)={0x0, 0x6, 0x9}, 0x8) sendmsg$NL802154_CMD_GET_SEC_DEV(r6, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000000)={0x1c, r7, 0x701, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r9}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r12 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r12, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r12, 0x29, 0x20, &(0x7f0000000480)={@empty, 0x8000000, 0x2, 0x3, 0x8, 0x3a7b, 0xb}, 0x20) syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000340)) 349.409029ms ago: executing program 0 (id=9909): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x4001, @multicast, 'veth1_to_hsr\x00'}}, 0x1e) syz_emit_ethernet(0x6c, &(0x7f0000000180)={@broadcast, @link_local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x3, 0x0, 0x37, 0x65, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x88a8, 0x0, 0x0, [0xff, 0x3]}, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x800, [0x6]}, {}, {}, {}, {0x8, 0x6558, 0xfffffffd}}}}}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCX25GCAUSEDIAG(0xffffffffffffffff, 0x89e6, &(0x7f0000000080)={0x80, 0x8e}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f00000047c0)={0x14, r3, 0x405, 0x70bd23, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000401}, 0x44084) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)={0x20, 0x16, 0x107, 0x70bd2c, 0x25dfdc02, {0x7, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @fd=r4}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1, 0x6, &(0x7f0000000300)=@raw=[@alu={0x7, 0x1, 0xb, 0x2, 0xa}, @alu={0x7, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc}, @call={0x85, 0x0, 0x0, 0x1}, @jmp={0x5, 0x0, 0x5, 0x0, 0x0, 0x1}, @exit, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="4400000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b00010067726574617000000c00028008000100", @ANYBLOB="933e2f", @ANYRES32, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 348.491629ms ago: executing program 3 (id=9910): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002fff300851000000600000018020000", @ANYRES32, @ANYBLOB="000000000000000166000200f3ffffff180000000000000000000000000000009500040000000000360a020000000001180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x4b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff35}, 0x78) 280.243566ms ago: executing program 4 (id=9911): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00006dbffc), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c", 0x30}, {&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}], 0x3, 0x0, 0x0, 0x40088c5}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40) recvmmsg(r0, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=""/72, 0x48}, 0x81}, {{0x0, 0x0, 0x0}, 0x400002}], 0x2, 0x20000020, 0x0) 46.320068ms ago: executing program 0 (id=9912): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000003}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200000700003b0000000000800000850000007500000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a050000000000000000000100fffc0900010073797a300000000040000000030a01200000000300000000010000000900030073797a300000000014000480080002400000000008000140000000010900010073797a300000000050000000060a010400000000000000000100000028000480240001800b000100736f636b6574001b140002800800024000000001080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) 42.825273ms ago: executing program 4 (id=9913): r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r1 = socket$kcm(0x29, 0x5, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x0) sendmsg$kcm(r1, &(0x7f0000000380)={&(0x7f0000000040)=@nfc_llcp={0x27, r2, 0x1, 0x1, 0x1, 0x1, "1e17a2c3c02cb8a0b6a86c9503836a6be243e4143ab7f6469e5965514447956b4f5d85e97d4700af07de8b8ab2fa7a07ba11e80fbaa3fbe4778c98cb15860d", 0x1c}, 0x80, &(0x7f0000000340)=[{&(0x7f00000001c0)="568a4cdceb67444087e8d618e7394aadbe0696078df221df73bf8a09621b0820a845cc0dd75c0a48b015976b9c8c2b6e90f6159d7b303f33d36289eb5321fc84e43987a40a91c0deb46a6cf0612bcd8f5dd2f8113a7a5d65f95a77146f06ad523373fe6d3da64e2c68257061e42b5fc998d881ae67de9d4bc996a6ad030421a6d83e3b7e019966c6946ee4e535b2a7d4ce4b792484d462b523be885d43ee90ab4c95054bde137eef3f304ff6262ab1db980199a0a1328aa7adddb1528d0127e1b501a5e5a47a8f5d5ee8bf87df9b0efb", 0xd0}, {&(0x7f00000002c0)="360c9a82bcdb425a2b8a8624c800ee125f173788fb624218c76a479fb70e5c41aa2a2fb2b44e282bcfeaa32566352b2052f74371151e09826a1cb5285b79b6b33c9f3f08ccddffc98adbb086db263eb408410de7ee4c7d8259af24d3ec44b9cb7ecf44a576885008057f09b04fe818822772", 0x72}], 0x2}, 0x800) recvmmsg(r0, &(0x7f00000050c0), 0x0, 0x2, 0x0) sendmmsg(r0, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 0s ago: executing program 3 (id=9914): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket(0x400000000010, 0xa, 0x5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newtfilter={0x24, 0x2c, 0x800, 0x70bd25, 0x6, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0xc, 0xc}, {0x8, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000}, 0x4008000) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r5, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000801}, 0x40810) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x20000002, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x5, 0x8, 0x17, 0x2, 0x1, 0x0, 0xe, {0x0, 0x7fff, 0x225, 0x3, 0xfffffffc, 0x4}}}}]}, 0x78}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd624ace8e8f5ede07f3fa810200e85a973be1ff00003bfffe80000000000000000000000000896c24b50000000000000000000000000001"], 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@deltclass={0xd4, 0x29, 0x400, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x10, 0x4}, {0xffee, 0x1}, {0xc, 0xd}}, [@tclass_kind_options=@c_taprio={0xb}, @TCA_RATE={0x6, 0x5, {0x3, 0x7}}, @tclass_kind_options=@c_ingress={0xc}, @tclass_kind_options=@c_hfsc={{0x9}, {0x54, 0x2, [@TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xffffff0d, 0x5}}, @TCA_HFSC_FSC={0x10, 0x2, {0x3, 0x8, 0x4}}, @TCA_HFSC_USC={0x10, 0x3, {0x5, 0x6, 0x7a0}}, @TCA_HFSC_RSC={0x10, 0x1, {0x401, 0x2, 0x2004}}, @TCA_HFSC_USC={0x10, 0x3, {0x0, 0x400}}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x5}}, @tclass_kind_options=@c_multiq={0xb}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_skbprio={0xc}, @TCA_RATE={0x6, 0x5, {0x0, 0x1}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20008941}, 0x8080) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0xe, 0xb, 0x1, 0x6}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240448a4}, 0x4004884) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r9 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) unshare(0x70020d80) r10 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r10, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r10, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000200)={'wlan1\x00'}) bpf$MAP_CREATE(0x0, 0x0, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="28000000100001000200"/20, @ANYRES32=0x0, @ANYBLOB="070000000100000008001b0000000000"], 0x28}}, 0x0) read(r9, 0x0, 0x0) sendto$packet(r7, &(0x7f00000002c0)="05031c00d3fc142efd004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) kernel console output (not intermixed with test programs): ] ? apparmor_socket_sendmsg+0x98/0x360 [ 1023.893296][ T5731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1023.893317][ T5731] sock_sendmsg_nosec+0x13a/0x180 [ 1023.893344][ T5731] ____sys_sendmsg+0x54e/0x850 [ 1023.893369][ T5731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1023.893396][ T5731] ? import_iovec+0x73/0xa0 [ 1023.893420][ T5731] ___sys_sendmsg+0x2a5/0x360 [ 1023.893438][ T5731] ? __lock_acquire+0x6df/0x2e50 [ 1023.893463][ T5731] ? __pfx____sys_sendmsg+0x10/0x10 [ 1023.893523][ T5731] ? __fget_files+0x2a/0x420 [ 1023.893546][ T5731] ? __fget_files+0x3a2/0x420 [ 1023.893579][ T5731] __x64_sys_sendmsg+0x1b1/0x290 [ 1023.893600][ T5731] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1023.893641][ T5731] do_syscall_64+0x166/0x520 [ 1023.893666][ T5731] ? trace_irq_disable+0x3b/0x140 [ 1023.893684][ T5731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.893703][ T5731] ? clear_bhb_loop+0x70/0xc0 [ 1023.893726][ T5731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1023.893743][ T5731] RIP: 0033:0x7fe7d179e159 [ 1023.893762][ T5731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1023.893778][ T5731] RSP: 002b:00007fe7d26d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1023.893798][ T5731] RAX: ffffffffffffffda RBX: 00007fe7d1a25fa0 RCX: 00007fe7d179e159 [ 1023.893811][ T5731] RDX: 0000000000040000 RSI: 0000200000000200 RDI: 0000000000000004 [ 1023.893823][ T5731] RBP: 00007fe7d26d3090 R08: 0000000000000000 R09: 0000000000000000 [ 1023.893834][ T5731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1023.893845][ T5731] R13: 00007fe7d1a26038 R14: 00007fe7d1a25fa0 R15: 00007ffce31efe98 [ 1023.893880][ T5731] [ 1023.944257][ T1430] bond3: (slave bridge3): failed to get link speed/duplex [ 1024.054966][ T1430] bond3: (slave bridge3): failed to get link speed/duplex [ 1024.164363][ T1418] bond3: (slave bridge3): failed to get link speed/duplex [ 1024.264056][ T5751] netlink: 'syz.2.9088': attribute type 7 has an invalid length. [ 1024.264155][ T5751] netlink: 'syz.2.9088': attribute type 8 has an invalid length. [ 1024.275919][ T1430] bond3: (slave bridge3): failed to get link speed/duplex [ 1024.387188][ T1429] bond3: (slave bridge3): failed to get link speed/duplex [ 1024.730363][ T5773] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9096'. [ 1024.866286][ T52] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1024.885202][ T52] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1024.894768][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1024.903010][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1024.913173][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1024.919268][ T5781] netlink: 60 bytes leftover after parsing attributes in process `syz.4.9098'. [ 1025.077791][ T5786] FAULT_INJECTION: forcing a failure. [ 1025.077791][ T5786] name failslab, interval 1, probability 0, space 0, times 0 [ 1025.091974][ T5786] CPU: 1 UID: 0 PID: 5786 Comm: syz.4.9101 Not tainted syzkaller #0 PREEMPT(full) [ 1025.092000][ T5786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1025.092012][ T5786] Call Trace: [ 1025.092020][ T5786] [ 1025.092029][ T5786] dump_stack_lvl+0xe8/0x150 [ 1025.092061][ T5786] should_fail_ex+0x410/0x560 [ 1025.092092][ T5786] ? __alloc_skb+0x1db/0x7a0 [ 1025.092119][ T5786] should_failslab+0xa8/0x100 [ 1025.092143][ T5786] ? __alloc_skb+0x1db/0x7a0 [ 1025.092167][ T5786] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1025.092194][ T5786] ? __alloc_skb+0x18d/0x7a0 [ 1025.092221][ T5786] ? __alloc_skb+0x1db/0x7a0 [ 1025.092264][ T5786] __alloc_skb+0x1db/0x7a0 [ 1025.092296][ T5786] xfrm_send_policy_notify+0x2a0/0x1c00 [ 1025.092332][ T5786] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 1025.092357][ T5786] ? lock_acquire+0x115/0x350 [ 1025.092383][ T5786] ? lockdep_hardirqs_on+0x7b/0x110 [ 1025.092407][ T5786] ? __local_bh_enable_ip+0xd6/0x140 [ 1025.092430][ T5786] ? km_policy_notify+0x28/0x200 [ 1025.092532][ T5786] ? __pfx_xfrm_send_policy_notify+0x10/0x10 [ 1025.092557][ T5786] km_policy_notify+0x121/0x200 [ 1025.092580][ T5786] ? km_policy_notify+0x28/0x200 [ 1025.092604][ T5786] xfrm_add_policy+0x4a1/0x690 [ 1025.092635][ T5786] ? __pfx_xfrm_add_policy+0x10/0x10 [ 1025.092658][ T5786] ? apparmor_capable+0x126/0x170 [ 1025.092688][ T5786] ? __nla_parse+0x40/0x60 [ 1025.092714][ T5786] xfrm_user_rcv_msg+0x7a8/0xf30 [ 1025.092746][ T5786] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1025.092803][ T5786] ? __mutex_trylock_common+0x15f/0x270 [ 1025.092831][ T5786] ? __pfx___mutex_trylock_common+0x10/0x10 [ 1025.092858][ T5786] ? rcu_is_watching+0x16/0xb0 [ 1025.092880][ T5786] ? trace_contention_end+0x3d/0x140 [ 1025.092912][ T5786] netlink_rcv_skb+0x226/0x4a0 [ 1025.092936][ T5786] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 1025.092964][ T5786] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1025.093004][ T5786] ? netlink_deliver_tap+0x2e/0x1b0 [ 1025.093026][ T5786] ? netlink_deliver_tap+0x2e/0x1b0 [ 1025.093051][ T5786] xfrm_netlink_rcv+0x79/0x90 [ 1025.093077][ T5786] netlink_unicast+0x7bd/0x940 [ 1025.093109][ T5786] netlink_sendmsg+0x813/0xb40 [ 1025.093143][ T5786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.093175][ T5786] ? apparmor_socket_sendmsg+0x98/0x360 [ 1025.093208][ T5786] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1025.093229][ T5786] sock_sendmsg_nosec+0x13a/0x180 [ 1025.093266][ T5786] ____sys_sendmsg+0x54e/0x850 [ 1025.093293][ T5786] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1025.093323][ T5786] ? import_iovec+0x73/0xa0 [ 1025.093348][ T5786] ___sys_sendmsg+0x2a5/0x360 [ 1025.093368][ T5786] ? __lock_acquire+0x6df/0x2e50 [ 1025.093392][ T5786] ? __pfx____sys_sendmsg+0x10/0x10 [ 1025.093450][ T5786] ? __fget_files+0x2a/0x420 [ 1025.093473][ T5786] ? __fget_files+0x3a2/0x420 [ 1025.093507][ T5786] __x64_sys_sendmsg+0x1b1/0x290 [ 1025.093531][ T5786] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1025.093575][ T5786] do_syscall_64+0x166/0x520 [ 1025.093600][ T5786] ? trace_irq_disable+0x3b/0x140 [ 1025.093618][ T5786] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.093638][ T5786] ? clear_bhb_loop+0x70/0xc0 [ 1025.093662][ T5786] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1025.093680][ T5786] RIP: 0033:0x7f6b4c19e159 [ 1025.093699][ T5786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1025.093716][ T5786] RSP: 002b:00007f6b4d0f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1025.093737][ T5786] RAX: ffffffffffffffda RBX: 00007f6b4c425fa0 RCX: 00007f6b4c19e159 [ 1025.093751][ T5786] RDX: 0000000000000010 RSI: 0000200000000180 RDI: 0000000000000004 [ 1025.093763][ T5786] RBP: 00007f6b4d0f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1025.093775][ T5786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1025.093786][ T5786] R13: 00007f6b4c426038 R14: 00007f6b4c425fa0 R15: 00007fffadeaa778 [ 1025.093818][ T5786] [ 1025.388334][ T5796] tipc: Started in network mode [ 1025.388352][ T5796] tipc: Node identity , cluster identity 4711 [ 1025.388365][ T5796] tipc: Failed to set node id, please configure manually [ 1025.388405][ T5796] tipc: Enabling of bearer rejected, failed to enable media [ 1025.393041][ T5796] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9102'. [ 1025.423081][ T5796] netlink: 'syz.2.9102': attribute type 1 has an invalid length. [ 1025.591311][ T5804] netlink: 28 bytes leftover after parsing attributes in process `syz.2.9102'. [ 1025.608807][ T5796] bond2: entered promiscuous mode [ 1025.609233][ T5796] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1025.659506][ T5803] --map-set only usable from mangle table [ 1025.692026][ T5804] bond2: entered allmulticast mode [ 1025.747645][ T5796] bond2: (slave bridge1): making interface the new active one [ 1025.760575][ T5796] bridge1: entered promiscuous mode [ 1025.767106][ T5796] bridge1: entered allmulticast mode [ 1025.774495][ T5796] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 1025.836234][ T5809] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1025.886443][ T5809] bond3 (unregistering): Released all slaves [ 1026.232987][ T1430] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1026.247364][ T1430] netdevsim netdevsim0 eth3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1026.247400][ T1430] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1026.306533][ T5832] sctp: [Deprecated]: syz.3.9109 (pid 5832) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1026.306533][ T5832] Use struct sctp_sack_info instead [ 1026.362025][ T5832] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1026.456433][ T5832] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1026.615865][ T5836] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9110'. [ 1026.635122][ T1430] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1026.635172][ T1430] netdevsim netdevsim0 eth2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1026.635211][ T1430] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1026.671085][ T5776] lo speed is unknown, defaulting to 1000 [ 1026.672626][ T5836] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9110'. [ 1026.672644][ T5836] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9110'. [ 1026.710196][ T5776] lo speed is unknown, defaulting to 1000 [ 1026.852819][ T1430] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1026.871600][ T1430] netdevsim netdevsim0 eth1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1026.871668][ T1430] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1026.982973][ T1430] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 256 - 0 [ 1026.992832][ T1430] netdevsim netdevsim0 eth0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 1026.992863][ T1430] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1027.024138][ T52] Bluetooth: hci2: command tx timeout [ 1027.048169][ T5860] geneve1: entered promiscuous mode [ 1027.064354][ T5860] geneve1: left promiscuous mode [ 1027.130105][ T5863] macsec0: left promiscuous mode [ 1027.130142][ T5863] macsec0: entered allmulticast mode [ 1027.152858][ T5863] veth1_macvtap: entered allmulticast mode [ 1027.159280][ T5863] macsec0: left allmulticast mode [ 1027.164944][ T5863] veth1_macvtap: left allmulticast mode [ 1027.516838][ T5878] netlink: 'syz.4.9122': attribute type 1 has an invalid length. [ 1027.516878][ T5878] netlink: 'syz.4.9122': attribute type 4 has an invalid length. [ 1027.516904][ T5878] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.9122'. [ 1027.863185][ T1430] batadv1: left allmulticast mode [ 1027.863228][ T1430] batadv1: left promiscuous mode [ 1027.863478][ T1430] bridge0: port 3(batadv1) entered disabled state [ 1027.899413][ T1430] bridge_slave_1: left allmulticast mode [ 1027.905213][ T1430] bridge_slave_1: left promiscuous mode [ 1027.911055][ T1430] bridge0: port 2(bridge_slave_1) entered disabled state [ 1027.946014][ T1430] û: left allmulticast mode [ 1027.950671][ T1430] û: left promiscuous mode [ 1027.955568][ T1430] bridge0: port 1(û) entered disabled state [ 1027.972789][ T5904] netlink: 'syz.3.9130': attribute type 10 has an invalid length. [ 1028.724654][ T1430] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1028.733489][ T1430] bridge0 (unregistering): left promiscuous mode [ 1028.749773][ T1430] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 1028.768002][ T1430] bond3 (unregistering): (slave bridge3): Removing an active aggregator [ 1028.768453][ T1430] bond3 (unregistering): (slave bridge3): Releasing backup interface [ 1028.792402][ T1430] bond4 (unregistering): (slave bridge4): Releasing active interface [ 1028.792437][ T1430] bridge4 (unregistering): left allmulticast mode [ 1028.813546][ T1430] team0: Port device bridge5 removed [ 1028.825002][ T1430] bond0 (unregistering): left promiscuous mode [ 1028.825037][ T1430] bond_slave_0: left promiscuous mode [ 1028.825213][ T1430] bond_slave_1: left promiscuous mode [ 1028.837347][ T1430] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1028.853447][ T1430] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1028.864531][ T1430] bond0 (unregistering): Released all slaves [ 1028.876426][ T1430] bond1 (unregistering): Released all slaves [ 1028.890243][ T1430] bond2 (unregistering): (slave veth3): Releasing active interface [ 1028.900639][ T1430] bond2 (unregistering): (slave veth5): Releasing active interface [ 1028.910891][ T1430] bond2 (unregistering): Released all slaves [ 1028.921504][ T1430] bond3 (unregistering): Released all slaves [ 1028.932766][ T1430] bond4 (unregistering): left allmulticast mode [ 1028.979865][ T1430] bond4 (unregistering): Released all slaves [ 1029.022474][ T5904] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1029.026909][ T5904] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 1029.127750][ T52] Bluetooth: hci2: command tx timeout [ 1029.259333][ T5938] __nla_validate_parse: 4 callbacks suppressed [ 1029.259380][ T5938] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9136'. [ 1029.259430][ T5938] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9136'. [ 1029.264467][ T5924] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1029.301652][ T5277] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1029.308593][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 1029.315950][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 1029.316126][ T5776] bridge_slave_0: entered allmulticast mode [ 1029.331171][ T5776] bridge_slave_0: entered promiscuous mode [ 1029.342587][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 1029.349977][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 1029.357301][ T5776] bridge_slave_1: entered allmulticast mode [ 1029.381171][ T5776] bridge_slave_1: entered promiscuous mode [ 1029.448437][ T5942] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9135'. [ 1029.487211][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1029.507720][ T5942] vlan0: entered promiscuous mode [ 1029.552240][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1029.586143][ T1430] IPVS: stopping backup sync thread 1518 ... [ 1029.649623][ T5776] team0: Port device team_slave_0 added [ 1029.660999][ T5776] team0: Port device team_slave_1 added [ 1029.745534][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1029.753027][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1029.753087][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1029.792542][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1029.792579][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1029.808909][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1029.873284][ T5961] net_ratelimit: 12 callbacks suppressed [ 1029.873332][ T5961] netlink: NAT attribute has 1 unknown bytes [ 1029.873365][ T5961] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1029.879195][ T5961] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified. [ 1029.879226][ T5961] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1029.982203][ T5967] FAULT_INJECTION: forcing a failure. [ 1029.982203][ T5967] name failslab, interval 1, probability 0, space 0, times 0 [ 1029.982257][ T5967] CPU: 0 UID: 0 PID: 5967 Comm: syz.2.9142 Not tainted syzkaller #0 PREEMPT(full) [ 1029.982277][ T5967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1029.982288][ T5967] Call Trace: [ 1029.982294][ T5967] [ 1029.982301][ T5967] dump_stack_lvl+0xe8/0x150 [ 1029.982328][ T5967] should_fail_ex+0x410/0x560 [ 1029.982356][ T5967] ? __alloc_skb+0x1db/0x7a0 [ 1029.982383][ T5967] should_failslab+0xa8/0x100 [ 1029.982406][ T5967] ? __alloc_skb+0x1db/0x7a0 [ 1029.982429][ T5967] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1029.982454][ T5967] ? __alloc_skb+0x18d/0x7a0 [ 1029.982479][ T5967] ? __alloc_skb+0x1db/0x7a0 [ 1029.982511][ T5967] __alloc_skb+0x1db/0x7a0 [ 1029.982540][ T5967] netlink_sendmsg+0x5d4/0xb40 [ 1029.982572][ T5967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1029.982601][ T5967] ? apparmor_socket_sendmsg+0x98/0x360 [ 1029.982631][ T5967] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1029.982652][ T5967] sock_sendmsg_nosec+0x13a/0x180 [ 1029.982679][ T5967] ____sys_sendmsg+0x54e/0x850 [ 1029.982707][ T5967] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1029.982734][ T5967] ? import_iovec+0x73/0xa0 [ 1029.982757][ T5967] ___sys_sendmsg+0x2a5/0x360 [ 1029.982775][ T5967] ? __lock_acquire+0x6df/0x2e50 [ 1029.982797][ T5967] ? __pfx____sys_sendmsg+0x10/0x10 [ 1029.982849][ T5967] ? __fget_files+0x2a/0x420 [ 1029.982870][ T5967] ? __fget_files+0x3a2/0x420 [ 1029.982902][ T5967] __x64_sys_sendmsg+0x1b1/0x290 [ 1029.982924][ T5967] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1029.982971][ T5967] do_syscall_64+0x166/0x520 [ 1029.982997][ T5967] ? trace_irq_disable+0x3b/0x140 [ 1029.983015][ T5967] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1029.983033][ T5967] ? clear_bhb_loop+0x70/0xc0 [ 1029.983056][ T5967] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1029.983073][ T5967] RIP: 0033:0x7fe7e699e159 [ 1029.983091][ T5967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1029.983107][ T5967] RSP: 002b:00007fe7e7798028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1029.983127][ T5967] RAX: ffffffffffffffda RBX: 00007fe7e6c25fa0 RCX: 00007fe7e699e159 [ 1029.983140][ T5967] RDX: 0000000000004054 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1029.983152][ T5967] RBP: 00007fe7e7798090 R08: 0000000000000000 R09: 0000000000000000 [ 1029.983163][ T5967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1029.983174][ T5967] R13: 00007fe7e6c26038 R14: 00007fe7e6c25fa0 R15: 00007fff3e6a9958 [ 1029.983203][ T5967] [ 1030.067384][ C1] ip6_tnl_xmit_ctl: 18 callbacks suppressed [ 1030.067404][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1030.415789][ T5776] hsr_slave_0: entered promiscuous mode [ 1030.427714][ T5776] hsr_slave_1: entered promiscuous mode [ 1030.428535][ T5776] debugfs: 'hsr0' already exists in 'hsr' [ 1030.428555][ T5776] Cannot create hsr debugfs directory [ 1030.559661][ T5987] xt_TCPMSS: Only works on TCP SYN packets [ 1030.576525][ T5983] syz_tun: entered promiscuous mode [ 1030.587919][ T5983] syz_tun: left promiscuous mode [ 1030.852461][ T1430] team0: left promiscuous mode [ 1030.852496][ T1430] team_slave_0: left promiscuous mode [ 1030.852707][ T1430] team_slave_1: left promiscuous mode [ 1030.908496][ T1430] hsr_slave_0: left promiscuous mode [ 1030.935885][ T1430] veth1_macvtap: left promiscuous mode [ 1030.935936][ T1430] veth0_macvtap: left promiscuous mode [ 1030.936064][ T1430] veth1_vlan: left promiscuous mode [ 1031.097664][ T6011] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9150'. [ 1031.097742][ T6011] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9150'. [ 1031.184172][ T52] Bluetooth: hci2: command tx timeout [ 1031.545752][ T1430] team0 (unregistering): Port device team_slave_1 removed [ 1031.576204][ T1430] team0 (unregistering): Port device team_slave_0 removed [ 1031.736364][ T5277] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1031.922989][ T5993] lo speed is unknown, defaulting to 1000 [ 1031.992346][ T5993] lo speed is unknown, defaulting to 1000 [ 1032.091735][ T6048] syz_tun: entered promiscuous mode [ 1032.098926][ T6048] macvtap1: entered allmulticast mode [ 1032.098954][ T6048] syz_tun: entered allmulticast mode [ 1032.143689][ T6048] syz_tun: left allmulticast mode [ 1032.143751][ T6048] syz_tun: left promiscuous mode [ 1032.196768][ T6051] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 1032.202283][ T6052] --map-set only usable from mangle table [ 1032.270881][ T6052] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1032.325208][ T6052] bond1 (unregistering): Released all slaves [ 1032.373670][ T6051] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9158'. [ 1032.686383][ T6068] xt_nfacct: accounting object `' does not exist [ 1033.274716][ T52] Bluetooth: hci2: command tx timeout [ 1033.504777][ T6072] netlink: 'syz.2.9165': attribute type 2 has an invalid length. [ 1033.536256][ T6075] x_tables: duplicate underflow at hook 1 [ 1033.547446][ T6075] IPVS: length: 24 != 36888 [ 1033.582751][ T6073] netlink: 44 bytes leftover after parsing attributes in process `syz.4.9166'. [ 1033.662089][ T6081] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9168'. [ 1033.673729][ T6081] netlink: 'syz.3.9168': attribute type 10 has an invalid length. [ 1033.682258][ T6081] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9168'. [ 1033.838941][ T1430] IPVS: stop unused estimator thread 0... [ 1033.902573][ T6091] netlink: 104 bytes leftover after parsing attributes in process `syz.3.9171'. [ 1034.133295][ T6099] bridge9: entered promiscuous mode [ 1034.140776][ T6099] bridge9: entered allmulticast mode [ 1034.158566][ T6099] team0: Port device bridge9 added [ 1034.582899][ T6109] xt_nfacct: accounting object `' does not exist [ 1035.030687][ T5776] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1035.041885][ T6126] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9182'. [ 1035.054017][ T6126] netlink: 'syz.2.9182': attribute type 10 has an invalid length. [ 1035.061930][ T6126] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9182'. [ 1035.072510][ T5776] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1035.086761][ T6126] geneve2: entered promiscuous mode [ 1035.092185][ T6126] geneve2: entered allmulticast mode [ 1035.100920][ T5776] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1035.121891][ T5776] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1035.128600][ T5776] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1035.159760][ T5776] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1035.163672][ T5776] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1035.204992][ T5776] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1035.264489][ T6141] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9184'. [ 1035.468526][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1035.522955][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 1035.557746][ T1418] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.557882][ T1418] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1035.562655][ T1418] bridge0: port 2(bridge_slave_1) entered blocking state [ 1035.562753][ T1418] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1035.862240][ T6162] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1035.871143][ T6162] 8021q: adding VLAN 0 to HW filter on device team0 [ 1035.871709][ T6162] tipc: Resetting bearer [ 1036.015824][ T6162] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1036.028602][ T6162] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1036.066386][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1036.074938][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1036.083173][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1036.091500][ T6162] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1036.099440][ T6162] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 1036.394173][ T1215] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1036.434121][ T9226] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1036.435322][ T1215] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1036.435849][ T1215] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1036.813185][ T6200] netlink: 168 bytes leftover after parsing attributes in process `syz.3.9195'. [ 1037.217149][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1037.320350][ T6231] veth1_macvtap: left promiscuous mode [ 1037.327636][ T6231] macsec0: entered allmulticast mode [ 1037.364979][ T6230] syz_tun: entered promiscuous mode [ 1037.365248][ T6230] macvtap1: entered allmulticast mode [ 1037.365263][ T6230] syz_tun: entered allmulticast mode [ 1037.408456][ T6230] syz_tun: left allmulticast mode [ 1037.413693][ T6230] syz_tun: left promiscuous mode [ 1037.466147][ T6231] veth1_macvtap: entered promiscuous mode [ 1037.472035][ T6231] veth1_macvtap: entered allmulticast mode [ 1037.478735][ T6231] macsec0: left allmulticast mode [ 1037.484005][ T6231] veth1_macvtap: left allmulticast mode [ 1037.668568][ T5776] veth0_vlan: entered promiscuous mode [ 1037.755471][ T5776] veth1_vlan: entered promiscuous mode [ 1037.874680][ T6257] netlink: 224 bytes leftover after parsing attributes in process `syz.1.9207'. [ 1037.878805][ T5776] veth0_macvtap: entered promiscuous mode [ 1037.968596][ T6254] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1038.099628][ T6254] bond1 (unregistering): Released all slaves [ 1038.152943][ T5776] veth1_macvtap: entered promiscuous mode [ 1038.287398][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1038.322332][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1038.357843][ T6270] xt_socket: unknown flags 0x4c [ 1038.365245][ T1215] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.375406][ T1215] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.375476][ T1215] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.375514][ T1215] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1038.679028][ T1417] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.679064][ T1417] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1038.881026][ T1430] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1038.881068][ T1430] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1039.213888][ T6313] netlink: 'syz.0.9093': attribute type 39 has an invalid length. [ 1039.301227][ T6318] netlink: 'syz.0.9093': attribute type 39 has an invalid length. [ 1039.362072][ T6314] veth11: entered promiscuous mode [ 1039.362116][ T6314] veth11: entered allmulticast mode [ 1040.008041][ T6345] syz_tun: entered promiscuous mode [ 1040.013163][ T6345] macvtap1: entered allmulticast mode [ 1040.013182][ T6345] syz_tun: entered allmulticast mode [ 1040.068010][ T6345] syz_tun: left allmulticast mode [ 1040.068059][ T6345] syz_tun: left promiscuous mode [ 1040.237075][ T6353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9228'. [ 1040.237114][ T6353] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9228'. [ 1040.371338][T31730] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1040.389789][T31730] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1040.401006][T31730] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1040.409238][T31730] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1040.418014][T31730] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1040.516332][ T6362] veth1_macvtap: left promiscuous mode [ 1040.516380][ T6362] macsec0: entered allmulticast mode [ 1040.525860][ T6362] veth1_macvtap: entered promiscuous mode [ 1040.525881][ T6362] veth1_macvtap: entered allmulticast mode [ 1040.525956][ T6362] macsec0: left allmulticast mode [ 1040.525968][ T6362] veth1_macvtap: left allmulticast mode [ 1040.798186][ T6370] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1040.857689][ T6370] bond1 (unregistering): Released all slaves [ 1040.925821][ T6392] xt_nfacct: accounting object `' does not exist [ 1041.155391][T28442] syz_tun (unregistering): left allmulticast mode [ 1041.317637][ T6404] team0: Device wg1 is of different type [ 1041.342592][ T6404] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 1041.387013][ T6413] veth1_macvtap: left promiscuous mode [ 1041.387067][ T6413] macsec0: entered allmulticast mode [ 1041.447119][ T6413] veth1_macvtap: entered promiscuous mode [ 1041.447157][ T6413] veth1_macvtap: entered allmulticast mode [ 1041.447593][ T6413] macsec0: left allmulticast mode [ 1041.447608][ T6413] veth1_macvtap: left allmulticast mode [ 1041.619848][ T6401] tipc: Resetting bearer [ 1041.750691][ T6426] syz_tun: entered promiscuous mode [ 1041.769394][ T6426] syz_tun: left promiscuous mode [ 1041.894597][ T6360] lo speed is unknown, defaulting to 1000 [ 1041.897788][ T6360] lo speed is unknown, defaulting to 1000 [ 1042.025305][ T6441] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9243'. [ 1042.464509][ T52] Bluetooth: hci5: command tx timeout [ 1042.794599][ T6479] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9248'. [ 1042.803614][ T6479] netlink: 'syz.4.9248': attribute type 10 has an invalid length. [ 1042.811761][ T6479] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9248'. [ 1043.049075][ T6492] Bluetooth: MGMT ver 1.23 [ 1043.102004][ T6492] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9252'. [ 1043.117280][ T6360] bridge0: port 1(bridge_slave_0) entered blocking state [ 1043.117408][ T6360] bridge0: port 1(bridge_slave_0) entered disabled state [ 1043.117568][ T6360] bridge_slave_0: entered allmulticast mode [ 1043.129045][ T6360] bridge_slave_0: entered promiscuous mode [ 1043.149195][ T6360] bridge0: port 2(bridge_slave_1) entered blocking state [ 1043.149311][ T6360] bridge0: port 2(bridge_slave_1) entered disabled state [ 1043.149455][ T6360] bridge_slave_1: entered allmulticast mode [ 1043.159620][ T6360] bridge_slave_1: entered promiscuous mode [ 1043.241324][ T6360] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1043.325298][ T6360] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1043.381176][ T6506] tc_dump_action: action bad kind [ 1043.469573][ T6360] team0: Port device team_slave_0 added [ 1043.482331][ T6360] team0: Port device team_slave_1 added [ 1044.106873][ T6539] netlink: 'syz.3.9261': attribute type 12 has an invalid length. [ 1044.122475][ T6360] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1044.122515][ T6360] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1044.122551][ T6360] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1044.266019][ T6545] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9261'. [ 1044.544002][ T52] Bluetooth: hci5: command tx timeout [ 1046.627943][ T52] Bluetooth: hci5: command tx timeout [ 1046.938282][ T6360] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1046.938312][ T6360] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1046.938335][ T6360] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1046.983117][ T6553] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9262'. [ 1046.983209][ T6553] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9262'. [ 1046.983259][ T6545] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1047.075934][ T6578] macvtap1: entered allmulticast mode [ 1047.077325][ T6578] syz_tun: entered allmulticast mode [ 1047.093363][ T6578] syz_tun: left allmulticast mode [ 1047.248066][ T6360] hsr_slave_0: entered promiscuous mode [ 1047.254829][ T6360] hsr_slave_1: entered promiscuous mode [ 1047.261198][ T6360] debugfs: 'hsr0' already exists in 'hsr' [ 1047.272510][ T6360] Cannot create hsr debugfs directory [ 1047.569963][ T6599] xt_l2tp: wrong L2TP version: 18 [ 1047.710142][ T6360] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1047.890966][ T6360] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.120673][ T6360] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.154579][ T6606] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9275'. [ 1048.337488][ T6611] FAULT_INJECTION: forcing a failure. [ 1048.337488][ T6611] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1048.344513][ T6360] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1048.361538][ T6611] CPU: 0 UID: 0 PID: 6611 Comm: syz.0.9277 Not tainted syzkaller #0 PREEMPT(full) [ 1048.361564][ T6611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1048.361575][ T6611] Call Trace: [ 1048.361584][ T6611] [ 1048.361591][ T6611] dump_stack_lvl+0xe8/0x150 [ 1048.361624][ T6611] should_fail_ex+0x410/0x560 [ 1048.361657][ T6611] _copy_from_user+0x2d/0xb0 [ 1048.361679][ T6611] ____sys_sendmsg+0x303/0x850 [ 1048.361705][ T6611] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1048.361734][ T6611] ? import_iovec+0x73/0xa0 [ 1048.361758][ T6611] ___sys_sendmsg+0x2a5/0x360 [ 1048.361777][ T6611] ? __lock_acquire+0x6df/0x2e50 [ 1048.361800][ T6611] ? __pfx____sys_sendmsg+0x10/0x10 [ 1048.361852][ T6611] ? __fget_files+0x2a/0x420 [ 1048.361874][ T6611] ? __fget_files+0x3a2/0x420 [ 1048.361903][ T6611] __x64_sys_sendmsg+0x1b1/0x290 [ 1048.361924][ T6611] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1048.361962][ T6611] do_syscall_64+0x166/0x520 [ 1048.361988][ T6611] ? trace_irq_disable+0x3b/0x140 [ 1048.362005][ T6611] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.362024][ T6611] ? clear_bhb_loop+0x70/0xc0 [ 1048.362046][ T6611] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1048.362064][ T6611] RIP: 0033:0x7f2e90f9e159 [ 1048.362080][ T6611] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1048.362095][ T6611] RSP: 002b:00007f2e91f44028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1048.362114][ T6611] RAX: ffffffffffffffda RBX: 00007f2e91225fa0 RCX: 00007f2e90f9e159 [ 1048.362126][ T6611] RDX: 0000000000040000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1048.362138][ T6611] RBP: 00007f2e91f44090 R08: 0000000000000000 R09: 0000000000000000 [ 1048.362150][ T6611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1048.362168][ T6611] R13: 00007f2e91226038 R14: 00007f2e91225fa0 R15: 00007ffea9e3f358 [ 1048.362196][ T6611] [ 1048.697166][ T6621] netlink: 'syz.2.9281': attribute type 2 has an invalid length. [ 1048.705150][ T52] Bluetooth: hci5: command tx timeout [ 1048.958424][ T6360] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1048.976446][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1048.984603][ T6360] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1048.997899][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1049.007114][ T6360] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1049.028444][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1049.038969][ T6360] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1049.062924][ T6360] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1049.368837][ T6360] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1049.431257][ T6360] 8021q: adding VLAN 0 to HW filter on device team0 [ 1049.452977][ T1430] bridge0: port 1(bridge_slave_0) entered blocking state [ 1049.453103][ T1430] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1049.488804][ T1430] bridge0: port 2(bridge_slave_1) entered blocking state [ 1049.488918][ T1430] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1049.508382][ T6655] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9288'. [ 1049.850091][ T6664] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1050.048654][ T6681] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1050.379007][ T6696] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9293'. [ 1050.743318][ T6718] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9298'. [ 1050.852031][ T6715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9297'. [ 1051.018656][ T6360] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1051.112152][ T6360] veth0_vlan: entered promiscuous mode [ 1051.140757][ T6360] veth1_vlan: entered promiscuous mode [ 1051.241979][ T6360] veth0_macvtap: entered promiscuous mode [ 1051.259282][ T6360] veth1_macvtap: entered promiscuous mode [ 1051.267376][ T6741] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9305'. [ 1051.267411][ T6741] netlink: 'syz.0.9305': attribute type 10 has an invalid length. [ 1051.267442][ T6741] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9305'. [ 1051.297630][ T6741] geneve2: entered promiscuous mode [ 1051.297657][ T6741] geneve2: entered allmulticast mode [ 1051.355012][ T6360] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1051.393878][ T6360] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1051.478094][ T1429] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.487205][ T1429] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.493172][ T6750] netlink: 27 bytes leftover after parsing attributes in process `syz.4.9307'. [ 1051.514892][ T9226] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.514948][ T9226] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1051.686787][ T6756] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 1051.689444][ T1429] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1051.689463][ T1429] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1051.769415][ T1430] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1051.769458][ T1430] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1052.452827][ T6783] macvtap1: entered allmulticast mode [ 1052.458561][ T6783] syz_tun: entered allmulticast mode [ 1052.479627][ T6783] syz_tun: left allmulticast mode [ 1052.570482][ T6788] __nla_validate_parse: 2 callbacks suppressed [ 1052.570735][ T6788] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9321'. [ 1053.011091][ T6811] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9329'. [ 1053.093374][ T6810] syz_tun: entered promiscuous mode [ 1053.118174][ T6810] syz_tun: left promiscuous mode [ 1053.221659][ T6821] syz_tun: entered promiscuous mode [ 1053.227751][ T6821] macvtap1: entered allmulticast mode [ 1053.233619][ T6821] syz_tun: entered allmulticast mode [ 1053.250457][ T6821] syz_tun: left allmulticast mode [ 1053.257592][ T6821] syz_tun: left promiscuous mode [ 1053.430190][ T6831] xt_nfacct: accounting object `' does not exist [ 1053.803421][ T6846] syzkaller1: entered promiscuous mode [ 1053.810540][ T6846] syzkaller1: entered allmulticast mode [ 1054.201724][ T6875] syz_tun: entered allmulticast mode [ 1054.370308][ T6882] FAULT_INJECTION: forcing a failure. [ 1054.370308][ T6882] name failslab, interval 1, probability 0, space 0, times 0 [ 1054.370377][ T6882] CPU: 1 UID: 0 PID: 6882 Comm: syz.0.9353 Not tainted syzkaller #0 PREEMPT(full) [ 1054.370399][ T6882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1054.370409][ T6882] Call Trace: [ 1054.370416][ T6882] [ 1054.370424][ T6882] dump_stack_lvl+0xe8/0x150 [ 1054.370449][ T6882] should_fail_ex+0x410/0x560 [ 1054.370477][ T6882] should_failslab+0xa8/0x100 [ 1054.370500][ T6882] __kmalloc_noprof+0xfe/0x720 [ 1054.370528][ T6882] ? bpf_test_init+0x9f/0x150 [ 1054.370548][ T6882] ? bpf_test_init+0x9f/0x150 [ 1054.370574][ T6882] bpf_test_init+0x9f/0x150 [ 1054.370597][ T6882] bpf_prog_test_run_flow_dissector+0x209/0x610 [ 1054.370630][ T6882] ? lock_acquire+0x115/0x350 [ 1054.370653][ T6882] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 1054.370680][ T6882] ? __fget_files+0x2a/0x420 [ 1054.370705][ T6882] ? __fget_files+0x2a/0x420 [ 1054.370726][ T6882] ? __fget_files+0x3a2/0x420 [ 1054.370747][ T6882] ? __fget_files+0x2a/0x420 [ 1054.370774][ T6882] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 1054.370799][ T6882] bpf_prog_test_run+0x2c5/0x340 [ 1054.370824][ T6882] __sys_bpf+0xa22/0xd90 [ 1054.370851][ T6882] ? __pfx___sys_bpf+0x10/0x10 [ 1054.370881][ T6882] ? __fget_files+0x2a/0x420 [ 1054.370920][ T6882] ? ksys_write+0x242/0x270 [ 1054.370947][ T6882] ? __pfx_ksys_write+0x10/0x10 [ 1054.370977][ T6882] __x64_sys_bpf+0xba/0xd0 [ 1054.370998][ T6882] do_syscall_64+0x166/0x520 [ 1054.371023][ T6882] ? trace_irq_disable+0x3b/0x140 [ 1054.371039][ T6882] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.371058][ T6882] ? clear_bhb_loop+0x70/0xc0 [ 1054.371080][ T6882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1054.371098][ T6882] RIP: 0033:0x7f2e90f9e159 [ 1054.371115][ T6882] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1054.371130][ T6882] RSP: 002b:00007f2e91f44028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1054.371149][ T6882] RAX: ffffffffffffffda RBX: 00007f2e91225fa0 RCX: 00007f2e90f9e159 [ 1054.371163][ T6882] RDX: 0000000000000009 RSI: 00002000000002c0 RDI: 000000000000000a [ 1054.371175][ T6882] RBP: 00007f2e91f44090 R08: 0000000000000000 R09: 0000000000000000 [ 1054.371187][ T6882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1054.371197][ T6882] R13: 00007f2e91226038 R14: 00007f2e91225fa0 R15: 00007ffea9e3f358 [ 1054.371227][ T6882] [ 1054.712746][ T6890] netlink: 204 bytes leftover after parsing attributes in process `syz.0.9355'. [ 1054.819358][ T6889] bridge3: entered promiscuous mode [ 1054.825623][ T6889] bridge3: entered allmulticast mode [ 1054.845190][ T6889] team0: Port device bridge3 added [ 1055.034847][ T1429] pimreg: left allmulticast mode [ 1055.200099][ T6900] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9357'. [ 1056.397278][ T1429] team0: Port device bridge5 removed [ 1056.422557][ T1429] team0: Port device bridge0 removed [ 1056.431117][ T1429] team0: Port device bridge8 removed [ 1056.446727][ T1429] bond0 (unregistering): Released all slaves [ 1056.453146][ T1429] bond1 (unregistering): Released all slaves [ 1056.462996][ T1429] bond2 (unregistering): Released all slaves [ 1056.476042][ T1429] bond3 (unregistering): Released all slaves [ 1056.488130][ T1429] bond4 (unregistering): (slave batadv0): Releasing active interface [ 1056.502703][ T1429] bond4 (unregistering): Released all slaves [ 1056.513228][ T1429] bond5 (unregistering): Released all slaves [ 1056.525438][ T1429] bond6 (unregistering): (slave veth5): Releasing backup interface [ 1056.525486][ T1429] veth5: left promiscuous mode [ 1056.540454][ T1429] bond6 (unregistering): Released all slaves [ 1056.555613][ T1429] bond7 (unregistering): Released all slaves [ 1056.813623][ T6874] syz_tun: left allmulticast mode [ 1056.900902][ T6927] FAULT_INJECTION: forcing a failure. [ 1056.900902][ T6927] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1056.900960][ T6927] CPU: 0 UID: 0 PID: 6927 Comm: syz.4.9366 Not tainted syzkaller #0 PREEMPT(full) [ 1056.900980][ T6927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1056.900991][ T6927] Call Trace: [ 1056.900997][ T6927] [ 1056.901004][ T6927] dump_stack_lvl+0xe8/0x150 [ 1056.901030][ T6927] should_fail_ex+0x410/0x560 [ 1056.901061][ T6927] _copy_from_user+0x2d/0xb0 [ 1056.901082][ T6927] bpf_test_init+0xd8/0x150 [ 1056.901108][ T6927] bpf_prog_test_run_flow_dissector+0x209/0x610 [ 1056.901137][ T6927] ? lock_acquire+0x115/0x350 [ 1056.901159][ T6927] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 1056.901185][ T6927] ? __fget_files+0x2a/0x420 [ 1056.901210][ T6927] ? __fget_files+0x2a/0x420 [ 1056.901234][ T6927] ? __fget_files+0x3a2/0x420 [ 1056.901255][ T6927] ? __fget_files+0x2a/0x420 [ 1056.901282][ T6927] ? __pfx_bpf_prog_test_run_flow_dissector+0x10/0x10 [ 1056.901307][ T6927] bpf_prog_test_run+0x2c5/0x340 [ 1056.901332][ T6927] __sys_bpf+0xa22/0xd90 [ 1056.901359][ T6927] ? __pfx___sys_bpf+0x10/0x10 [ 1056.901389][ T6927] ? __fget_files+0x2a/0x420 [ 1056.901426][ T6927] ? ksys_write+0x242/0x270 [ 1056.901454][ T6927] ? __pfx_ksys_write+0x10/0x10 [ 1056.901484][ T6927] __x64_sys_bpf+0xba/0xd0 [ 1056.901504][ T6927] do_syscall_64+0x166/0x520 [ 1056.901529][ T6927] ? trace_irq_disable+0x3b/0x140 [ 1056.901546][ T6927] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.901564][ T6927] ? clear_bhb_loop+0x70/0xc0 [ 1056.901586][ T6927] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1056.901604][ T6927] RIP: 0033:0x7f6b4c19e159 [ 1056.901620][ T6927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1056.901636][ T6927] RSP: 002b:00007f6b4d0f3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1056.901656][ T6927] RAX: ffffffffffffffda RBX: 00007f6b4c425fa0 RCX: 00007f6b4c19e159 [ 1056.901670][ T6927] RDX: 0000000000000009 RSI: 00002000000002c0 RDI: 000000000000000a [ 1056.901682][ T6927] RBP: 00007f6b4d0f3090 R08: 0000000000000000 R09: 0000000000000000 [ 1056.901693][ T6927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1056.901710][ T6927] R13: 00007f6b4c426038 R14: 00007f6b4c425fa0 R15: 00007fffadeaa778 [ 1056.901740][ T6927] [ 1056.924522][ T1429] ´: left promiscuous mode [ 1056.961836][ T6931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9364'. [ 1057.149074][ T1429] tipc: Left network mode [ 1057.223597][ T1429] IPVS: stopping backup sync thread 23911 ... [ 1057.270371][ T6939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9370'. [ 1057.270415][ T6939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9370'. [ 1057.279222][ T6939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9370'. [ 1057.279242][ T6939] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9370'. [ 1057.327598][ T1417] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1057.327677][ T1417] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1057.327725][ T1417] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1057.327758][ T1417] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1057.493061][ T6949] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1057.499437][ T6939] SET target dimension over the limit! [ 1057.521934][ T6949] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9373'. [ 1057.567440][ T6949] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1057.633796][ T6953] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9374'. [ 1057.778517][ T6949] netlink: 88 bytes leftover after parsing attributes in process `syz.1.9373'. [ 1057.782660][ T6949] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1057.924672][ T6962] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 1057.971932][ T6963] 8021q: adding VLAN 0 to HW filter on device ipvlan3 [ 1058.071680][ T1429] veth1_macvtap: left promiscuous mode [ 1058.071733][ T1429] veth0_macvtap: left promiscuous mode [ 1058.089723][ T6967] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9379'. [ 1058.122167][ T6969] FAULT_INJECTION: forcing a failure. [ 1058.122167][ T6969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1058.122240][ T6969] CPU: 0 UID: 0 PID: 6969 Comm: syz.3.9380 Not tainted syzkaller #0 PREEMPT(full) [ 1058.122260][ T6969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1058.122271][ T6969] Call Trace: [ 1058.122278][ T6969] [ 1058.122286][ T6969] dump_stack_lvl+0xe8/0x150 [ 1058.122313][ T6969] should_fail_ex+0x410/0x560 [ 1058.122338][ T6969] _copy_to_user+0x31/0xb0 [ 1058.122359][ T6969] simple_read_from_buffer+0xe1/0x170 [ 1058.122390][ T6969] proc_fail_nth_read+0x1bb/0x230 [ 1058.122416][ T6969] ? common_file_perm+0x20e/0x2b0 [ 1058.122438][ T6969] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1058.122466][ T6969] ? rw_verify_area+0x24a/0x4c0 [ 1058.122493][ T6969] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1058.122518][ T6969] vfs_read+0x213/0xa80 [ 1058.122547][ T6969] ? __pfx___mutex_lock+0x10/0x10 [ 1058.122578][ T6969] ? __pfx_vfs_read+0x10/0x10 [ 1058.122613][ T6969] ? __fget_files+0x2a/0x420 [ 1058.122639][ T6969] ? __fget_files+0x3a2/0x420 [ 1058.122661][ T6969] ? __fget_files+0x2a/0x420 [ 1058.122692][ T6969] ksys_read+0x150/0x270 [ 1058.122720][ T6969] ? __pfx_ksys_read+0x10/0x10 [ 1058.122755][ T6969] do_syscall_64+0x166/0x520 [ 1058.122779][ T6969] ? trace_irq_disable+0x3b/0x140 [ 1058.122797][ T6969] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1058.122816][ T6969] ? clear_bhb_loop+0x70/0xc0 [ 1058.122837][ T6969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1058.122856][ T6969] RIP: 0033:0x7fe7d175e98e [ 1058.122872][ T6969] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1058.122888][ T6969] RSP: 002b:00007fe7d26d2fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1058.122908][ T6969] RAX: ffffffffffffffda RBX: 00007fe7d26d36c0 RCX: 00007fe7d175e98e [ 1058.122922][ T6969] RDX: 000000000000000f RSI: 00007fe7d26d30a0 RDI: 0000000000000004 [ 1058.122934][ T6969] RBP: 00007fe7d26d3090 R08: 0000000000000000 R09: 0000000000000000 [ 1058.122945][ T6969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1058.122956][ T6969] R13: 00007fe7d1a26038 R14: 00007fe7d1a25fa0 R15: 00007ffce31efe98 [ 1058.122986][ T6969] [ 1058.360690][ T6973] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9381'. [ 1058.701980][ T6975] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9383'. [ 1058.900989][ T6966] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 1059.051114][ T1429] IPVS: stop unused estimator thread 0... [ 1059.127566][ T6995] netlink: 'syz.0.9389': attribute type 1 has an invalid length. [ 1059.263510][ T6998] syz_tun: entered promiscuous mode [ 1059.281516][ T6998] syz_tun: left promiscuous mode [ 1059.312499][ T7006] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9391'. [ 1059.312591][ T7006] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9391'. [ 1059.504421][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1059.728810][ T6987] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1059.728883][ T6987] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1059.946078][ T6993] bond1: (slave veth0_to_bond): making interface the new active one [ 1059.959478][ T6993] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1059.990976][ T6995] macvlan2: entered promiscuous mode [ 1059.992714][ T6995] macvlan2: entered allmulticast mode [ 1059.993335][ T6995] bond1: entered promiscuous mode [ 1059.993356][ T6995] veth0_to_bond: entered promiscuous mode [ 1060.018058][ T6995] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1060.018821][ T6995] bond1: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1060.018921][ T6995] bond1: left promiscuous mode [ 1060.018939][ T6995] veth0_to_bond: left promiscuous mode [ 1060.140751][ T7031] syzkaller0: entered promiscuous mode [ 1060.140779][ T7031] syzkaller0: entered allmulticast mode [ 1060.289806][ T6987] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1060.301073][ T6987] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.734425][ T7050] syz_tun: entered promiscuous mode [ 1062.742506][ T7050] syz_tun: left promiscuous mode [ 1062.847021][ T6987] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1062.847057][ T6987] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1062.902185][ T7065] syz_tun: entered promiscuous mode [ 1062.902439][ T7065] macvtap1: entered allmulticast mode [ 1062.902455][ T7065] syz_tun: entered allmulticast mode [ 1062.913733][ T7065] syz_tun: left allmulticast mode [ 1062.913759][ T7065] syz_tun: left promiscuous mode [ 1063.079124][ T6987] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1063.079194][ T6987] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1063.146673][ T7078] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9402'. [ 1063.190564][ T7080] C: renamed from veth1_to_team (while UP) [ 1063.200524][ T7080] netlink: 164 bytes leftover after parsing attributes in process `syz.0.9403'. [ 1063.220042][ T7080] block nbd0: reconnected socket [ 1063.228296][ T7080] block nbd0: reconnected socket [ 1063.233516][ T7080] nbd: socks must be embedded in a SOCK_ITEM attr [ 1063.241715][ T52] block nbd0: Receive control failed (result -32) [ 1063.242484][T31730] block nbd0: Receive control failed (result -32) [ 1063.302132][ T7086] syz_tun: entered promiscuous mode [ 1063.338868][ T7086] syz_tun: left promiscuous mode [ 1063.452078][ T7092] veth1_macvtap: left promiscuous mode [ 1063.452129][ T7092] macsec0: entered allmulticast mode [ 1063.476486][ T7092] veth1_macvtap: entered promiscuous mode [ 1063.482463][ T7092] veth1_macvtap: entered allmulticast mode [ 1063.488991][ T7092] macsec0: left allmulticast mode [ 1063.494512][ T7092] veth1_macvtap: left allmulticast mode [ 1063.619962][ T7098] FAULT_INJECTION: forcing a failure. [ 1063.619962][ T7098] name failslab, interval 1, probability 0, space 0, times 0 [ 1063.620012][ T7098] CPU: 0 UID: 0 PID: 7098 Comm: syz.1.9410 Not tainted syzkaller #0 PREEMPT(full) [ 1063.620032][ T7098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1063.620042][ T7098] Call Trace: [ 1063.620048][ T7098] [ 1063.620055][ T7098] dump_stack_lvl+0xe8/0x150 [ 1063.620081][ T7098] should_fail_ex+0x410/0x560 [ 1063.620122][ T7098] should_failslab+0xa8/0x100 [ 1063.620145][ T7098] __kmalloc_noprof+0xfe/0x720 [ 1063.620171][ T7098] ? rcu_is_watching+0x16/0xb0 [ 1063.620193][ T7098] ? tomoyo_realpath_from_path+0xef/0x640 [ 1063.620294][ T7098] ? tomoyo_realpath_from_path+0xef/0x640 [ 1063.620321][ T7098] tomoyo_realpath_from_path+0xef/0x640 [ 1063.620351][ T7098] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1063.620378][ T7098] tomoyo_path_number_perm+0x246/0x5f0 [ 1063.620410][ T7098] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1063.620435][ T7098] ? __lock_acquire+0x6df/0x2e50 [ 1063.620468][ T7098] ? hook_file_ioctl+0x1f2/0x600 [ 1063.620506][ T7098] ? __fget_files+0x2a/0x420 [ 1063.620532][ T7098] ? __fget_files+0x2a/0x420 [ 1063.620553][ T7098] ? __fget_files+0x3a2/0x420 [ 1063.620574][ T7098] ? __fget_files+0x2a/0x420 [ 1063.620600][ T7098] security_file_ioctl+0xc3/0x2a0 [ 1063.620628][ T7098] __se_sys_ioctl+0x47/0x170 [ 1063.620650][ T7098] do_syscall_64+0x166/0x520 [ 1063.620674][ T7098] ? trace_irq_disable+0x3b/0x140 [ 1063.620691][ T7098] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1063.620710][ T7098] ? clear_bhb_loop+0x70/0xc0 [ 1063.620733][ T7098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1063.620751][ T7098] RIP: 0033:0x7f7c4799e159 [ 1063.620768][ T7098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1063.620783][ T7098] RSP: 002b:00007f7c45bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1063.620802][ T7098] RAX: ffffffffffffffda RBX: 00007f7c47c26090 RCX: 00007f7c4799e159 [ 1063.620817][ T7098] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 1063.620829][ T7098] RBP: 00007f7c45bf6090 R08: 0000000000000000 R09: 0000000000000000 [ 1063.620841][ T7098] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1063.620851][ T7098] R13: 00007f7c47c26128 R14: 00007f7c47c26090 R15: 00007ffe3b990758 [ 1063.620881][ T7098] [ 1063.623246][ T7098] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1063.705216][ T1421] netdevsim netdevsim4 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1063.705248][ T1421] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1063.719828][ T7097] veth1_macvtap: left promiscuous mode [ 1063.719854][ T7097] macsec0: entered allmulticast mode [ 1063.740782][ T7103] Bluetooth: MGMT ver 1.23 [ 1063.811753][ T7098] veth1_macvtap: entered promiscuous mode [ 1063.811774][ T7098] veth1_macvtap: entered allmulticast mode [ 1063.811859][ T7098] macsec0: left allmulticast mode [ 1063.811872][ T7098] veth1_macvtap: left allmulticast mode [ 1063.898048][ T7100] syz_tun: entered promiscuous mode [ 1063.946774][ T7100] syz_tun: left promiscuous mode [ 1063.991842][ T7113] xt_nfacct: accounting object `' does not exist [ 1063.999537][ T7110] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9415'. [ 1064.074618][ T1421] netdevsim netdevsim4 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.074668][ T1421] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1064.105867][ T9226] netdevsim netdevsim4 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1064.105935][ T9226] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1064.155762][ T7115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9414'. [ 1064.155883][ T7117] netlink: 'syz.1.9417': attribute type 1 has an invalid length. [ 1064.190019][ T7112] syzkaller0: entered promiscuous mode [ 1064.190044][ T7112] syzkaller0: entered allmulticast mode [ 1064.220818][ T7119] syz_tun: entered promiscuous mode [ 1064.222609][ T7119] macvtap1: entered allmulticast mode [ 1064.222627][ T7119] syz_tun: entered allmulticast mode [ 1064.238712][ T7119] syz_tun: left allmulticast mode [ 1064.238753][ T7119] syz_tun: left promiscuous mode [ 1064.496555][ T7135] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9425'. [ 1066.396845][ T7146] sctp: [Deprecated]: syz.3.9428 (pid 7146) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1066.396845][ T7146] Use struct sctp_sack_info instead [ 1067.103492][ T7149] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9429'. [ 1067.141988][ T7149] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9429'. [ 1067.142031][ T7149] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9429'. [ 1067.145734][ T1429] netdevsim netdevsim4 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1067.145766][ T1429] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.313162][ T7155] syz_tun: entered promiscuous mode [ 1067.322510][ T7155] syz_tun: left promiscuous mode [ 1067.352512][ T7159] FAULT_INJECTION: forcing a failure. [ 1067.352512][ T7159] name failslab, interval 1, probability 0, space 0, times 0 [ 1067.352549][ T7159] CPU: 0 UID: 0 PID: 7159 Comm: syz.4.9431 Not tainted syzkaller #0 PREEMPT(full) [ 1067.352570][ T7159] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1067.352581][ T7159] Call Trace: [ 1067.352587][ T7159] [ 1067.352594][ T7159] dump_stack_lvl+0xe8/0x150 [ 1067.352620][ T7159] should_fail_ex+0x410/0x560 [ 1067.352651][ T7159] should_failslab+0xa8/0x100 [ 1067.352674][ T7159] __kmalloc_noprof+0xfe/0x720 [ 1067.352701][ T7159] ? tomoyo_encode+0x2ad/0x570 [ 1067.352720][ T7159] ? tomoyo_encode+0x2ad/0x570 [ 1067.352746][ T7159] tomoyo_encode+0x2ad/0x570 [ 1067.352771][ T7159] tomoyo_realpath_from_path+0x5fa/0x640 [ 1067.352809][ T7159] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1067.352837][ T7159] tomoyo_path_number_perm+0x246/0x5f0 [ 1067.352866][ T7159] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1067.352895][ T7159] ? __lock_acquire+0x6df/0x2e50 [ 1067.352928][ T7159] ? hook_file_ioctl+0x1f2/0x600 [ 1067.352965][ T7159] ? __fget_files+0x2a/0x420 [ 1067.352991][ T7159] ? __fget_files+0x2a/0x420 [ 1067.353011][ T7159] ? __fget_files+0x3a2/0x420 [ 1067.353033][ T7159] ? __fget_files+0x2a/0x420 [ 1067.353059][ T7159] security_file_ioctl+0xc3/0x2a0 [ 1067.353088][ T7159] __se_sys_ioctl+0x47/0x170 [ 1067.353109][ T7159] do_syscall_64+0x166/0x520 [ 1067.353134][ T7159] ? trace_irq_disable+0x3b/0x140 [ 1067.353152][ T7159] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1067.353170][ T7159] ? clear_bhb_loop+0x70/0xc0 [ 1067.353193][ T7159] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1067.353210][ T7159] RIP: 0033:0x7f6b4c19e159 [ 1067.353228][ T7159] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1067.353244][ T7159] RSP: 002b:00007f6b4d0d2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1067.353263][ T7159] RAX: ffffffffffffffda RBX: 00007f6b4c426090 RCX: 00007f6b4c19e159 [ 1067.353276][ T7159] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 1067.353288][ T7159] RBP: 00007f6b4d0d2090 R08: 0000000000000000 R09: 0000000000000000 [ 1067.353299][ T7159] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1067.353310][ T7159] R13: 00007f6b4c426128 R14: 00007f6b4c426090 R15: 00007fffadeaa778 [ 1067.353340][ T7159] [ 1067.359966][ T7159] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1067.368798][ T7157] macsec0: entered allmulticast mode [ 1067.372367][ T7159] veth1_macvtap: entered allmulticast mode [ 1067.372439][ T7159] macsec0: left allmulticast mode [ 1067.372451][ T7159] veth1_macvtap: left allmulticast mode [ 1067.811138][ T7174] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9440'. [ 1067.811188][ T7174] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9440'. [ 1067.918284][ T52] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1067.932137][ T52] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1067.940155][ T52] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1067.955372][ T52] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1067.970019][ T52] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1068.734920][ T7176] lo speed is unknown, defaulting to 1000 [ 1068.750585][ T7176] lo speed is unknown, defaulting to 1000 [ 1068.781882][ T7221] __nla_validate_parse: 1 callbacks suppressed [ 1068.781920][ T7221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9448'. [ 1068.808664][ T7220] veth1_macvtap: left promiscuous mode [ 1068.808713][ T7220] macsec0: entered allmulticast mode [ 1068.823599][ T7220] FAULT_INJECTION: forcing a failure. [ 1068.823599][ T7220] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1068.837089][ T7220] CPU: 1 UID: 0 PID: 7220 Comm: syz.0.9450 Not tainted syzkaller #0 PREEMPT(full) [ 1068.837114][ T7220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1068.837125][ T7220] Call Trace: [ 1068.837133][ T7220] [ 1068.837141][ T7220] dump_stack_lvl+0xe8/0x150 [ 1068.837173][ T7220] should_fail_ex+0x410/0x560 [ 1068.837204][ T7220] _copy_from_user+0x2d/0xb0 [ 1068.837222][ T7220] sock_do_ioctl+0x195/0x320 [ 1068.837249][ T7220] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1068.837270][ T7220] ? hook_file_ioctl+0x1f2/0x600 [ 1068.837301][ T7220] sock_ioctl+0x57a/0x7e0 [ 1068.837324][ T7220] ? __pfx_sock_ioctl+0x10/0x10 [ 1068.837346][ T7220] ? __fget_files+0x2a/0x420 [ 1068.837367][ T7220] ? __fget_files+0x3a2/0x420 [ 1068.837388][ T7220] ? __fget_files+0x2a/0x420 [ 1068.837412][ T7220] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1068.837439][ T7220] ? __pfx_sock_ioctl+0x10/0x10 [ 1068.837460][ T7220] __se_sys_ioctl+0xfc/0x170 [ 1068.837481][ T7220] do_syscall_64+0x166/0x520 [ 1068.837505][ T7220] ? trace_irq_disable+0x3b/0x140 [ 1068.837521][ T7220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.837539][ T7220] ? clear_bhb_loop+0x70/0xc0 [ 1068.837559][ T7220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1068.837575][ T7220] RIP: 0033:0x7f2e90f9e159 [ 1068.837592][ T7220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1068.837607][ T7220] RSP: 002b:00007f2e91f44028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1068.837625][ T7220] RAX: ffffffffffffffda RBX: 00007f2e91225fa0 RCX: 00007f2e90f9e159 [ 1068.837638][ T7220] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 1068.837650][ T7220] RBP: 00007f2e91f44090 R08: 0000000000000000 R09: 0000000000000000 [ 1068.837661][ T7220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1068.837673][ T7220] R13: 00007f2e91226038 R14: 00007f2e91225fa0 R15: 00007ffea9e3f358 [ 1068.837704][ T7220] [ 1068.952087][ T7226] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9451'. [ 1068.985973][ T7222] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1069.071222][ T7222] bond1 (unregistering): Released all slaves [ 1069.080287][ T7228] x_tables: unsorted entry at hook 2 [ 1069.088283][ T7232] netlink: 'syz.2.9453': attribute type 2 has an invalid length. [ 1069.419813][ T7248] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9459'. [ 1069.609361][ T7259] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9462'. [ 1069.726796][ T7176] bridge0: port 1(bridge_slave_0) entered blocking state [ 1069.734459][ T7176] bridge0: port 1(bridge_slave_0) entered disabled state [ 1069.734847][ T7176] bridge_slave_0: entered allmulticast mode [ 1069.758885][ T7176] bridge_slave_0: entered promiscuous mode [ 1069.785555][ T7267] bridge1: entered promiscuous mode [ 1069.791117][ T7267] bridge1: entered allmulticast mode [ 1069.801338][ T7267] team0: Port device bridge1 added [ 1069.808187][ T7176] bridge0: port 2(bridge_slave_1) entered blocking state [ 1069.808316][ T7176] bridge0: port 2(bridge_slave_1) entered disabled state [ 1069.808447][ T7176] bridge_slave_1: entered allmulticast mode [ 1069.835045][ T7176] bridge_slave_1: entered promiscuous mode [ 1069.893109][ T7176] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1069.910489][ T7176] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1070.002390][ T7176] team0: Port device team_slave_0 added [ 1070.018116][ T7176] team0: Port device team_slave_1 added [ 1070.059448][ T7176] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1070.059483][ T7176] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1070.059735][ T7176] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1070.061828][ T7176] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1070.061867][ T7176] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1070.061891][ T7176] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1070.065629][ T52] Bluetooth: hci4: command tx timeout [ 1070.122506][ T7176] hsr_slave_0: entered promiscuous mode [ 1070.123537][ T7176] hsr_slave_1: entered promiscuous mode [ 1070.129185][ T7176] debugfs: 'hsr0' already exists in 'hsr' [ 1070.129206][ T7176] Cannot create hsr debugfs directory [ 1070.285785][ T7276] Bluetooth: ISO socket layer initialized [ 1070.630892][ T7176] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1070.630954][ T7176] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1070.984666][ T7176] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1070.984718][ T7176] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.043988][ T7307] sctp: [Deprecated]: syz.1.9480 (pid 7307) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1071.043988][ T7307] Use struct sctp_sack_info instead [ 1071.150910][ T7176] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.150967][ T7176] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.178058][ T7315] netlink: 'syz.1.9481': attribute type 2 has an invalid length. [ 1071.246422][ T7176] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1071.246480][ T7176] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1071.249942][ T7318] netlink: 'syz.2.9482': attribute type 1 has an invalid length. [ 1071.526107][ T7176] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1071.536902][ T7176] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1071.539267][ T7176] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1071.551074][ T7176] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1071.551906][ T7176] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1071.574366][ T7176] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1071.581877][ T7176] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1071.592888][ T7176] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1071.689157][ T7176] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1071.712284][ T7176] 8021q: adding VLAN 0 to HW filter on device team0 [ 1071.740215][ T1423] bridge0: port 1(bridge_slave_0) entered blocking state [ 1071.740319][ T1423] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1071.748608][ T1423] bridge0: port 2(bridge_slave_1) entered blocking state [ 1071.748709][ T1423] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1071.930602][ T7340] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1072.016693][ T7340] bond1 (unregistering): Released all slaves [ 1072.152672][ T52] Bluetooth: hci4: command tx timeout [ 1072.231485][ T7352] syzkaller1: entered promiscuous mode [ 1072.231528][ T7352] syzkaller1: entered allmulticast mode [ 1072.276180][ T7352] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9489'. [ 1072.276234][ T7352] netlink: 32 bytes leftover after parsing attributes in process `syz.0.9489'. [ 1072.907550][ T7176] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1072.930790][ T7391] netlink: 1920 bytes leftover after parsing attributes in process `syz.1.9501'. [ 1072.940382][ T7391] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1072.948413][ T7391] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1072.956886][ T7391] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1072.956925][ T7391] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1073.162574][ T7408] netlink: 'syz.3.9507': attribute type 1 has an invalid length. [ 1073.255053][ T7408] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1073.281570][ T7415] vlan2: entered promiscuous mode [ 1073.286995][ T7415] bond1: entered promiscuous mode [ 1073.292416][ T7415] vlan2: entered allmulticast mode [ 1073.292434][ T7415] bond1: entered allmulticast mode [ 1073.322805][ T7417] netlink: 'syz.1.9510': attribute type 1 has an invalid length. [ 1073.370319][ T7417] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1073.458470][ T7417] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9510'. [ 1073.470146][ T7417] bond1: entered promiscuous mode [ 1073.476161][ T7417] bond1: entered allmulticast mode [ 1073.540816][ T7429] netlink: NAT flags may be given only when NAT range (SRC or DST) is also specified. [ 1073.554864][ T7429] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1073.602621][ T7176] veth0_vlan: entered promiscuous mode [ 1073.629231][ T7176] veth1_vlan: entered promiscuous mode [ 1073.658649][ T7431] sctp: [Deprecated]: syz.2.9514 (pid 7431) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1073.658649][ T7431] Use struct sctp_sack_info instead [ 1073.662753][ T7431] FAULT_INJECTION: forcing a failure. [ 1073.662753][ T7431] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1073.662782][ T7431] CPU: 0 UID: 0 PID: 7431 Comm: syz.2.9514 Not tainted syzkaller #0 PREEMPT(full) [ 1073.662802][ T7431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1073.662812][ T7431] Call Trace: [ 1073.662821][ T7431] [ 1073.662828][ T7431] dump_stack_lvl+0xe8/0x150 [ 1073.662860][ T7431] should_fail_ex+0x410/0x560 [ 1073.662892][ T7431] _copy_from_iter+0x1d3/0x1660 [ 1073.662921][ T7431] ? __alloc_skb+0x27a/0x7a0 [ 1073.662953][ T7431] ? __alloc_skb+0x27a/0x7a0 [ 1073.662980][ T7431] ? __alloc_skb+0x27a/0x7a0 [ 1073.663005][ T7431] ? __pfx__copy_from_iter+0x10/0x10 [ 1073.663030][ T7431] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1073.663056][ T7431] ? __alloc_skb+0x27a/0x7a0 [ 1073.663079][ T7431] ? __alloc_skb+0x27a/0x7a0 [ 1073.663116][ T7431] ? netlink_sendmsg+0x650/0xb40 [ 1073.663138][ T7431] ? skb_put+0x112/0x210 [ 1073.663158][ T7431] netlink_sendmsg+0x6c0/0xb40 [ 1073.663188][ T7431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1073.663217][ T7431] ? apparmor_socket_sendmsg+0x98/0x360 [ 1073.663247][ T7431] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1073.663268][ T7431] sock_sendmsg_nosec+0x13a/0x180 [ 1073.663294][ T7431] ____sys_sendmsg+0x54e/0x850 [ 1073.663318][ T7431] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1073.663345][ T7431] ? import_iovec+0x73/0xa0 [ 1073.663368][ T7431] ___sys_sendmsg+0x2a5/0x360 [ 1073.663386][ T7431] ? __lock_acquire+0x6df/0x2e50 [ 1073.663408][ T7431] ? __pfx____sys_sendmsg+0x10/0x10 [ 1073.663459][ T7431] ? __fget_files+0x2a/0x420 [ 1073.663482][ T7431] ? __fget_files+0x3a2/0x420 [ 1073.663513][ T7431] __x64_sys_sendmsg+0x1b1/0x290 [ 1073.663535][ T7431] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1073.663574][ T7431] do_syscall_64+0x166/0x520 [ 1073.663599][ T7431] ? trace_irq_disable+0x3b/0x140 [ 1073.663616][ T7431] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.663634][ T7431] ? clear_bhb_loop+0x70/0xc0 [ 1073.663657][ T7431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1073.663675][ T7431] RIP: 0033:0x7fe7e699e159 [ 1073.663692][ T7431] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1073.663707][ T7431] RSP: 002b:00007fe7e7798028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1073.663727][ T7431] RAX: ffffffffffffffda RBX: 00007fe7e6c25fa0 RCX: 00007fe7e699e159 [ 1073.663740][ T7431] RDX: 0000000000004080 RSI: 0000200000000300 RDI: 0000000000000007 [ 1073.663752][ T7431] RBP: 00007fe7e7798090 R08: 0000000000000000 R09: 0000000000000000 [ 1073.663764][ T7431] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1073.663775][ T7431] R13: 00007fe7e6c26038 R14: 00007fe7e6c25fa0 R15: 00007fff3e6a9958 [ 1073.663804][ T7431] [ 1073.796936][ T7176] veth0_macvtap: entered promiscuous mode [ 1073.822131][ T7176] veth1_macvtap: entered promiscuous mode [ 1073.914031][ T7176] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1073.941344][ T7176] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1074.075257][ T1421] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.075310][ T1421] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.075355][ T1421] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.075388][ T1421] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1074.171261][ T7437] lo speed is unknown, defaulting to 1000 [ 1074.226055][ T52] Bluetooth: hci4: command tx timeout [ 1074.257114][ T7437] lo speed is unknown, defaulting to 1000 [ 1074.408460][ T1423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1074.408501][ T1423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1074.569434][ T7458] syz_tun: entered promiscuous mode [ 1074.578081][ T1417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1074.578124][ T1417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1074.591786][ T7461] netlink: 164 bytes leftover after parsing attributes in process `syz.0.9523'. [ 1074.598748][ T7458] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9522'. [ 1074.598790][ T7458] syz_tun: left promiscuous mode [ 1074.647032][ T7461] block nbd0: reconnected socket [ 1074.656137][ T7461] block nbd0: reconnected socket [ 1074.656178][ T7461] nbd: socks must be embedded in a SOCK_ITEM attr [ 1074.672705][ T52] block nbd0: Receive control failed (result -32) [ 1074.675002][T31730] block nbd0: Receive control failed (result -32) [ 1074.714581][ T7467] netlink: 'syz.4.9435': attribute type 2 has an invalid length. [ 1074.726168][ T7464] syz_tun: entered promiscuous mode [ 1074.728862][ T7464] macvtap1: entered allmulticast mode [ 1074.728880][ T7464] syz_tun: entered allmulticast mode [ 1074.756130][ T7464] syz_tun: left allmulticast mode [ 1074.756181][ T7464] syz_tun: left promiscuous mode [ 1074.884658][ T7474] FAULT_INJECTION: forcing a failure. [ 1074.884658][ T7474] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1074.884712][ T7474] CPU: 0 UID: 0 PID: 7474 Comm: syz.0.9526 Not tainted syzkaller #0 PREEMPT(full) [ 1074.884731][ T7474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1074.884740][ T7474] Call Trace: [ 1074.884746][ T7474] [ 1074.884753][ T7474] dump_stack_lvl+0xe8/0x150 [ 1074.884782][ T7474] should_fail_ex+0x410/0x560 [ 1074.884813][ T7474] _copy_from_user+0x2d/0xb0 [ 1074.884835][ T7474] ___sys_sendmsg+0x1c6/0x360 [ 1074.884854][ T7474] ? __lock_acquire+0x6df/0x2e50 [ 1074.884878][ T7474] ? __pfx____sys_sendmsg+0x10/0x10 [ 1074.884926][ T7474] ? __fget_files+0x2a/0x420 [ 1074.884949][ T7474] ? __fget_files+0x3a2/0x420 [ 1074.884981][ T7474] __x64_sys_sendmsg+0x1b1/0x290 [ 1074.885003][ T7474] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1074.885052][ T7474] do_syscall_64+0x166/0x520 [ 1074.885077][ T7474] ? trace_irq_disable+0x3b/0x140 [ 1074.885095][ T7474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1074.885113][ T7474] ? clear_bhb_loop+0x70/0xc0 [ 1074.885135][ T7474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1074.885153][ T7474] RIP: 0033:0x7f2e90f9e159 [ 1074.885170][ T7474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1074.885186][ T7474] RSP: 002b:00007f2e91f44028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1074.885205][ T7474] RAX: ffffffffffffffda RBX: 00007f2e91225fa0 RCX: 00007f2e90f9e159 [ 1074.885219][ T7474] RDX: 0000000000040000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1074.885230][ T7474] RBP: 00007f2e91f44090 R08: 0000000000000000 R09: 0000000000000000 [ 1074.885242][ T7474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1074.885253][ T7474] R13: 00007f2e91226038 R14: 00007f2e91225fa0 R15: 00007ffea9e3f358 [ 1074.885282][ T7474] [ 1075.105923][ T7476] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9527'. [ 1075.478523][ T7498] veth1_macvtap: left promiscuous mode [ 1075.485634][ T7498] macsec0: entered allmulticast mode [ 1075.496714][ T7498] veth1_macvtap: entered promiscuous mode [ 1075.502542][ T7498] veth1_macvtap: entered allmulticast mode [ 1075.509007][ T7498] macsec0: left allmulticast mode [ 1075.514314][ T7498] veth1_macvtap: left allmulticast mode [ 1075.630119][ T7507] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9539'. [ 1075.650417][ T7502] mac80211_hwsim hwsim69 wlan0: entered promiscuous mode [ 1075.650468][ T7502] mac80211_hwsim hwsim69 wlan0: entered allmulticast mode [ 1075.734819][ T7512] FAULT_INJECTION: forcing a failure. [ 1075.734819][ T7512] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1075.750999][ T7512] CPU: 1 UID: 0 PID: 7512 Comm: syz.3.9540 Not tainted syzkaller #0 PREEMPT(full) [ 1075.751025][ T7512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1075.751037][ T7512] Call Trace: [ 1075.751045][ T7512] [ 1075.751054][ T7512] dump_stack_lvl+0xe8/0x150 [ 1075.751084][ T7512] should_fail_ex+0x410/0x560 [ 1075.751114][ T7512] _copy_from_user+0x2d/0xb0 [ 1075.751135][ T7512] __copy_msghdr+0x390/0x590 [ 1075.751161][ T7512] ___sys_sendmsg+0x213/0x360 [ 1075.751180][ T7512] ? __lock_acquire+0x6df/0x2e50 [ 1075.751201][ T7512] ? __pfx____sys_sendmsg+0x10/0x10 [ 1075.751252][ T7512] ? __fget_files+0x2a/0x420 [ 1075.751273][ T7512] ? __fget_files+0x3a2/0x420 [ 1075.751302][ T7512] __x64_sys_sendmsg+0x1b1/0x290 [ 1075.751322][ T7512] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1075.751357][ T7512] do_syscall_64+0x166/0x520 [ 1075.751380][ T7512] ? trace_irq_disable+0x3b/0x140 [ 1075.751397][ T7512] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.751416][ T7512] ? clear_bhb_loop+0x70/0xc0 [ 1075.751439][ T7512] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.751457][ T7512] RIP: 0033:0x7fe7d179e159 [ 1075.751473][ T7512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1075.751489][ T7512] RSP: 002b:00007fe7d26d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1075.751511][ T7512] RAX: ffffffffffffffda RBX: 00007fe7d1a25fa0 RCX: 00007fe7d179e159 [ 1075.751525][ T7512] RDX: 0000000000040000 RSI: 0000200000000080 RDI: 0000000000000003 [ 1075.751538][ T7512] RBP: 00007fe7d26d3090 R08: 0000000000000000 R09: 0000000000000000 [ 1075.751550][ T7512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1075.751560][ T7512] R13: 00007fe7d1a26038 R14: 00007fe7d1a25fa0 R15: 00007ffce31efe98 [ 1075.751590][ T7512] [ 1075.987269][ T7517] veth1_macvtap: left promiscuous mode [ 1075.992957][ T7517] macsec0: entered allmulticast mode [ 1076.003715][ T7517] veth1_macvtap: entered promiscuous mode [ 1076.011667][ T7517] veth1_macvtap: entered allmulticast mode [ 1076.017936][ T7517] macsec0: left allmulticast mode [ 1076.023078][ T7517] veth1_macvtap: left allmulticast mode [ 1076.076763][ T7521] netlink: 'syz.0.9544': attribute type 2 has an invalid length. [ 1076.304291][T31730] Bluetooth: hci4: command tx timeout [ 1076.314116][ T7535] netlink: 'syz.2.9546': attribute type 1 has an invalid length. [ 1076.331609][ T7533] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9547'. [ 1076.479490][ T7539] FAULT_INJECTION: forcing a failure. [ 1076.479490][ T7539] name failslab, interval 1, probability 0, space 0, times 0 [ 1076.479522][ T7539] CPU: 0 UID: 0 PID: 7539 Comm: syz.1.9548 Not tainted syzkaller #0 PREEMPT(full) [ 1076.479544][ T7539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1076.479555][ T7539] Call Trace: [ 1076.479562][ T7539] [ 1076.479568][ T7539] dump_stack_lvl+0xe8/0x150 [ 1076.479595][ T7539] should_fail_ex+0x410/0x560 [ 1076.479626][ T7539] should_failslab+0xa8/0x100 [ 1076.479649][ T7539] __kmalloc_node_track_caller_noprof+0xfb/0x720 [ 1076.479676][ T7539] ? __kasan_kmalloc+0x93/0xb0 [ 1076.479696][ T7539] ? __request_module+0x2ec/0x630 [ 1076.479715][ T7539] ? __request_module+0x2ec/0x630 [ 1076.479737][ T7539] ? __kmalloc_cache_noprof+0x14d/0x600 [ 1076.479767][ T7539] kstrdup+0x42/0x100 [ 1076.479787][ T7539] __request_module+0x2ec/0x630 [ 1076.479809][ T7539] ? __pfx___request_module+0x10/0x10 [ 1076.479828][ T7539] ? kasan_quarantine_put+0xbb/0x1f0 [ 1076.479858][ T7539] ? __pfx___request_module+0x10/0x10 [ 1076.479882][ T7539] ? apparmor_capable+0x126/0x170 [ 1076.479914][ T7539] ? dev_load+0x21/0x1f0 [ 1076.480030][ T7539] dev_ioctl+0x79f/0x1150 [ 1076.480060][ T7539] sock_do_ioctl+0x23e/0x320 [ 1076.480085][ T7539] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1076.480105][ T7539] ? hook_file_ioctl+0x1f2/0x600 [ 1076.480138][ T7539] sock_ioctl+0x57a/0x7e0 [ 1076.480162][ T7539] ? __pfx_sock_ioctl+0x10/0x10 [ 1076.480184][ T7539] ? __fget_files+0x2a/0x420 [ 1076.480206][ T7539] ? __fget_files+0x3a2/0x420 [ 1076.480228][ T7539] ? __fget_files+0x2a/0x420 [ 1076.480253][ T7539] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1076.480276][ T7539] ? __pfx_sock_ioctl+0x10/0x10 [ 1076.480297][ T7539] __se_sys_ioctl+0xfc/0x170 [ 1076.480318][ T7539] do_syscall_64+0x166/0x520 [ 1076.480344][ T7539] ? trace_irq_disable+0x3b/0x140 [ 1076.480368][ T7539] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.480386][ T7539] ? clear_bhb_loop+0x70/0xc0 [ 1076.480409][ T7539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1076.480427][ T7539] RIP: 0033:0x7f7c4799e159 [ 1076.480445][ T7539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1076.480461][ T7539] RSP: 002b:00007f7c48789028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1076.480480][ T7539] RAX: ffffffffffffffda RBX: 00007f7c47c25fa0 RCX: 00007f7c4799e159 [ 1076.480493][ T7539] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 1076.480506][ T7539] RBP: 00007f7c48789090 R08: 0000000000000000 R09: 0000000000000000 [ 1076.480517][ T7539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1076.480529][ T7539] R13: 00007f7c47c26038 R14: 00007f7c47c25fa0 R15: 00007ffe3b990758 [ 1076.480559][ T7539] [ 1076.972607][ T7555] syz_tun: entered promiscuous mode [ 1076.980976][ T7555] syz_tun: left promiscuous mode [ 1077.057848][ T7557] syz_tun: entered promiscuous mode [ 1077.063375][ T7557] macvtap1: entered allmulticast mode [ 1077.063416][ T7557] syz_tun: entered allmulticast mode [ 1077.070970][ T7557] syz_tun: left allmulticast mode [ 1077.070993][ T7557] syz_tun: left promiscuous mode [ 1077.163246][ T7559] FAULT_INJECTION: forcing a failure. [ 1077.163246][ T7559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1077.163279][ T7559] CPU: 1 UID: 0 PID: 7559 Comm: syz.0.9553 Not tainted syzkaller #0 PREEMPT(full) [ 1077.163300][ T7559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1077.163311][ T7559] Call Trace: [ 1077.163318][ T7559] [ 1077.163325][ T7559] dump_stack_lvl+0xe8/0x150 [ 1077.163352][ T7559] should_fail_ex+0x410/0x560 [ 1077.163382][ T7559] _copy_to_user+0x31/0xb0 [ 1077.163407][ T7559] simple_read_from_buffer+0xe1/0x170 [ 1077.163436][ T7559] proc_fail_nth_read+0x1bb/0x230 [ 1077.163461][ T7559] ? common_file_perm+0x20e/0x2b0 [ 1077.163482][ T7559] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1077.163512][ T7559] ? rw_verify_area+0x24a/0x4c0 [ 1077.163538][ T7559] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1077.163563][ T7559] vfs_read+0x213/0xa80 [ 1077.163593][ T7559] ? __pfx___mutex_lock+0x10/0x10 [ 1077.163621][ T7559] ? __pfx_vfs_read+0x10/0x10 [ 1077.163647][ T7559] ? __fget_files+0x2a/0x420 [ 1077.163673][ T7559] ? __fget_files+0x3a2/0x420 [ 1077.163695][ T7559] ? __fget_files+0x2a/0x420 [ 1077.163727][ T7559] ksys_read+0x150/0x270 [ 1077.163753][ T7559] ? __pfx_ksys_read+0x10/0x10 [ 1077.163789][ T7559] do_syscall_64+0x166/0x520 [ 1077.163814][ T7559] ? trace_irq_disable+0x3b/0x140 [ 1077.163831][ T7559] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.163850][ T7559] ? clear_bhb_loop+0x70/0xc0 [ 1077.163872][ T7559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.163890][ T7559] RIP: 0033:0x7f2e90f5e98e [ 1077.163910][ T7559] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1077.163933][ T7559] RSP: 002b:00007f2e91f43fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1077.163953][ T7559] RAX: ffffffffffffffda RBX: 00007f2e91f446c0 RCX: 00007f2e90f5e98e [ 1077.163966][ T7559] RDX: 000000000000000f RSI: 00007f2e91f440a0 RDI: 0000000000000004 [ 1077.163978][ T7559] RBP: 00007f2e91f44090 R08: 0000000000000000 R09: 0000000000000000 [ 1077.163990][ T7559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1077.164000][ T7559] R13: 00007f2e91226038 R14: 00007f2e91225fa0 R15: 00007ffea9e3f358 [ 1077.164031][ T7559] [ 1077.279079][ T7563] sctp: [Deprecated]: syz.0.9555 (pid 7563) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1077.279079][ T7563] Use struct sctp_sack_info instead [ 1077.336578][ T7564] FAULT_INJECTION: forcing a failure. [ 1077.336578][ T7564] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1077.336608][ T7564] CPU: 1 UID: 0 PID: 7564 Comm: syz.0.9555 Not tainted syzkaller #0 PREEMPT(full) [ 1077.336628][ T7564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1077.336639][ T7564] Call Trace: [ 1077.336646][ T7564] [ 1077.336654][ T7564] dump_stack_lvl+0xe8/0x150 [ 1077.336684][ T7564] should_fail_ex+0x410/0x560 [ 1077.336717][ T7564] _copy_to_user+0x31/0xb0 [ 1077.336740][ T7564] simple_read_from_buffer+0xe1/0x170 [ 1077.336770][ T7564] proc_fail_nth_read+0x1bb/0x230 [ 1077.336796][ T7564] ? common_file_perm+0x20e/0x2b0 [ 1077.336817][ T7564] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1077.336850][ T7564] ? rw_verify_area+0x24a/0x4c0 [ 1077.336877][ T7564] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1077.336909][ T7564] vfs_read+0x213/0xa80 [ 1077.336938][ T7564] ? __pfx___mutex_lock+0x10/0x10 [ 1077.336976][ T7564] ? __pfx_vfs_read+0x10/0x10 [ 1077.337003][ T7564] ? __fget_files+0x2a/0x420 [ 1077.337030][ T7564] ? __fget_files+0x3a2/0x420 [ 1077.337051][ T7564] ? __fget_files+0x2a/0x420 [ 1077.337082][ T7564] ksys_read+0x150/0x270 [ 1077.337110][ T7564] ? __pfx_ksys_read+0x10/0x10 [ 1077.337145][ T7564] do_syscall_64+0x166/0x520 [ 1077.337170][ T7564] ? trace_irq_disable+0x3b/0x140 [ 1077.337187][ T7564] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.337207][ T7564] ? clear_bhb_loop+0x70/0xc0 [ 1077.337229][ T7564] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1077.337247][ T7564] RIP: 0033:0x7f2e90f5e98e [ 1077.337264][ T7564] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1077.337280][ T7564] RSP: 002b:00007f2e91f22fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1077.337300][ T7564] RAX: ffffffffffffffda RBX: 00007f2e91f236c0 RCX: 00007f2e90f5e98e [ 1077.337314][ T7564] RDX: 000000000000000f RSI: 00007f2e91f230a0 RDI: 000000000000000a [ 1077.337326][ T7564] RBP: 00007f2e91f23090 R08: 0000000000000000 R09: 0000000000000000 [ 1077.337337][ T7564] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1077.337348][ T7564] R13: 00007f2e91226128 R14: 00007f2e91226090 R15: 00007ffea9e3f358 [ 1077.337379][ T7564] [ 1079.017513][ T7524] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1079.263087][ T7575] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9558'. [ 1079.263180][ T7575] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9558'. [ 1079.302053][ T7578] syz_tun: entered promiscuous mode [ 1079.320427][ T7578] syz_tun: left promiscuous mode [ 1079.373530][ T7584] netlink: 'syz.0.9563': attribute type 1 has an invalid length. [ 1079.382024][ T1429] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 1079.385404][ T7585] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9560'. [ 1079.485753][ T7588] gretap1: entered allmulticast mode [ 1079.522114][ T7588] bond2: (slave gretap1): making interface the new active one [ 1079.544543][ T7588] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1079.780543][ T7611] netlink: 'syz.0.9571': attribute type 8 has an invalid length. [ 1079.782241][ T7611] sctp: [Deprecated]: syz.0.9571 (pid 7611) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1079.782241][ T7611] Use struct sctp_sack_info instead [ 1079.836917][ T7613] veth1_macvtap: left promiscuous mode [ 1079.836961][ T7613] macsec0: entered allmulticast mode [ 1079.841221][ T7613] veth1_macvtap: entered promiscuous mode [ 1079.841241][ T7613] veth1_macvtap: entered allmulticast mode [ 1079.841544][ T7613] macsec0: left allmulticast mode [ 1079.841558][ T7613] veth1_macvtap: left allmulticast mode [ 1079.841844][ T7613] FAULT_INJECTION: forcing a failure. [ 1079.841844][ T7613] name failslab, interval 1, probability 0, space 0, times 0 [ 1079.841870][ T7613] CPU: 0 UID: 0 PID: 7613 Comm: syz.4.9572 Not tainted syzkaller #0 PREEMPT(full) [ 1079.841891][ T7613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1079.841902][ T7613] Call Trace: [ 1079.841909][ T7613] [ 1079.841917][ T7613] dump_stack_lvl+0xe8/0x150 [ 1079.841949][ T7613] should_fail_ex+0x410/0x560 [ 1079.841983][ T7613] ? __alloc_skb+0x1db/0x7a0 [ 1079.842009][ T7613] should_failslab+0xa8/0x100 [ 1079.842031][ T7613] ? __alloc_skb+0x1db/0x7a0 [ 1079.842055][ T7613] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 1079.842082][ T7613] ? __alloc_skb+0x18d/0x7a0 [ 1079.842107][ T7613] ? __alloc_skb+0x1db/0x7a0 [ 1079.842139][ T7613] __alloc_skb+0x1db/0x7a0 [ 1079.842175][ T7613] inet_ifmcaddr_notify+0x7e/0x150 [ 1079.842209][ T7613] ____ip_mc_inc_group+0xb6b/0xdb0 [ 1079.842242][ T7613] ip_mc_up+0x115/0x2e0 [ 1079.842269][ T7613] inetdev_event+0xe8a/0x1610 [ 1079.842289][ T7613] ? __pfx_ib_device_get_by_netdev+0x10/0x10 [ 1079.842435][ T7613] ? __pfx_inetdev_event+0x10/0x10 [ 1079.842453][ T7613] ? preempt_schedule_notrace+0x56/0x90 [ 1079.842489][ T7613] notifier_call_chain+0x1a5/0x3d0 [ 1079.842525][ T7613] __dev_notify_flags+0x31e/0x510 [ 1079.842543][ T7613] ? netif_set_allmulti+0x373/0x4d0 [ 1079.842566][ T7613] ? __pfx___dev_notify_flags+0x10/0x10 [ 1079.842583][ T7613] ? __dev_change_flags+0x64b/0x820 [ 1079.842607][ T7613] ? __pfx___dev_change_flags+0x10/0x10 [ 1079.842623][ T7613] ? dev_ioctl+0x7a4/0x1150 [ 1079.842650][ T7613] ? __pfx___mutex_lock+0x10/0x10 [ 1079.842672][ T7613] ? full_name_hash+0x92/0xe0 [ 1079.842699][ T7613] netif_change_flags+0xde/0x1b0 [ 1079.842720][ T7613] dev_change_flags+0x128/0x260 [ 1079.842750][ T7613] dev_ioctl+0x7b4/0x1150 [ 1079.842779][ T7613] sock_do_ioctl+0x23e/0x320 [ 1079.842805][ T7613] ? __pfx_sock_do_ioctl+0x10/0x10 [ 1079.842826][ T7613] ? hook_file_ioctl+0x1f2/0x600 [ 1079.842859][ T7613] sock_ioctl+0x57a/0x7e0 [ 1079.842884][ T7613] ? __pfx_sock_ioctl+0x10/0x10 [ 1079.842907][ T7613] ? __fget_files+0x2a/0x420 [ 1079.842928][ T7613] ? __fget_files+0x3a2/0x420 [ 1079.842949][ T7613] ? __fget_files+0x2a/0x420 [ 1079.842976][ T7613] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1079.843000][ T7613] ? __pfx_sock_ioctl+0x10/0x10 [ 1079.843022][ T7613] __se_sys_ioctl+0xfc/0x170 [ 1079.843042][ T7613] do_syscall_64+0x166/0x520 [ 1079.843066][ T7613] ? trace_irq_disable+0x3b/0x140 [ 1079.843081][ T7613] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1079.843100][ T7613] ? clear_bhb_loop+0x70/0xc0 [ 1079.843123][ T7613] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1079.843142][ T7613] RIP: 0033:0x7f558bb9e159 [ 1079.843158][ T7613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1079.843182][ T7613] RSP: 002b:00007f558c9df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1079.843201][ T7613] RAX: ffffffffffffffda RBX: 00007f558be25fa0 RCX: 00007f558bb9e159 [ 1079.843215][ T7613] RDX: 0000200000000240 RSI: 0000000000008914 RDI: 0000000000000003 [ 1079.843227][ T7613] RBP: 00007f558c9df090 R08: 0000000000000000 R09: 0000000000000000 [ 1079.843239][ T7613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1079.843249][ T7613] R13: 00007f558be26038 R14: 00007f558be25fa0 R15: 00007ffd0ea6d038 [ 1079.843280][ T7613] [ 1079.949629][ T7616] netlink: 44 bytes leftover after parsing attributes in process `syz.4.9573'. [ 1079.987584][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 1080.045900][ T7570] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1080.324737][ T7620] netlink: 48 bytes leftover after parsing attributes in process `syz.3.9578'. [ 1080.415793][ T7626] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9576'. [ 1080.417399][ T7625] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9575'. [ 1080.449459][ T7625] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9575'. [ 1080.484577][ T7630] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9581'. [ 1080.494097][ T7630] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9581'. [ 1080.563473][ T7634] syzkaller0: entered promiscuous mode [ 1080.569966][ T7634] syzkaller0: entered allmulticast mode [ 1080.619788][ T7632] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1080.699133][ T7649] sctp: [Deprecated]: syz.3.9585 (pid 7649) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1080.699133][ T7649] Use struct sctp_sack_info instead [ 1080.842748][ T7653] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1080.849729][ T7653] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9587'. [ 1080.855118][ T7653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1080.898001][ T7658] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9589'. [ 1081.045278][ T7653] netlink: 88 bytes leftover after parsing attributes in process `syz.2.9587'. [ 1081.050800][ T7653] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1081.458154][ T7680] bridge1: entered promiscuous mode [ 1081.463668][ T7680] bridge1: entered allmulticast mode [ 1081.481641][ T7680] team0: Port device bridge1 added [ 1081.535034][ T7689] sctp: [Deprecated]: syz.3.9600 (pid 7689) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1081.535034][ T7689] Use struct sctp_sack_info instead [ 1081.917899][ T7700] FAULT_INJECTION: forcing a failure. [ 1081.917899][ T7700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1081.917959][ T7700] CPU: 0 UID: 0 PID: 7700 Comm: syz.3.9605 Not tainted syzkaller #0 PREEMPT(full) [ 1081.917978][ T7700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1081.917988][ T7700] Call Trace: [ 1081.917994][ T7700] [ 1081.918000][ T7700] dump_stack_lvl+0xe8/0x150 [ 1081.918028][ T7700] should_fail_ex+0x410/0x560 [ 1081.918061][ T7700] _copy_from_iter+0x1d3/0x1660 [ 1081.918090][ T7700] ? __alloc_skb+0x27a/0x7a0 [ 1081.918118][ T7700] ? __alloc_skb+0x27a/0x7a0 [ 1081.918144][ T7700] ? __alloc_skb+0x27a/0x7a0 [ 1081.918169][ T7700] ? __pfx__copy_from_iter+0x10/0x10 [ 1081.918194][ T7700] ? kmem_cache_alloc_node_noprof+0x1f9/0x610 [ 1081.918219][ T7700] ? __alloc_skb+0x27a/0x7a0 [ 1081.918247][ T7700] ? __alloc_skb+0x27a/0x7a0 [ 1081.918278][ T7700] ? netlink_sendmsg+0x650/0xb40 [ 1081.918299][ T7700] ? skb_put+0x112/0x210 [ 1081.918318][ T7700] netlink_sendmsg+0x6c0/0xb40 [ 1081.918349][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1081.918378][ T7700] ? apparmor_socket_sendmsg+0x98/0x360 [ 1081.918408][ T7700] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1081.918429][ T7700] sock_sendmsg_nosec+0x13a/0x180 [ 1081.918456][ T7700] ____sys_sendmsg+0x54e/0x850 [ 1081.918480][ T7700] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1081.918508][ T7700] ? import_iovec+0x73/0xa0 [ 1081.918530][ T7700] ___sys_sendmsg+0x2a5/0x360 [ 1081.918548][ T7700] ? __lock_acquire+0x6df/0x2e50 [ 1081.918570][ T7700] ? __pfx____sys_sendmsg+0x10/0x10 [ 1081.918621][ T7700] ? __fget_files+0x2a/0x420 [ 1081.918643][ T7700] ? __fget_files+0x3a2/0x420 [ 1081.918675][ T7700] __x64_sys_sendmsg+0x1b1/0x290 [ 1081.918697][ T7700] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1081.918735][ T7700] do_syscall_64+0x166/0x520 [ 1081.918759][ T7700] ? trace_irq_disable+0x3b/0x140 [ 1081.918777][ T7700] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.918803][ T7700] ? clear_bhb_loop+0x70/0xc0 [ 1081.918824][ T7700] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1081.918843][ T7700] RIP: 0033:0x7fe7d179e159 [ 1081.918860][ T7700] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1081.918876][ T7700] RSP: 002b:00007fe7d26d3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1081.918895][ T7700] RAX: ffffffffffffffda RBX: 00007fe7d1a25fa0 RCX: 00007fe7d179e159 [ 1081.918908][ T7700] RDX: 0000000000040000 RSI: 0000200000000200 RDI: 0000000000000004 [ 1081.918920][ T7700] RBP: 00007fe7d26d3090 R08: 0000000000000000 R09: 0000000000000000 [ 1081.918932][ T7700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1081.918943][ T7700] R13: 00007fe7d1a26038 R14: 00007fe7d1a25fa0 R15: 00007ffce31efe98 [ 1081.918973][ T7700] [ 1082.258888][ T7704] bridge1: entered promiscuous mode [ 1082.258935][ T7704] bridge1: entered allmulticast mode [ 1082.291691][ T7704] team0: Port device bridge1 added [ 1082.455163][ T7708] bridge2: entered promiscuous mode [ 1082.455215][ T7708] bridge2: entered allmulticast mode [ 1082.480030][ T7708] team0: Port device bridge2 added [ 1082.519438][ T7713] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1082.519475][ T7713] IPv6: NLM_F_CREATE should be set when creating new route [ 1082.519535][ T7713] IPv6: NLM_F_CREATE should be set when creating new route [ 1082.662983][ T7709] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1082.837178][ T7709] bond1 (unregistering): Released all slaves [ 1083.342677][ T7729] macvtap1: entered allmulticast mode [ 1083.342719][ T7729] syz_tun: entered allmulticast mode [ 1083.358604][ T7729] syz_tun: left allmulticast mode [ 1083.872383][ T7740] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1083.918474][ T7740] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1084.038793][ T7745] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1084.499058][ T7768] netlink: 'syz.1.9628': attribute type 2 has an invalid length. [ 1085.311839][ T7802] netlink: 'syz.2.9638': attribute type 2 has an invalid length. [ 1085.491233][ T7814] veth1_macvtap: left promiscuous mode [ 1085.497626][ T7814] macsec0: entered allmulticast mode [ 1085.536819][ T7817] syz_tun: entered promiscuous mode [ 1085.537044][ T7817] macvtap0: entered allmulticast mode [ 1085.537059][ T7817] syz_tun: entered allmulticast mode [ 1085.549125][ T7811] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1085.563675][ T7817] syz_tun: left allmulticast mode [ 1085.563724][ T7817] syz_tun: left promiscuous mode [ 1085.572618][ T7811] __nla_validate_parse: 13 callbacks suppressed [ 1085.572635][ T7811] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9639'. [ 1085.626909][ T7814] veth1_macvtap: entered promiscuous mode [ 1085.626949][ T7814] veth1_macvtap: entered allmulticast mode [ 1085.627135][ T7814] macsec0: left allmulticast mode [ 1085.627148][ T7814] veth1_macvtap: left allmulticast mode [ 1085.705378][ T1417] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1085.705425][ T1417] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1085.740448][ T7826] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9644'. [ 1085.740808][ T7826] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9644'. [ 1085.863077][ T7826] bond1: entered allmulticast mode [ 1085.911957][ T7832] macvlan2: entered promiscuous mode [ 1085.912003][ T7832] macvlan2: entered allmulticast mode [ 1085.913886][ T7832] bond1: entered promiscuous mode [ 1085.915767][ T7832] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1085.950881][ T7832] bond1: left promiscuous mode [ 1085.967476][ T7838] nbd: nbd3 already in use [ 1086.017215][ T7838] netlink: 'syz.3.9646': attribute type 1 has an invalid length. [ 1086.049703][ T7847] xt_nfacct: accounting object `' does not exist [ 1086.056031][ T7827] macvlan2: entered promiscuous mode [ 1086.056052][ T7827] macvlan2: entered allmulticast mode [ 1086.058363][ T7827] bond1: entered promiscuous mode [ 1086.060664][ T7827] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1086.087172][ T7827] bond1: left promiscuous mode [ 1086.413185][ T7862] sctp: [Deprecated]: syz.3.9654 (pid 7862) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1086.413185][ T7862] Use struct sctp_sack_info instead [ 1086.421121][ T7865] veth1_macvtap: left promiscuous mode [ 1086.421144][ T7865] macsec0: entered allmulticast mode [ 1086.447538][ T7865] veth1_macvtap: entered promiscuous mode [ 1086.466306][ T7865] veth1_macvtap: entered allmulticast mode [ 1086.482505][ T7865] macsec0: left allmulticast mode [ 1086.487671][ T7865] veth1_macvtap: left allmulticast mode [ 1086.915495][ T7879] syzkaller0: entered promiscuous mode [ 1086.915541][ T7879] syzkaller0: entered allmulticast mode [ 1086.965597][ T7891] netlink: 'syz.2.9662': attribute type 83 has an invalid length. [ 1086.975743][ T7884] bridge3: entered promiscuous mode [ 1086.981750][ T7884] bridge3: entered allmulticast mode [ 1086.993693][ T7884] team0: Port device bridge3 added [ 1087.342265][ T7906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1087.364955][ T7906] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1087.703055][ T7924] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9671'. [ 1088.179715][ T7931] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9672'. [ 1088.179787][ T7931] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9672'. [ 1088.899045][ T1215] IPVS: starting estimator thread 0... [ 1089.010065][ T7942] IPVS: using max 31 ests per chain, 74400 per kthread [ 1090.690009][ T7910] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1090.821704][ T7947] bond3: ARP target 9.0.0.0 is already present [ 1090.821747][ T7947] bond3: option arp_ip_target: invalid value (9) [ 1090.823476][ T7947] bond3 (unregistering): Released all slaves [ 1091.016613][ T7961] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9679'. [ 1091.037945][ T7961] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1091.074187][ T7967] netlink: 4356 bytes leftover after parsing attributes in process `syz.0.9682'. [ 1091.083608][ T7967] netlink: 4356 bytes leftover after parsing attributes in process `syz.0.9682'. [ 1091.187036][ T7961] netlink: 88 bytes leftover after parsing attributes in process `syz.1.9679'. [ 1091.192627][ T7961] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1091.487384][ T7986] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9687'. [ 1091.744366][ T7993] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9689'. [ 1092.039686][ T8007] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9690'. [ 1092.227304][ T8013] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 1092.719405][ T8040] syz_tun: entered promiscuous mode [ 1092.727178][ T8040] macvtap1: entered allmulticast mode [ 1092.732719][ T8040] syz_tun: entered allmulticast mode [ 1092.749422][ T8040] syz_tun: left allmulticast mode [ 1092.749462][ T8040] syz_tun: left promiscuous mode [ 1092.834479][ T8046] netlink: 16 bytes leftover after parsing attributes in process `syz.1.9701'. [ 1092.842672][ T8046] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1092.855517][ T1417] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1092.855561][ T1417] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1092.855593][ T1417] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1092.855624][ T1417] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1092.958882][ T8050] netlink: 88 bytes leftover after parsing attributes in process `syz.1.9701'. [ 1092.971709][ T8050] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1093.172037][ T8059] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9704'. [ 1093.893404][ T8092] sctp: [Deprecated]: syz.4.9715 (pid 8092) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1093.893404][ T8092] Use struct sctp_sack_info instead [ 1093.950405][ T8097] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1093.964287][ T8097] netlink: 'syz.3.9719': attribute type 1 has an invalid length. [ 1094.358629][ T8111] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1094.363474][ T8111] bond3 (unregistering): Released all slaves [ 1094.973035][ T8143] block nbd0: reconnected socket [ 1094.980008][ T8143] block nbd0: reconnected socket [ 1094.980051][ T8143] nbd: socks must be embedded in a SOCK_ITEM attr [ 1094.994643][ T52] block nbd0: Receive control failed (result -32) [ 1095.001549][T31730] block nbd0: Receive control failed (result -32) [ 1095.033206][ T8147] netlink: 'syz.4.9731': attribute type 18 has an invalid length. [ 1095.344318][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1095.345134][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1095.705391][ T8177] netlink: 'syz.1.9737': attribute type 10 has an invalid length. [ 1095.816245][ T8171] bridge3: entered promiscuous mode [ 1095.816289][ T8171] bridge3: entered allmulticast mode [ 1095.831452][ T8171] team0: Port device bridge3 added [ 1095.939117][ T8177] team0 (unregistering): Port device team_slave_0 removed [ 1095.963606][ T8177] team0 (unregistering): Port device team_slave_1 removed [ 1095.965176][ T8173] netlink: 'syz.1.9737': attribute type 2 has an invalid length. [ 1096.154747][ T8202] __nla_validate_parse: 18 callbacks suppressed [ 1096.161201][ T8202] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9746'. [ 1096.214460][ T8207] netlink: 148 bytes leftover after parsing attributes in process `syz.0.9748'. [ 1096.273864][ T8211] netlink: 27 bytes leftover after parsing attributes in process `syz.1.9747'. [ 1096.339555][ T8220] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9749'. [ 1096.399339][ T8217] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9751'. [ 1096.401847][ T8218] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9751'. [ 1096.462813][ T8217] hsr_slave_1 (unregistering): left promiscuous mode [ 1096.479969][ T8226] netlink: 'syz.4.9752': attribute type 15 has an invalid length. [ 1096.750455][ T8245] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9760'. [ 1096.750521][ T8245] netlink: 'syz.3.9760': attribute type 10 has an invalid length. [ 1096.750537][ T8245] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9760'. [ 1097.019530][ T8259] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1097.197100][ T8270] netlink: 'syz.3.9770': attribute type 1 has an invalid length. [ 1097.197143][ T8270] netlink: 256 bytes leftover after parsing attributes in process `syz.3.9770'. [ 1097.255758][ T8273] netlink: 48 bytes leftover after parsing attributes in process `syz.2.9772'. [ 1097.271122][ T8273] FAULT_INJECTION: forcing a failure. [ 1097.271122][ T8273] name failslab, interval 1, probability 0, space 0, times 0 [ 1097.285185][ T8273] CPU: 0 UID: 0 PID: 8273 Comm: syz.2.9772 Not tainted syzkaller #0 PREEMPT(full) [ 1097.285208][ T8273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1097.285219][ T8273] Call Trace: [ 1097.285226][ T8273] [ 1097.285234][ T8273] dump_stack_lvl+0xe8/0x150 [ 1097.285263][ T8273] should_fail_ex+0x410/0x560 [ 1097.285295][ T8273] should_failslab+0xa8/0x100 [ 1097.285315][ T8273] ? skb_clone+0x212/0x3a0 [ 1097.285334][ T8273] kmem_cache_alloc_noprof+0xa1/0x600 [ 1097.285373][ T8273] ? skb_clone+0x212/0x3a0 [ 1097.285399][ T8273] skb_clone+0x212/0x3a0 [ 1097.285420][ T8273] __netlink_deliver_tap+0x413/0x860 [ 1097.285452][ T8273] ? netlink_deliver_tap+0x2e/0x1b0 [ 1097.285476][ T8273] netlink_deliver_tap+0x19c/0x1b0 [ 1097.285498][ T8273] __netlink_sendskb+0x47/0x90 [ 1097.285519][ T8273] netlink_dump+0xa8c/0xee0 [ 1097.285550][ T8273] ? __pfx_netlink_dump+0x10/0x10 [ 1097.285582][ T8273] ? netlink_recvmsg+0x5bf/0xa50 [ 1097.285602][ T8273] ? kmem_cache_free+0x182/0x650 [ 1097.285627][ T8273] netlink_recvmsg+0x683/0xa50 [ 1097.285657][ T8273] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1097.285683][ T8273] ? aa_sock_msg_perm+0x144/0x210 [ 1097.285708][ T8273] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1097.285728][ T8273] ? security_socket_recvmsg+0x7e/0x2c0 [ 1097.285751][ T8273] ? __pfx_netlink_recvmsg+0x10/0x10 [ 1097.285771][ T8273] sock_recvmsg+0x196/0x1e0 [ 1097.285799][ T8273] sock_read_iter+0x22a/0x2f0 [ 1097.285824][ T8273] ? __pfx_sock_read_iter+0x10/0x10 [ 1097.285864][ T8273] do_iter_readv_writev+0x612/0x8c0 [ 1097.285900][ T8273] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 1097.285931][ T8273] ? bpf_lsm_file_permission+0x9/0x20 [ 1097.285953][ T8273] ? security_file_permission+0x75/0x260 [ 1097.285981][ T8273] ? rw_verify_area+0x24a/0x4c0 [ 1097.286010][ T8273] vfs_readv+0x28d/0x850 [ 1097.286040][ T8273] ? __pfx_vfs_readv+0x10/0x10 [ 1097.286074][ T8273] ? __fget_files+0x2a/0x420 [ 1097.286102][ T8273] ? __fget_files+0x3a2/0x420 [ 1097.286124][ T8273] ? __fget_files+0x2a/0x420 [ 1097.286155][ T8273] do_readv+0x154/0x2e0 [ 1097.286177][ T8273] ? __pfx_do_readv+0x10/0x10 [ 1097.286205][ T8273] do_syscall_64+0x166/0x520 [ 1097.286229][ T8273] ? trace_irq_disable+0x3b/0x140 [ 1097.286246][ T8273] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.286262][ T8273] ? clear_bhb_loop+0x70/0xc0 [ 1097.286285][ T8273] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1097.286301][ T8273] RIP: 0033:0x7fe7e699e159 [ 1097.286318][ T8273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1097.286335][ T8273] RSP: 002b:00007fe7e7798028 EFLAGS: 00000246 ORIG_RAX: 0000000000000013 [ 1097.286354][ T8273] RAX: ffffffffffffffda RBX: 00007fe7e6c25fa0 RCX: 00007fe7e699e159 [ 1097.286378][ T8273] RDX: 0000000000000001 RSI: 00002000000005c0 RDI: 0000000000000003 [ 1097.286390][ T8273] RBP: 00007fe7e7798090 R08: 0000000000000000 R09: 0000000000000000 [ 1097.286401][ T8273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1097.286413][ T8273] R13: 00007fe7e6c26038 R14: 00007fe7e6c25fa0 R15: 00007fff3e6a9958 [ 1097.286445][ T8273] [ 1097.748568][ T8297] netlink: 'syz.4.9779': attribute type 4 has an invalid length. [ 1098.031306][ T8313] netlink: 'syz.2.9783': attribute type 1 has an invalid length. [ 1098.044822][ T8313] syz_tun: entered promiscuous mode [ 1098.053745][ T8313] netlink: 'syz.2.9783': attribute type 1 has an invalid length. [ 1098.135503][ T8316] syzkaller0: entered promiscuous mode [ 1098.135547][ T8316] syzkaller0: entered allmulticast mode [ 1098.163577][ T8312] nbd4: detected capacity change from 0 to 127 [ 1098.172341][T31730] block nbd4: Receive control failed (result -32) [ 1098.186086][ T4943] block nbd4: Dead connection, failed to find a fallback [ 1098.197253][ T4943] block nbd4: shutting down sockets [ 1098.197472][ T4943] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.197627][ T4943] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1098.228252][ T1999] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.228293][ T1999] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1098.228752][ T1999] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.228776][ T1999] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1098.230370][ T1999] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.230397][ T1999] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1098.230992][ T1999] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.231016][ T1999] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1098.231208][ T1999] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.231230][ T1999] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1098.232517][ T1999] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.232543][ T1999] Buffer I/O error on dev nbd4, logical block 2, async page read [ 1098.232637][ T1999] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.232672][ T1999] Buffer I/O error on dev nbd4, logical block 3, async page read [ 1098.232780][ T1999] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.232813][ T1999] Buffer I/O error on dev nbd4, logical block 0, async page read [ 1098.232920][ T1999] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1098.232942][ T1999] Buffer I/O error on dev nbd4, logical block 1, async page read [ 1098.241428][ T7959] ldm_validate_partition_table(): Disk read failed. [ 1098.248538][ T7959] Dev nbd4: unable to read RDB block 0 [ 1098.255531][ T7959] nbd4: unable to read partition table [ 1098.358401][ T8316] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1098.361985][ T8316] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 1098.411697][ T7959] ldm_validate_partition_table(): Disk read failed. [ 1098.423157][ T7959] Dev nbd4: unable to read RDB block 0 [ 1098.431606][ T7959] nbd4: unable to read partition table [ 1100.471186][ C0] ip6_tunnel: ip6gre6 xmit: Local address not yet configured! [ 1100.471510][ C0] ip6_tunnel: ip6gre4 xmit: Local address not yet configured! [ 1101.417507][ T8372] __nla_validate_parse: 7 callbacks suppressed [ 1101.425285][ T8372] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9802'. [ 1101.434478][ T8372] netlink: 'syz.3.9802': attribute type 10 has an invalid length. [ 1101.434509][ T8372] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9802'. [ 1101.562930][ T8386] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9807'. [ 1101.575000][ T8386] netlink: 'syz.0.9807': attribute type 10 has an invalid length. [ 1101.575031][ T8386] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9807'. [ 1101.600452][ T8386] geneve3: entered promiscuous mode [ 1101.605942][ T8386] geneve3: entered allmulticast mode [ 1101.621620][ T8388] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9807'. [ 1101.621673][ T8388] netlink: 'syz.0.9807': attribute type 10 has an invalid length. [ 1101.621688][ T8388] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9807'. [ 1101.705024][ T8388] geneve3: entered promiscuous mode [ 1101.705064][ T8388] geneve3: entered allmulticast mode [ 1101.845984][ T8398] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9813'. [ 1101.904258][ T8403] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9815'. [ 1101.947359][ T8407] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9814'. [ 1101.977628][ T8395] syzkaller0: entered promiscuous mode [ 1101.977676][ T8395] syzkaller0: entered allmulticast mode [ 1101.979023][ T8398] netlink: 40 bytes leftover after parsing attributes in process `syz.2.9813'. [ 1102.375227][ T8427] netlink: 'syz.2.9822': attribute type 1 has an invalid length. [ 1102.383325][ T8427] netlink: 'syz.2.9822': attribute type 1 has an invalid length. [ 1102.710745][ T8445] netlink: 'syz.4.9827': attribute type 1 has an invalid length. [ 1104.890617][ T8448] bond3 (unregistering): Released all slaves [ 1105.181139][ T8465] netlink: 'syz.4.9834': attribute type 10 has an invalid length. [ 1105.213565][ T8465] geneve2: entered promiscuous mode [ 1105.213613][ T8465] geneve2: entered allmulticast mode [ 1105.714109][ T8484] syzkaller0: entered promiscuous mode [ 1105.715325][ T8484] syzkaller0: entered allmulticast mode [ 1105.859869][ T8494] veth1_macvtap: entered promiscuous mode [ 1105.867741][ T8494] veth1_macvtap: entered allmulticast mode [ 1105.892332][ T8494] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1105.914121][ T8494] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1107.024554][ T8546] __nla_validate_parse: 59 callbacks suppressed [ 1107.031002][ T8546] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9853'. [ 1109.060432][ T8533] ªªªªªª: renamed from vlan0 (while UP) [ 1109.069778][ T8537] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9855'. [ 1109.083719][ T8546] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1109.091765][ T8547] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9856'. [ 1109.297670][ T8561] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9861'. [ 1109.297753][ T8561] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9861'. [ 1109.612006][ T8584] netlink: 'syz.0.9867': attribute type 2 has an invalid length. [ 1110.037889][ T8597] syzkaller0: entered promiscuous mode [ 1110.046227][ T8597] syzkaller0: entered allmulticast mode [ 1110.047254][ T8604] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1110.169020][ T8603] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1110.181237][ T8603] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1110.338867][ T8611] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9875'. [ 1110.348867][ T8611] netlink: 32 bytes leftover after parsing attributes in process `syz.3.9875'. [ 1110.459357][ T8613] netlink: 'syz.2.9876': attribute type 19 has an invalid length. [ 1110.459401][ T8613] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9876'. [ 1110.570393][ T30] audit: type=1804 audit(1789074966.453:15): pid=8618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.9876" name="/newroot/234/cgroup.controllers" dev="tmpfs" ino=1210 res=1 errno=0 [ 1110.570485][ T30] audit: type=1800 audit(1789074966.453:16): pid=8618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.9876" name="cgroup.controllers" dev="tmpfs" ino=1210 res=0 errno=0 [ 1110.575459][ T30] audit: type=1800 audit(1789074966.453:17): pid=8618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.9876" name="cgroup.controllers" dev="tmpfs" ino=1210 res=0 errno=0 [ 1110.705496][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 1110.705872][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 1113.796014][ T8657] sctp: [Deprecated]: syz.0.9889 (pid 8657) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1113.796014][ T8657] Use struct sctp_sack_info instead [ 1113.933223][ T8664] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9890'. [ 1114.310740][ T8671] bond3: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1114.323336][ T8671] bond3 (unregistering): Released all slaves [ 1114.499557][ T8677] syzkaller0: entered promiscuous mode [ 1114.499604][ T8677] syzkaller0: entered allmulticast mode [ 1114.563328][ T8684] veth1_macvtap: left promiscuous mode [ 1114.570747][ T8684] macsec0: entered allmulticast mode [ 1114.590747][ T8686] veth1_macvtap: entered promiscuous mode [ 1114.590791][ T8686] veth1_macvtap: entered allmulticast mode [ 1114.590872][ T8686] macsec0: left allmulticast mode [ 1114.590885][ T8686] veth1_macvtap: left allmulticast mode [ 1115.039352][ T8698] ksmbd: Unknown IPC event: 1, ignore. [ 1115.237097][ T8702] block nbd0: reconnected socket [ 1115.237211][ T8702] block nbd0: reconnected socket [ 1115.237222][ T8702] nbd: socks must be embedded in a SOCK_ITEM attr [ 1115.945463][ T52] block nbd0: Receive control failed (result -32) [ 1115.952013][T31730] block nbd0: Receive control failed (result -32) [ 1117.196806][ T8700] C: renamed from veth1_to_team (while UP) [ 1117.208653][ T8700] netlink: 164 bytes leftover after parsing attributes in process `syz.1.9902'. [ 1117.570140][ T8721] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9909'. [ 1117.904216][ T52] Bluetooth: hci1: command 0x0406 tx timeout [ 1117.955838][T21559] [ 1117.958208][T21559] ====================================================== [ 1117.965224][T21559] WARNING: possible circular locking dependency detected [ 1117.972252][T21559] syzkaller #0 Not tainted [ 1117.976666][T21559] ------------------------------------------------------ [ 1117.983682][T21559] kworker/u9:3/21559 is trying to acquire lock: [ 1117.989925][T21559] ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 [ 1118.000215][T21559] [ 1118.000215][T21559] but task is already holding lock: [ 1118.007579][T21559] ffff88801c2d4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 1118.018470][T21559] [ 1118.018470][T21559] which lock already depends on the new lock. [ 1118.018470][T21559] [ 1118.028916][T21559] [ 1118.028916][T21559] the existing dependency chain (in reverse order) is: [ 1118.037934][T21559] [ 1118.037934][T21559] -> #10 (&root->kernfs_supers_rwsem){++++}-{4:4}: [ 1118.046641][T21559] down_read+0x4a/0x330 [ 1118.051332][T21559] kernfs_remove_by_name_ns+0x3f/0x140 [ 1118.057322][T21559] internal_create_group+0x58e/0x1180 [ 1118.063235][T21559] sysfs_update_groups+0x60/0x130 [ 1118.068796][T21559] pmu_dev_alloc+0x29b/0x300 [ 1118.073907][T21559] perf_event_sysfs_init+0x76/0x100 [ 1118.079749][T21559] do_one_initcall+0x250/0x870 [ 1118.085033][T21559] do_initcall_level+0x10a/0x1a0 [ 1118.090566][T21559] do_initcalls+0x59/0xa0 [ 1118.095408][T21559] kernel_init_freeable+0x29d/0x3e0 [ 1118.101119][T21559] kernel_init+0x22/0x1d0 [ 1118.105981][T21559] ret_from_fork+0x514/0xb70 [ 1118.111077][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.116351][T21559] [ 1118.116351][T21559] -> #9 (pmus_lock){+.+.}-{4:4}: [ 1118.123466][T21559] __mutex_lock+0x19d/0x1550 [ 1118.128567][T21559] perf_event_init_cpu+0x1d1/0x7a0 [ 1118.134190][T21559] cpuhp_invoke_callback+0x434/0x810 [ 1118.139987][T21559] cpuhp_thread_fun+0x362/0x780 [ 1118.145347][T21559] smpboot_thread_fn+0x565/0xa70 [ 1118.150799][T21559] kthread+0x38b/0x480 [ 1118.155381][T21559] ret_from_fork+0x514/0xb70 [ 1118.160478][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.165750][T21559] [ 1118.165750][T21559] -> #8 (cpuhp_state-up){+.+.}-{0:0}: [ 1118.173293][T21559] cpuhp_thread_fun+0x127/0x780 [ 1118.178654][T21559] smpboot_thread_fn+0x565/0xa70 [ 1118.184106][T21559] kthread+0x38b/0x480 [ 1118.188678][T21559] ret_from_fork+0x514/0xb70 [ 1118.193771][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.199045][T21559] [ 1118.199045][T21559] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 1118.206756][T21559] cpus_read_lock+0x42/0x160 [ 1118.211852][T21559] static_key_slow_inc+0x12/0x30 [ 1118.217321][T21559] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 1118.223645][T21559] nbd_genl_foreach_sock+0x265/0x450 [ 1118.229472][T21559] nbd_genl_reconfigure+0xbbb/0x1040 [ 1118.235268][T21559] genl_family_rcv_msg_doit+0x233/0x340 [ 1118.241325][T21559] genl_rcv_msg+0x614/0x7a0 [ 1118.246338][T21559] netlink_rcv_skb+0x226/0x4a0 [ 1118.251612][T21559] genl_rcv+0x28/0x40 [ 1118.256105][T21559] netlink_unicast+0x7bd/0x940 [ 1118.261373][T21559] netlink_sendmsg+0x813/0xb40 [ 1118.266643][T21559] sock_sendmsg_nosec+0x13a/0x180 [ 1118.272175][T21559] ____sys_sendmsg+0x54e/0x850 [ 1118.277447][T21559] ___sys_sendmsg+0x2a5/0x360 [ 1118.282629][T21559] __x64_sys_sendmsg+0x1b1/0x290 [ 1118.288069][T21559] do_syscall_64+0x166/0x520 [ 1118.293170][T21559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.299570][T21559] [ 1118.299570][T21559] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 1118.307197][T21559] __mutex_lock+0x19d/0x1550 [ 1118.312297][T21559] nbd_queue_rq+0x373/0xff0 [ 1118.317311][T21559] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1118.323476][T21559] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1118.330339][T21559] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1118.336840][T21559] blk_mq_run_work_fn+0x16c/0x300 [ 1118.342378][T21559] process_scheduled_works+0xc3d/0x1630 [ 1118.348434][T21559] worker_thread+0xa47/0xfb0 [ 1118.353535][T21559] kthread+0x38b/0x480 [ 1118.358104][T21559] ret_from_fork+0x514/0xb70 [ 1118.363198][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.368476][T21559] [ 1118.368476][T21559] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 1118.375671][T21559] __mutex_lock+0x19d/0x1550 [ 1118.380773][T21559] nbd_queue_rq+0xc1/0xff0 [ 1118.385698][T21559] blk_mq_dispatch_rq_list+0x499/0x1990 [ 1118.391759][T21559] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 1118.398589][T21559] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1118.405074][T21559] blk_mq_run_work_fn+0x16c/0x300 [ 1118.410605][T21559] process_scheduled_works+0xc3d/0x1630 [ 1118.416657][T21559] worker_thread+0xa47/0xfb0 [ 1118.421756][T21559] kthread+0x38b/0x480 [ 1118.426329][T21559] ret_from_fork+0x514/0xb70 [ 1118.431426][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.436702][T21559] [ 1118.436702][T21559] -> #4 (set->srcu){.+.+}-{0:0}: [ 1118.443810][T21559] __synchronize_srcu+0xc9/0x2f0 [ 1118.449251][T21559] elevator_switch+0x1e8/0x7b0 [ 1118.454625][T21559] elevator_change+0x2fa/0x480 [ 1118.459898][T21559] elevator_set_default+0x375/0x440 [ 1118.465614][T21559] blk_register_queue+0x3f3/0x4e0 [ 1118.471212][T21559] __add_disk+0x6cb/0xe30 [ 1118.476046][T21559] add_disk_fwnode+0x100/0x3a0 [ 1118.481316][T21559] nbd_dev_add+0x733/0xb60 [ 1118.486248][T21559] nbd_init+0x168/0x1f0 [ 1118.490998][T21559] do_one_initcall+0x250/0x870 [ 1118.496274][T21559] do_initcall_level+0x10a/0x1a0 [ 1118.501716][T21559] do_initcalls+0x59/0xa0 [ 1118.506550][T21559] kernel_init_freeable+0x29d/0x3e0 [ 1118.512251][T21559] kernel_init+0x22/0x1d0 [ 1118.517086][T21559] ret_from_fork+0x514/0xb70 [ 1118.522177][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.527471][T21559] [ 1118.527471][T21559] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 1118.535274][T21559] __mutex_lock+0x19d/0x1550 [ 1118.540378][T21559] elevator_change+0x1af/0x480 [ 1118.545652][T21559] elevator_set_none+0xb5/0x140 [ 1118.551013][T21559] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 1118.557324][T21559] nbd_start_device+0x189/0xb30 [ 1118.562691][T21559] nbd_genl_connect+0x167d/0x1cd0 [ 1118.568226][T21559] genl_family_rcv_msg_doit+0x233/0x340 [ 1118.574282][T21559] genl_rcv_msg+0x614/0x7a0 [ 1118.579297][T21559] netlink_rcv_skb+0x226/0x4a0 [ 1118.584566][T21559] genl_rcv+0x28/0x40 [ 1118.589056][T21559] netlink_unicast+0x7bd/0x940 [ 1118.594321][T21559] netlink_sendmsg+0x813/0xb40 [ 1118.599595][T21559] sock_sendmsg_nosec+0x13a/0x180 [ 1118.605136][T21559] ____sys_sendmsg+0x54e/0x850 [ 1118.610422][T21559] ___sys_sendmsg+0x2a5/0x360 [ 1118.615617][T21559] __x64_sys_sendmsg+0x1b1/0x290 [ 1118.621074][T21559] do_syscall_64+0x166/0x520 [ 1118.626186][T21559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.632588][T21559] [ 1118.632588][T21559] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 1118.641179][T21559] blk_alloc_queue+0x544/0x690 [ 1118.646457][T21559] __blk_mq_alloc_disk+0x194/0x390 [ 1118.652073][T21559] nbd_dev_add+0x494/0xb60 [ 1118.657000][T21559] nbd_init+0x168/0x1f0 [ 1118.661668][T21559] do_one_initcall+0x250/0x870 [ 1118.666982][T21559] do_initcall_level+0x10a/0x1a0 [ 1118.672431][T21559] do_initcalls+0x59/0xa0 [ 1118.677265][T21559] kernel_init_freeable+0x29d/0x3e0 [ 1118.682975][T21559] kernel_init+0x22/0x1d0 [ 1118.687811][T21559] ret_from_fork+0x514/0xb70 [ 1118.692908][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.698191][T21559] [ 1118.698191][T21559] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1118.705400][T21559] fs_reclaim_acquire+0x71/0x100 [ 1118.710868][T21559] kmem_cache_alloc_lru_noprof+0x65/0x5f0 [ 1118.717111][T21559] alloc_inode+0xb8/0x1b0 [ 1118.721951][T21559] iget_locked+0x131/0x6a0 [ 1118.726876][T21559] kernfs_get_inode+0x4f/0x770 [ 1118.732154][T21559] kernfs_get_tree+0x5cd/0x980 [ 1118.737432][T21559] vfs_get_tree+0x92/0x2a0 [ 1118.742379][T21559] do_new_mount+0x319/0xdc0 [ 1118.747402][T21559] __se_sys_mount+0x31d/0x420 [ 1118.752604][T21559] do_syscall_64+0x166/0x520 [ 1118.757715][T21559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1118.764134][T21559] [ 1118.764134][T21559] -> #0 (&root->kernfs_rwsem){++++}-{4:4}: [ 1118.772137][T21559] __lock_acquire+0x15ff/0x2e50 [ 1118.777503][T21559] lock_acquire+0x115/0x350 [ 1118.782513][T21559] down_write+0x96/0x200 [ 1118.787263][T21559] kernfs_remove_by_name_ns+0x4e/0x140 [ 1118.793232][T21559] sysfs_unmerge_group+0xd3/0x140 [ 1118.798774][T21559] dpm_sysfs_remove+0x5f/0xd0 [ 1118.804044][T21559] device_del+0x250/0x8f0 [ 1118.808888][T21559] device_unregister+0x21/0xf0 [ 1118.814163][T21559] hci_conn_del+0xc3d/0x1200 [ 1118.819351][T21559] hci_abort_conn_sync+0xdd0/0x1190 [ 1118.825094][T21559] hci_cmd_sync_work+0x20b/0x3f0 [ 1118.830580][T21559] process_scheduled_works+0xc3d/0x1630 [ 1118.836652][T21559] worker_thread+0xa47/0xfb0 [ 1118.841766][T21559] kthread+0x38b/0x480 [ 1118.846351][T21559] ret_from_fork+0x514/0xb70 [ 1118.851452][T21559] ret_from_fork_asm+0x1a/0x30 [ 1118.856732][T21559] [ 1118.856732][T21559] other info that might help us debug this: [ 1118.856732][T21559] [ 1118.866954][T21559] Chain exists of: [ 1118.866954][T21559] &root->kernfs_rwsem --> pmus_lock --> &root->kernfs_supers_rwsem [ 1118.866954][T21559] [ 1118.880770][T21559] Possible unsafe locking scenario: [ 1118.880770][T21559] [ 1118.888230][T21559] CPU0 CPU1 [ 1118.893601][T21559] ---- ---- [ 1118.898970][T21559] rlock(&root->kernfs_supers_rwsem); [ 1118.904431][T21559] lock(pmus_lock); [ 1118.910926][T21559] lock(&root->kernfs_supers_rwsem); [ 1118.918825][T21559] lock(&root->kernfs_rwsem); [ 1118.923589][T21559] [ 1118.923589][T21559] *** DEADLOCK *** [ 1118.923589][T21559] [ 1118.931806][T21559] locks held by kworker/u9:3/21559: 5, last CPU#0: [ 1118.938292][T21559] #0: ffff88802b123140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1118.949081][T21559] #1: ffffc9000322fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 1118.961595][T21559] #2: ffff88809fdc8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 [ 1118.971422][T21559] #3: ffff88809fdc80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 1118.981160][T21559] #4: ffff88801c2d4aa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 [ 1118.992463][T21559] [ 1118.992463][T21559] stack backtrace: [ 1118.998344][T21559] CPU: 0 UID: 0 PID: 21559 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 1119.007877][T21559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1119.017924][T21559] Workqueue: hci1 hci_cmd_sync_work [ 1119.023125][T21559] Call Trace: [ 1119.026394][T21559] [ 1119.029318][T21559] dump_stack_lvl+0xe8/0x150 [ 1119.033908][T21559] print_circular_bug+0x2e2/0x300 [ 1119.038935][T21559] check_noncircular+0x12f/0x150 [ 1119.043869][T21559] __lock_acquire+0x15ff/0x2e50 [ 1119.048729][T21559] ? lockdep_unlock+0x5c/0xd0 [ 1119.053409][T21559] lock_acquire+0x115/0x350 [ 1119.057901][T21559] ? kernfs_remove_by_name_ns+0x4e/0x140 [ 1119.063530][T21559] down_write+0x96/0x200 [ 1119.067767][T21559] ? kernfs_remove_by_name_ns+0x4e/0x140 [ 1119.073394][T21559] ? __pfx_down_write+0x10/0x10 [ 1119.078242][T21559] kernfs_remove_by_name_ns+0x4e/0x140 [ 1119.083695][T21559] sysfs_unmerge_group+0xd3/0x140 [ 1119.088716][T21559] dpm_sysfs_remove+0x5f/0xd0 [ 1119.093384][T21559] device_del+0x250/0x8f0 [ 1119.097708][T21559] ? klist_iter_exit+0xc1/0x100 [ 1119.102551][T21559] ? __pfx_device_del+0x10/0x10 [ 1119.107399][T21559] device_unregister+0x21/0xf0 [ 1119.112158][T21559] hci_conn_del+0xc3d/0x1200 [ 1119.116751][T21559] ? hci_abort_conn_sync+0xa7b/0x1190 [ 1119.122115][T21559] hci_abort_conn_sync+0xdd0/0x1190 [ 1119.127305][T21559] ? __pfx_hci_abort_conn_sync+0x10/0x10 [ 1119.132929][T21559] ? abort_conn_sync+0x26/0x210 [ 1119.137772][T21559] ? abort_conn_sync+0x26/0x210 [ 1119.142624][T21559] ? abort_conn_sync+0x19c/0x210 [ 1119.147550][T21559] ? __pfx_abort_conn_sync+0x10/0x10 [ 1119.152824][T21559] hci_cmd_sync_work+0x20b/0x3f0 [ 1119.157762][T21559] ? process_scheduled_works+0x97a/0x1630 [ 1119.163475][T21559] process_scheduled_works+0xc3d/0x1630 [ 1119.169021][T21559] ? __pfx_process_scheduled_works+0x10/0x10 [ 1119.174998][T21559] ? assign_work+0x3cf/0x5d0 [ 1119.179583][T21559] worker_thread+0xa47/0xfb0 [ 1119.184176][T21559] ? __kthread_parkme+0x71/0x1f0 [ 1119.189115][T21559] kthread+0x38b/0x480 [ 1119.193172][T21559] ? __pfx_worker_thread+0x10/0x10 [ 1119.198279][T21559] ? __pfx_kthread+0x10/0x10 [ 1119.202857][T21559] ret_from_fork+0x514/0xb70 [ 1119.207434][T21559] ? __pfx_ret_from_fork+0x10/0x10 [ 1119.212541][T21559] ? __switch_to+0xc89/0x1420 [ 1119.217213][T21559] ? __pfx_kthread+0x10/0x10 [ 1119.221792][T21559] ret_from_fork_asm+0x1a/0x30 [ 1119.226560][T21559] [ 1119.372424][ T8733] syzkaller0: entered promiscuous mode [ 1119.379167][ T8733] syzkaller0: entered allmulticast mode [ 1120.944597][ C0] ip6_tunnel: ip6gre3 xmit: Local address not yet configured! [ 1120.944938][ C0] ip6_tunnel: ip6gre5 xmit: Local address not yet configured! [ 1120.945129][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured!