last executing test programs: 14.044913775s ago: executing program 1 (id=3135): r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000600)=ANY=[@ANYBLOB="600000001200050926bd7000fedbdf2521094b004e224e26fcffffff23090000000000000600000001040000040000000300000002000000", @ANYRES32=0x0, @ANYBLOB="000001000520000031000000040000001400010007141400029c"], 0x60}, 0x1, 0x0, 0x0, 0x2000010}, 0x20000000) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0x8, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r2, &(0x7f00000006c0)=[{&(0x7f0000000440)="2e9b3d0007e03dd65193dfb6c575963f88a8", 0x12}, {&(0x7f0000000100)="31020002", 0x4}, {&(0x7f0000000a80)='h?', 0x2}], 0x3) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000fc0)=ANY=[@ANYBLOB="1900000004000000080000000800000000000000", @ANYRES32, @ANYBLOB="00010000000000000200000000000000000000008bd927835e03862a57d7fb37bf00a75f04e09a398bc55c74f23805a03da5ae686b700ce0cc434fb2e3f3ff81c0ed6e7967b3428eeb9b7687304b7c4f71f548c0722dec7ea39834ea3f9e3a1b1f440f1d7861e237d2254c4a4afd28cc3040522ed68fc262bfa99deb7d432fb97e2c167c23b73e91292636ed808d5e003b619de7075e0ec26acc561cb6e3c896387903b73b78fde6acc6b081b2b776a5a80c56cd76b23f2d191906f1b3dc96136f45813d8b69aa37a9f917237e8f4003", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000006000000000000000100008018150000", @ANYRESHEX=r4, @ANYRES8=r3], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x94) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001100)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB="f981ff8f9441979b0000000000000000000000002909537b648b4e6de8cc214d487c70a791ed62551009fa839324c0c678ec6b9923a0a60e01639c235f63a394a61dd9606aec5820f7780fe1fdd1d16889bb", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000040000000300"/28], 0x50) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x6, 0x31, &(0x7f0000000700)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3}, {}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xffffffa6}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x7}}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xeec}}, @exit, @map_val={0x18, 0xb, 0x2, 0x0, 0x1}, @call={0x85, 0x0, 0x0, 0x1a}, @map_idx_val={0x18, 0x3, 0x6, 0x0, 0xd, 0x0, 0x0, 0x0, 0xa46b}, @map_fd={0x18, 0xa, 0x1, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000008c0)='GPL\x00', 0x8, 0xd1, &(0x7f0000000900)=""/209, 0x100, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a00)={0x2, 0xa, 0x9, 0x6}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000a40)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000ac0)=[{0x1, 0x5, 0x8, 0x8}, {0x5, 0x2, 0xf, 0x4}, {0x4, 0x5, 0x0, 0xb}, {0x3, 0x3, 0xa, 0x5}], 0x10, 0x6}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r7}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f00000011c0)=ANY=[@ANYBLOB="180000000372d603371e6f02fc40000018110000042ad89490de3b60382850f4f83a594f45c5190d0b958ff5a0c02ab0021e89", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000500000085000000060000009500000000000000"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000c00)=@generic={&(0x7f0000000bc0)='./file0\x00', 0x0, 0x8}, 0x18) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000c40)={0x0, 0x9, 0x8}, 0xc) r10 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000cc0)=@generic={&(0x7f0000000c80)='./file0\x00', 0x0, 0x10}, 0x18) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000d00)={0x1b, 0x0, 0x0, 0x6, 0x0, 0x1, 0x7fff, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x50) r12 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000dc0)=@o_path={&(0x7f0000000d80)='./file0\x00', 0x0, 0x8, r3}, 0x18) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) r14 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r13, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x15, 0xf, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r14}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0xd1}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8, 0x9, 0x20}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r15 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) write$cgroup_int(r15, &(0x7f0000000200), 0x12) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r15, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000f00)=@bpf_tracing={0x1a, 0xb, &(0x7f0000000240)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x10}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @ldst={0x0, 0x3, 0x2, 0x9, 0x0, 0xffffffffffffffff}, @map_val={0x18, 0x5, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f00000002c0)='GPL\x00', 0xffffffff, 0x34, &(0x7f00000003c0)=""/52, 0x40f00, 0x59, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000400)={0x2, 0xd, 0x8001, 0x9}, 0x10, 0xd984, r6, 0x9, &(0x7f0000000e00)=[r7, 0xffffffffffffffff, r8, r9, r10, r11, r12, r15, 0xffffffffffffffff, 0x1], &(0x7f0000000e40)=[{0x2, 0x4, 0x7, 0x7}, {0x4, 0x5, 0xd, 0x6}, {0x1, 0x5, 0x5, 0x7}, {0x5, 0x2, 0x8, 0x5}, {0x4, 0x1, 0x2, 0x6}, {0x0, 0x5, 0xf, 0xc}, {0x0, 0x3, 0xf}, {0x2, 0x2, 0x0, 0x5}, {0x5, 0x5, 0x9, 0x1}], 0x10, 0x1}, 0x94) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002c00128009000100626f6e64000000001c00028005002100010400080500010004"], 0x4c}}, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000140)={0x0, r3, 0x3, 0x40, 0xe, 0x2181}) 13.28004017s ago: executing program 1 (id=3136): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r0, 0x6, 0x21, 0x0, 0x0) shutdown(r0, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) recvmsg$qrtr(r1, &(0x7f0000000980)={&(0x7f0000000080), 0xc, &(0x7f00000005c0)=[{&(0x7f0000000340)=""/160, 0xa0}, {&(0x7f0000000400)=""/5, 0x5}, {0x0}, {&(0x7f00000004c0)=""/18, 0x12}, {0x0}], 0x5, &(0x7f0000000700)=[{0xf8, 0x0, 0x0, ""/228}, {0x80, 0x0, 0x0, ""/107}, {0xc8, 0x0, 0x0, ""/181}, {0x30, 0x0, 0x0, ""/29}], 0x270, 0x2000}, 0x38, 0x0) ioctl$TUNSETNOCSUM(0xffffffffffffffff, 0x400454c8, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, 0x0, 0x0, 0x44080, &(0x7f0000000180)={0x11, 0x1, r4, 0x1, 0x6}, 0x14) 13.157765349s ago: executing program 1 (id=3138): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) recvmmsg(0xffffffffffffffff, &(0x7f0000004e00)=[{{0x0, 0x0, 0x0}, 0x8}, {{&(0x7f00000025c0)=@l2tp6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000002840)=[{0x0}], 0x1}, 0xffffffff}, {{&(0x7f00000028c0)=@l2={0x1f, 0x0, @none}, 0x80, 0x0}, 0x2}], 0x3, 0x2, 0x0) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x0, 0x1000006, @loopback, 0x8007}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000002200)=[{{0x0, 0xf5, 0x0}}], 0x40000000000027f, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000040)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @generic={0x2, 0x5, 0x0, 0x800, 0x8}, @ringbuf_query, @map_fd={0x18, 0x0, 0x1, 0x0, r0}], &(0x7f00000000c0)='syzkaller\x00', 0xffff, 0x75, &(0x7f0000000100)=""/117, 0x1f00, 0x30, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000180)=[r0, r0], &(0x7f0000000280)=[{0x6, 0x5, 0xf, 0x6}, {0x3, 0x1, 0x6, 0xa}, {0x3, 0x3, 0x10, 0x4}, {0x2, 0x2, 0xe, 0xb}], 0x10, 0x9}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000440)={'ip6tnl0\x00', &(0x7f00000002c0)={'syztnl0\x00', 0x0, 0x0, 0x3, 0x5, 0x4, 0x1, @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1, 0x700, 0x10001, 0x5}}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x10, &(0x7f0000000880)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0, @ANYRES32=r2], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) 12.952615243s ago: executing program 1 (id=3140): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000140)={@val={0x3, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x8016, 0x1400, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @dest_unreach={0x4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x11, 0x0, @local, @loopback}}}}, 0xfdef) recvfrom$inet(r0, &(0x7f0000000680)=""/245, 0xf5, 0x62, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000008f09000000000000002951f7ea9f993f32d7e9e4286a00000000004d6eec51168a2cfacc2cb96833"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 10.780025039s ago: executing program 1 (id=3142): r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={0x0, @remote, @dev}, &(0x7f0000000140)=0xc) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x6, 0x104}}, 0x10) syz_emit_ethernet(0x22, &(0x7f0000002880)={@broadcast, @broadcast, @void, {@arp={0x806, @generic={0x339, 0x8847, 0x6, 0x0, 0x4, @empty, "", @broadcast}}}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[@assoc={0x18, 0x117, 0x4, 0x6}], 0x18, 0x40040}], 0x1, 0x8040) sendmsg$NL80211_CMD_REQ_SET_REG(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000700)=ANY=[], 0x1c}}, 0x0) recvmsg(r5, &(0x7f0000001600)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)=""/23, 0x17}], 0x1}, 0x142) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) sendmsg$tipc(r3, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x40, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40040}, 0x4) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@bridge_getvlan={0x18, 0x72, 0x400, 0x70bd27, 0x25dfdbfe, {0x7, 0x0, 0x0, r2}}, 0x18}, 0x1, 0x0, 0x0, 0x20004002}, 0x0) sendmsg$sock(r0, &(0x7f0000000280)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0xfd}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x40) setsockopt$netrom_NETROM_T1(r5, 0x103, 0x1, &(0x7f0000000080)=0x8, 0x4) 10.434432298s ago: executing program 1 (id=3148): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x2b, 0x80801, 0x1) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x20000000) setsockopt$sock_int(r1, 0x1, 0x20, &(0x7f0000000100)=0xffff8000, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) sendmsg$unix(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)="aa", 0x1}], 0x1, 0x0, 0x18}, 0xc800) socket$can_bcm(0x1d, 0x2, 0x2) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0xca) bind$ax25(r3, &(0x7f0000000280)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @null]}, 0x48) getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000000)={0x0, 0xf32f, 0xfe000000}, &(0x7f00000000c0)=0x10) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x20004010) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'tunl0\x00', 0x7101}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00'}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000100)={'wg1\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) r8 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r8, 0x890b, &(0x7f00000007c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bpq0, 0x5, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @null, @null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}) connect$rose(r8, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, 0x1c) connect$rose(r8, &(0x7f0000000240)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @null}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newlink={0x54, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x34, 0x12, 0x0, 0x1, @bond={{0x9}, {0x24, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}, @IFLA_BOND_PEER_NOTIF_DELAY={0x8}, @IFLA_BOND_UPDELAY={0x8, 0x4, 0x400}, @IFLA_BOND_DOWNDELAY={0x8, 0x5, 0x4}]}}}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x400c89c) 5.520293157s ago: executing program 2 (id=3177): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8}]}, &(0x7f0000000640)=0x10) setsockopt$inet6_IPV6_PKTINFO(r4, 0x29, 0x32, 0x0, 0x0) sendto(r4, &(0x7f0000000240)="f77d53c8b0f812947e44edd2a90fc4f449d1a22aa31dffd2bf6aedf6e6fd017fe1058ffb0cd6b1584bc4b154adfb787926a3a3b8edd4a9ecf74317b32d1088c88e451007630ea77f2d0142a3", 0x4c, 0x8844, &(0x7f0000000380)=@can, 0x80) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)={0x24, r1, 0x1, 0x70bd28, 0xe, {}, [@GTPA_LINK={0x8, 0x1, r3}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 5.331104978s ago: executing program 4 (id=3179): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2}, 0x50) (async) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x17, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x43, 0x0, 0x0, 0x0, 0x59}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0xcc}, @func={0x85, 0x0, 0x1, 0x0, 0x5}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x7}, @exit, @call={0x85, 0x0, 0x0, 0x2f}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x8eceb2e30985c02b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r1 = accept(0xffffffffffffffff, &(0x7f0000000180)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10}, &(0x7f0000000440)=0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = socket$inet(0x2, 0x3, 0x7f) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="440000001000010026bd700403dcdf2500000000", @ANYRES32=r5, @ANYBLOB="800000000539030024001280110001006272696467655f736c617665000000000c00058008002200d39189f5377d783c590e2984c9c80c9d4031cc096a10801c9f7f"], 0x44}, 0x1, 0x0, 0x0, 0x400c880}, 0x8002) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x34, r8, 0x1, 0x4, 0x1, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48c1}, 0x20048000) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000280)={0x130, r8, 0x100, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xf34}]}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x489}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x4}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1ff}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'pimreg\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e1d}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x47}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}]}]}, 0x130}, 0x1, 0x0, 0x0, 0x44001}, 0x8040) 5.089833523s ago: executing program 4 (id=3180): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) writev(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x60000081}, 0x44801) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r2], 0x90}}, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, &(0x7f00000000c0), 0x492492492492627, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg$unix(r4, &(0x7f0000003200)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/138, 0x8a}, {&(0x7f0000000180)=""/162, 0xa2}], 0x2, &(0x7f0000000300)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{&(0x7f0000000380), 0x6e, &(0x7f0000000580)=[{&(0x7f0000000400)=""/129, 0x81}, {&(0x7f00000004c0)=""/144, 0x90}], 0x2, &(0x7f0000000680)=[@cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{&(0x7f0000000740), 0x6e, &(0x7f0000001ac0)=[{&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/69, 0x45}, {&(0x7f0000001840)=""/119, 0x77}, {&(0x7f00000018c0)=""/109, 0x6d}, {&(0x7f0000001940)=""/95, 0x5f}, {&(0x7f00000019c0)=""/249, 0xf9}], 0x6, &(0x7f0000001b40)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000001c40), 0x6e, &(0x7f0000001f80)=[{&(0x7f0000001cc0)=""/181, 0xb5}, {&(0x7f0000001d80)=""/216, 0xd8}, {&(0x7f0000001e80)=""/114, 0x72}, {&(0x7f0000001f00)=""/94, 0x5e}], 0x4}}, {{&(0x7f0000001fc0), 0x6e, &(0x7f0000003100)=[{&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000003040)=""/140, 0x8c}], 0x2, &(0x7f0000003140)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x90}}], 0x5, 0x20, &(0x7f0000003340)={0x0, 0x989680}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x20, 0x15, 0x1, 0x70bd26, 0x25dfdbff, {0x5}, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x48080}, 0x8c0) writev(r4, &(0x7f0000000640)=[{&(0x7f00000002c0)="5810", 0x2}], 0x1) close(r4) 3.424975265s ago: executing program 0 (id=3187): socket(0x2a, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 11) 3.074148674s ago: executing program 0 (id=3189): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), 0xffffffffffffffff) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) sendmsg$NFC_CMD_SE_IO(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x1ac, r1, 0x0, 0x70bd25, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_SE_APDU={0xf3, 0x19, "a152b4889aeda75005077b5fab79ce6fc8c0fcded1ef34de7bb9b4b17d24c84475059b1ea70f4d096db8fe7cd9e5843a1ccffc874e54e5bc76789d9932a958d49dfb69b252930dab1eca5d94abe37af6677d37d47f3eb3399c757777f43a018b7e15683eafb05844039c6a7d59fb054789b4745b2ca384bb08c098d778eb10de4989b037540877422e284dee2fe9a4827c4a7bcce8193d3ad496b1056e8724658b0ba40f2d5866681d0b59d00edae299cba8b18579354f8b99caa887c57b6da7642d5d47488fef42d76b889718264fec70a14326a0608d76f107b1de4c09956985c0dbec1f8e563cc1bed753d246df"}, @NFC_ATTR_SE_APDU={0x91, 0x19, "24ed178fbf842c6ab289f191d21f0add187de6e75ad01eeab0cc93d760bf06039a202987b407e636dc70dbda98781c0f868f050a5a6c53c1a53f98e5c1e23cf20d492d38d75f1d587b05fdcb29f26bf6f31c8d4bd0fab17d808a47edd84dfc1c90a2c000e9bf4a135fad51e16dc5265ab5f3a870419902262e895bb9e48e6cc53b184283783bccd63316a1e925"}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}]}, 0x1ac}, 0x1, 0x0, 0x0, 0x20008001}, 0x40000) r3 = socket$inet6(0xa, 0x1, 0x2) sendto$inet6(r3, &(0x7f0000000300), 0x0, 0x40, &(0x7f0000000340)={0xa, 0x4e20, 0x9, @mcast2, 0x10}, 0x1c) setsockopt$inet6_buf(r3, 0x29, 0x0, &(0x7f0000000380)="23347d0f68671c3d3648fa7f93c6285332d55d94acfe1201", 0x18) sendmsg$NFC_CMD_DEP_LINK_DOWN(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x24, r1, 0x2, 0x70bd26, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_TARGET_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x9d79540097383907}, 0x4000804) sendmsg$NFC_CMD_ACTIVATE_TARGET(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x4c, r1, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x5}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r2}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8801}, 0x44080) getsockopt$IP6T_SO_GET_ENTRIES(r3, 0x29, 0x41, &(0x7f0000000600)={'security\x00', 0xfb, "7a3371df635a8cc6a8b21e22c4cfa8b048a3f5db9fdc1004e89567e5fc1ace53f7cb2f14d6ef41a2c2539f8ec01e8ebc50e0b664bbd8f49aa8d7741714c16a3e5d6d6b73ac9924782bc4a285cf35769f3b3f6bfc010bcbf96f12806b785a42415c0d7d7ee4ee59228d55ce29fad2af1872084f54d688b32c028374d10d6eb6f7eaaabe373c29a27ec0a639a9e4d49aaf8581870e02814c66478c59a864820aec685ccf627f4634bda90e8afa5b1ca5949fc9ce79b3bd668758c04391f543c5407d5d5a9f4e8fb857395b6350a34fc4b664fc5b9a07fb40b624a4bac6d65cc3a775f7469cfed0b2c46672dbba962d654365041b744b6584b9e37f98"}, &(0x7f0000000740)=0x11f) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r3, 0x4058587a, &(0x7f0000000980)={{r3, &(0x7f0000000780)='-\x00', 0xc040, &(0x7f00000007c0)={@_ha_fsid={[0xfffffff9, 0x7]}, {0x400, 0xc927, 0x9, 0x8}}, 0x2, &(0x7f0000000800)={@_ha_fsid}, &(0x7f0000000840)=0x4}, {[0x9b9, 0x0, 0x9, 0x4]}, 0x100020, 0xee, &(0x7f0000000880)=""/238}) sendmsg$kcm(r4, &(0x7f0000000f00)={&(0x7f0000000a00)=@tipc=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x3, 0x2}}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000a80)="5d2eed11b809f4b426384ec8b0e6e9ce5336cdef0ca0cd104d5522b52245408d5ad59eb17a882ed1b8dbbf8c71d7631f6d6cecea6d53142c1ada6a6c50c604a2b0993d6b70f140b160df9f29d644be71d025c1d4", 0x54}, {&(0x7f0000000b00)="339b3ad9831a3882ce2fef2e13637c137cefc122d4c24c1f59a09f9514f730f4f63565fc5469f16af9cbe204cbedf88ada1b47b37dbff28b040d65ab045cbfc944eacf9ea540c6b002da7f68664b31f38bd0c26ee82171b3ea34ee50ac108843ba357c5ba0000538f8395eee98943c034e3a78875fac4d6d239ccbe47542ee804dd3ddc4e8f5bb9ba8b3e10b55652c6c70275b710dba62ab33c156fd8fc725493f7512861cfc6684fc14a6e172aefee66b785609efd023f6dbaea06f4a1f3588d8a37f5adc1d7e10e3a1024f3ff75cf4a4980181243997174dfc11cd885c39c06afa5b5a8033aa8148f3081c716bf56117ae6741b1f8", 0xf6}, {&(0x7f0000000c00)="25bb86a5c73f54c0f8949d4837603f1a8e76b9619e7303aaf002c131445eca7712f530ab70bd1c610ca7185b30259dc2a86456f91052cbfcf1751c21f824b840558e8a7ac2349588aacd0c19ef9bac223173a81008783414aa6e898125d9798ced68e76383b26e5a", 0x68}, {&(0x7f0000000c80)="d55a1f6b2a661d8497178b063980be7a82502db0", 0x14}, {&(0x7f0000000cc0)="c59437fe52d87cb321e6af39e838dadda6311a50def2c2de1344824820f69a7400cdb86e727c61c28c3d8e8465eb88f43215f41f003ad36d606c3230d03a396497289b5c5d4eeff06dee77f7a4f36c2d172eb6951a23fac92177e906126232a687c446acaa5b7bfde470b85897030d2e6a875eee15ae77eb931e7e6089b08a2b77ae5bd661eb262e25e43d5cfecc9612cc3eaebbf47af8475d4d2f212f92515b65c5016c83510013b7e47784ec244db0a6ab349f8fd53ccb34893394450a2f954fc44d257fe5d75be26ce7fcc668da93fafa6b03e6f56849f6e25dae0c7c47f2474d9bffabcf4f83f1a4baa7a8a97c1b7b4adf962f5d1b63", 0xf8}], 0x5, &(0x7f0000000e40)=[{0x98, 0x10a, 0x5, "3b9e7d12e373ba277c168ac3b28cc1d86e1f2f31e1d93b3df59e85e103f1e495c9c26084540b324afa7603da4bfeacf9433ed0abaeaf416f9ad9d8a0439d38d935b62e0d60726a280a9928fc2b659faa98c67650193be41a40be50a35a1c37e2ee01beb1163385aec6433dfcecf1b21cd1b6ed0b9ed2648c59590bbe31aca82d8ac0"}], 0x98}, 0x4c044) r5 = socket$inet_sctp(0x2, 0x0, 0x84) r6 = socket$rds(0x15, 0x5, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE(r6, 0x5000940e, &(0x7f0000000f40)={{r5}, "538237f17c8fd2e9351a3802e4f4098a30974b6734b4dc39134b07bbb9ae3c2d4c180dda165565eb246138c13abfc3de8a05922e439cc89bf20054e5c09faa9bd111b53603841fba9eacc7ec08fbf83b0534bf78fdbe3c217021f541cd930873b1ba9e0b082bfb7d0ba00586e7214a823b2c49207c855e6e694696ea7b25f93f374ce2a92e85bf37625e665efe6d0739b653a505cd1a6cd6b75d70b8cfa4715af330b15e8e229eaf025ebc342ab877274ce85dff53241df51e6582bdaafb29a4cc1403335f537b493a430ab45a632f7e94422a9923384f144d8c20b250ade201f8206a3ac0553d9602ed9439820a9031caaf1e95edac27a3da833313818e5b8e611ccb0d81dea237771c65e209cc518c1938f2f04a1392df18a0a196f0faa28176c3b5cac7bd6566648bfa63921b9a635c72fd4b361521fbfef19fe77d2e3abc26e752c24f722f19f658c6565244f1aaae89f52dbbf0a96c6b4558fc8b98d0350639bef20c42c96bb6bfe542674d78dfcf93278508ce94d510059a7089cd17b3cc320ea7cf8802a561b09431e926f548c329f09c50d62f3c53dea946f52dca239cfe2ac77f462537d2e8d938c451e010d806142418b59fb43ac51149f6022697567dc9363b911abb7aff6873a23fc4ec0551690f66a94ef24d148f096154a76e4e3ff1d9db93d228edeed0bdea2ae2982f0581dda5e95fd7befe19f9d82da357a81ac95a7a08ede6f47dde504a647d5c4c1233fe9230a4e57473085695269d087a24d6c554d66decead6d24e3e1e85637f7e533ace235bbcd203b1a8a5d4f5dc937a68057f6ec28d015bdd141e11c634104a631e015443c4b991b5e74d6260442de67b71bc8dd9de87a3483df0952300cc52a0f2a7e97bddb7be7b9ef1a37ac5f8dc6e3edb6dbab93648c6d5304daca1b85e6152449724f4a6b69655d093c2c759785ff4217091cde91bcbb241ed68d0585b762786bb679658c82aa6cbcdc492cb76111c501332aa543f4cf96b408462c3a09e45bc99ff830211e9e3999b7ffc38e7fa979426e1b151b4728d76688e5dc1f445bef4486989865da69f625c85d5c9e1641000439861357a3243b15054ef40051a1d7e97fd0b4c763b884c740849704f4592520e79de297e2863bac4a4324ba4befafda4ebba790b8823fb201f7d83eab8138f0bb95daa663d33b23606c08cb11056b1a7129c11356e5ea3799f2850db57e4fca48cbae11f74bfb39eef797c1fd7c5854e6cf17f293a3937921799c4821d68af0d4fe068b1210db98c07d737f528a553fd69b9aad63044036a0ad2890b20b1c473b11a4d6c0ce899c13e70504ea51be4cadcfc134117564a12226f0a164e836a50271e553d0b91f344ad9325f3fc19ebe5e943b0efb0d5c682f35095d1476dcebe3f61339742d30a8fe3422629844b6dc3623590fafa68ba408c2b5becbbc405197f3c725f956af1426d5ddcde067cc69ff7d32747c42946d7e7ab6c093b56ae9852780bb4eaddc811600d9ada5eab3ca001c7f3b9878ab76233f3713c7e998dcfcdd8a849c9734edeb94f8305c75efcefe3775bc4601661558eaeda560c8a5e9f8d061aef86b8c320d5eb3a83daea14a189002eea7509e551a7699e53e42c9cf23b57c751787957bdf6961717bceb8b0ac922e4195ac6e1af699a52a0fba713158b6a1487ea4f55ca9f1a1cec2a220608386bac0253594bfa066b57ccc061a8bda964a05b7f07ec6d13efc2ab09f66ce52ddfddd1dcfc356e0aa5709432d887a69e1f8b77c4e1237224acaff6248b05f2b3e517caec1367cc563cba861ea5bbfe914c505bac3c552311e486d21342806cafd7049c066137b6d438d4edfb5690f94a4c1373402f69ca3aaa4b0a4ff7efad1c558af4988478470e99f59571f3d21d52527b6646fef246c0f5e7b7fa72e1f65954364ee82bcfd3b48330e816c7a1955018f28e081266b645ceb3f5738a215caad97d5578d32ccb6a463b80162cf98e80b37f574d30ce8a83f20e5c4de2d087adb4625075749a773b7981d02a4cf745687488214d0cfce76ff54c62f6ad4f26b29ca082e68ec9f4f3f0f674d127c692c31a8a20c107f83a73838b2e9146b015af288dda94b79a0307d771df13b803bcc69690fede95883d46429b993986d5f05f49f5bcbbc84b2d44aeb8cfa7e8feb60d005124b386d5a53da68b60a1026f98fba48e67b2f64f78931bfbd5557d92a88b05150f2efaa6e549fa2cd107e63c793cfa3cc34907b25d1bcf7c92781db62f0f4fecccc7a3135c8934c379e0dfb73452e24c75ce013e7f711be1a37bff8c6132cbb3ccb9da6d3c3190613665dc6799687760b6b74eea4d61b1d7ef4b212373d5b58e683340e48dd905209a2c52cdfb55746d07e10592017ef52e8df6dab19e6055fd2cc3c35253c6bf7f482e273bdabdc338e937ae628b96494c59ec554cdc2dcc8c263ba9af9fe02d74d05fe6c85092f1040029a759a0a412d7705b2e38eb6d777a0553ec74909a1fef2ecb9fc3cddeaab0eac5c044f2d898e296404d9b605b73d1e00c1093eb48619be2f2aef03722b903a57efe80dc1194724cc149c018fc9b000d6f9e64626755c604ccc163c08768d7f10c6469b08aba8e5ea98f8cdb99c87101a46c79d60acac5a01e7d0f6914261ad8e02f6f699844bae11e9cdd4881a23df9b124255063f8eef5e5fc6c3c393768ba2df1904275067d5d8df5d5b1e67beba0e6211824f8adbc26e73bcf3fc85faa27ecab88f326ce9a928dfe6f1f4dd0dbb305d44b52f665ac29ffd8d10bf296a4e657939606d7f7a79510d0bc8bf3b05241fb9e64a759493fbfe40db2f6b6aa2205f9687519e51cad8afc5874480412495130f732dc92b26f25522cb5e59fcfc7ef79ee63b00a1bef1a7ac2e42b4167cbfdf7c2a8b3e725fad94490734efdfbf6b76fd50586db3ed56d09b940b351acdac4ad7739f4609cc30492725e70418a7695c40aa26b3ad935dabdcf7d29561867b58794a1aff32653c8e47f7fec248f842ccaf099be85c29a6d881d341d6a664bcd5fb6d4ac1024a45ce48d34d9ed0f0af0f0009cb86b5ecd437378a4f8424f4697b4d3d6da3ca2d78544ca6f11ac223f34a8987f34f3744034449d6ade8fb52c72ca00071127e9477b714433c2029a46a9b54453bc6ed70928298c3904d7a6625dc0c4d0c896392e0c717869240353670a8fe6ecc65931388ae0078187ac45135546def54e1e06b6dadcca53cabd71192a57c3f9b0d2c13f650004ca163b9dfc8bb2cb412a6f8a641e41b69ca1ef7a5003ac5a4d3efd347ee62e906ca01a8a2232611e74e5b44f0e3453d209d3a556ad036c0617dd06370c1e33cb5dcbe7bc8fca82389b3c8a29070079819d5bd406032c76cc877947d5bd941580dfdb5ff56f903d5edbe11f21a58c1b795456d66d0cc9cbdf92e540837166a5a4a63174ed1c7a8e5463040d32639905d6382b61194153fb1d846194ca008114d1a509d91d24e3a0216f89feb9145eb254077e05aa8d0da13969a056e2ca66174f8db4643f94f8ceda94b7b45ccdef2496c8733b4060904f500646ce1496bc0247294fa0eef44d2ca80ae47316571fc6b0474ae7566c0001ced11b1db99843d84ce9a19a98251fffa216ef167eea3f3ed10fbdace083531f49d21922171f74eefd42905142bb4ca21102a6883df362f4e187234b3c901c9ad6375a0162d90b8dc71a0de5eea7defb9fe3a98f755c5e4ae8b1fd9bafab09b8e5e9a5587a4382c35daddfc2a004fbef1e806e9e41af012489ceddd656addf6642e5b61ff58eae455c2da603b032b94104d3f282048803d80414e7bbea83e08431c09ddd430c206982008f43c8cec8e79dcc7787e892e50094bdca985e4aeed439e0f44c98279d7be77171e55077ecc375e67ac5fb3eaef34c287ac36f3084f96b93001682a04067c98e0ac282d71563252a43e8a599da867258d572df229ce5abdcfe59b34a9cbd308ed7ff14c8370009e0f90565340a880c0eeb3ce142da63525f85c71fa614cb78d6e7630f3e4318ef116852502491ed582145e3b94d4b328fd75cd7c0c8d46a766933685e92d6fa8f255661b83cb6d5e191d87fff19fea1f450b56bcedb5c6215ffec9a973a5ed5fa105930bc98853860ff9c5a13a4b0553c5d7ea21d28dd929129e968f9880ffddb2899052e29e1804f2fd3fcb0b49fc058e1da2a8e22bbce36d0fba34bb505191f6d4bc7e44385a107ded49647f544956e17144d457da866e06f1cc008ef884caf1b0015f1254317cf3e47def11a43cc565b27fd3761e4539a7e9d68e0e9bed95c6fa132791ca516a0f5f02403d5d333e887bf0ee927adab2c7b32f396c2c2be5535dab86e11fdf0c4af94818d2169716aaa36dbd0cb4b5915c0732bd0d910b5f80a13e2940fcbab94eb1227c49f8d941f35e07de80c26d816a7c134d80679f33c744b722fe08e84b2c0508ad55e93a5ccab430ffafc1502bf832c70a41e18a1b8e46733560e192e72d3abcc1deb5aa7a7133370503187827af051df155f46c158e3e5bb967f1dbe19b47526f81522e635352afcdf3ab7a89b5d15c2a48eaf3ea302715087ed6da47f346cab4f546deb02c5c6c60b6606e34ee6a1749a42e56315ddb556fc46a23135bd45736de755ca31653af5a3a06b9f447642f810ab5b48a049dd2b853a3ae868823987ecc06ef099fa4de43f9a8528172f39b8f3ccbd7000600ea8a0ce274268f614903e8496fc9f4a8273df0b8ce5613594e5f979e4df57e47032197ebe98819084e25b54d37b48f8209682d47695399fad95ffda02b3bf621e8616c3939931ec1aa15774ec25d03bcdffbdcb9ebe1389c064530c5f9d85c5b0a84404842110abbf0eb27f816b003dab87da6ad991055937bb0b61034ab910658394e11edfa4c0d30a2c6192d699b5bba6836aea93274d1dd4b9ce10b10b8b97e239950f983a73dc14dba330a48e596d402be35083a36cce04e5ad2967fc5bf6825f909f66e2eb40b4194b9821c09480d27edad8335b1e253ffb7ce530f3cb6b691f8521bacf1872f2acb06cb42a7a736c4d400971b96326853df1da8e5ee5c23227c43c8d06ebc580ae37612c8714ad5325493407b185b61c7fc6d146179f5f749822235c23a91486ff3c463b3b7ee2a793fdd259161ef965cc1a2d30ebe92b9ab228eb178a2ac3b06bd20deb3a7e7007adc46fbf1463e0b0631933415babf33b10babc626da70b4d85bd7dc947bca08073905e9ae283d790e8c2347975141f4096a6156e7c1780fb5a98f6227f998d4e90bbba358766f4ac11a654ce4ae527ea8711ee9c5478d7f2334c73dc5d4f9b91de4f97ce1b67e48132f444e888f58cc34e4512c2564f39ecef4055d17b2fcc46b4e612195634cb56145f0df005a54f17529c99f2e8d0451d541d631a661dc84ba3d72dbd17e4da17815cee10b69bcbfb5abbe489a5260e75d9aadddc5424abcd992ea88b73a86060c2939b770a3d6aaa9ac77a69c5f7f82404d49103ac5295031503c267d365a225325b85e68419a967e2cee63adb50a6e5253a0ac72a38cd6a3438510247c3e2b67c29430d4b492611d5d406d8b629f31e35fa16d28bdd1ed2479da01d98028c04c76a9cd5aeb7eebaff3228df2b676532e4bb3e7c7296aaa2150d3b4f0d2aac7fd65d4cb5849e1fa4122454ec21a1074b21fdcb250a17e4e4b625d0022514dd2aff92eaf9a10df7df966370a77adb759600b45f4526347c672e28d7171b8d0a444ef38a0fe1e0b36028d2c6b7d92a3ff8b7"}) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) pselect6(0x40, &(0x7f0000001f40)={0x8, 0x351, 0xee, 0x1, 0x0, 0x4, 0x8, 0x8}, &(0x7f0000001f80)={0x6aa, 0x9, 0xfff, 0x1, 0x10000, 0x6, 0x8, 0x2}, &(0x7f0000001fc0)={0x7, 0x84c, 0x1, 0x9, 0xffffffff7fffffff, 0x7ff, 0x401, 0x2}, &(0x7f0000002000)={0x0, 0x989680}, &(0x7f0000002080)={&(0x7f0000002040)={[0x8001]}, 0x8}) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f00000020c0)="410ea6d853905f82b8d18b3ffe24cc324d12eb2a669d305ccb0024c679d1da1752e3488633f5a5cc6981e3694f01526b65543e26d0fd52f49f72873da9306263e87c5c31b6428e6a6ff4fe532b516b5d59342dd5594675130e4496542f9c8964dd44150aa86f2f441ce2074d1dced7509e0c74808bcdabd2e570d8833a17f8d84b60402cbe418fdf5077818b", 0x8c) ioctl$XFS_IOC_FD_TO_HANDLE(r3, 0xc038586a, &(0x7f0000002280)={r7, &(0x7f0000002180)='*\x04^\\\x00', 0x1, &(0x7f00000021c0)={@_ha_fsid={[0x7, 0x7]}, {0x69e6, 0x40, 0xa5, 0x2}}, 0x0, &(0x7f0000002200), &(0x7f0000002240)=0x6}) connect$x25(r8, &(0x7f00000022c0), 0x12) sendmsg$MPTCP_PM_CMD_GET_ADDR(r4, &(0x7f0000002400)={&(0x7f0000002300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000023c0)={&(0x7f0000002340)={0x6c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x7}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x48000}, 0x4000000) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r8, 0x84, 0xc, &(0x7f0000002440)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000002480)={'ip6gretap0\x00'}) ioctl$XFS_IOC_FSGROWFSDATA(r6, 0x4010586e, &(0x7f00000024c0)={0x6, 0x80000001}) setsockopt$inet6_int(r4, 0x29, 0x13, &(0x7f0000002500), 0x4) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r3, 0x84, 0xf, &(0x7f0000002540)={0x0, @in={{0x2, 0x4e21, @remote}}, 0x0, 0x7, 0x7, 0x1, 0xffff66b2}, &(0x7f0000002600)=0x98) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f0000002640)={0x0, 0x6}, &(0x7f0000002680)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f00000026c0)={r9, 0x7, 0x7, 0x2, 0x5, 0x6, 0x7fff, 0x1, {r10, @in={{0x2, 0x4e24, @loopback}}, 0x1, 0x7, 0x3, 0xca7, 0x5}}, &(0x7f0000002780)=0xb0) syz_genetlink_get_family_id$nl802154(&(0x7f00000027c0), r0) socketpair(0x18, 0x1, 0x87b0, &(0x7f0000002800)) 2.644827066s ago: executing program 0 (id=3191): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x6, 0x104}}, 0x10) (async) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x6, 0x104}}, 0x10) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000040)={0x42, 0x1}, 0x10) socket$tipc(0x1e, 0x5, 0x0) (async) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r2, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) (async) sendmsg$tipc(r2, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x80) 2.492300788s ago: executing program 0 (id=3193): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000440)={0xffffffffffffffff, &(0x7f0000000340)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x100, &(0x7f0000000380)={@align=0xc, {0x9, 0x7, 0x3, 0xe}}, 0xfffffffa, &(0x7f00000003c0), &(0x7f0000000400)=0x78e}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) sendmmsg(r0, &(0x7f000000c680), 0x0, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_route(0x10, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xea, 0x440, 0x0, 0x32}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff), 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 2.363876172s ago: executing program 0 (id=3194): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={0x14, 0x1e, 0x221, 0x0, 0x0, {0x14}}, 0x14}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="2000000072009fb3000800000400000007000000", @ANYRES32=r2, @ANYBLOB="080001"], 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x8000) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) syz_emit_ethernet(0x46, &(0x7f0000000000)={@multicast, @random="6696eeee2a81", @void, {@ipv6={0x86dd, @icmpv6={0x1, 0x6, '\x00', 0x10, 0x3a, 0x0, @empty, @mcast1, {[], @ndisc_ra={0x86, 0x0, 0x0, 0xff, 0x2d, 0x6, 0x999, 0x5932}}}}}}, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0x50, 0x0, &(0x7f0000000000)="ff", 0x0, 0x36, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="20000000400019070000000000000025037c"], 0x20}, 0x1, 0x0, 0x0, 0x4c896}, 0x4000) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="540000001000030400000000fcdbdf2500007400", @ANYRES32=r1, @ANYBLOB="800c000007500500340012800b00010062726964676500002400028005001900020000000c00230001000000000000000c00060000000000"], 0x54}}, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000780)={@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0xe, r1}) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f00000002c0)={r7, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x41}}}, 0xfff8, 0x2}, &(0x7f0000000480)=0x90) 2.096083987s ago: executing program 2 (id=3195): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000006c0)=ANY=[@ANYBLOB="d80000001f0001002bbd7000fbdbdf0f579e349c85dd25c800ca80a317a5a24a73db249f54d1b8aba0398d56d14abedb29cb2eac4cae4acb95e21974ed2df4dce49b3682b4580c67d082b570bdd243f8a62c3ea6a88e15c5d7961ae797c7a67d0baee99e81e3689bfb69c870c8409182e9a7c77a53f7f9bdb454d6953cf61e07480eeb13bfcd3990bbf01b61da8fb4e9379a37e6d04377effd0400fe8014000c00fe88000000000000000000000054f5df86936bb491fbf076fb5dac70a5bc8f92618e2089887419d26b58a6f8daff0b1f0e6c67d635d1cce5ac4d9eed63bf91e921cea34880657780ff52"], 0xd8}], 0x1, 0x0, 0x0, 0x20000080}, 0x44000) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000380)) r2 = socket$can_bcm(0x1d, 0x2, 0x2) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000001701000003000000010000000000000018000000000000001701000003000000010000000000000050"], 0x80}], 0x1, 0x40800) syz_genetlink_get_family_id$ethtool(&(0x7f0000000340), r3) ioctl$sock_TIOCINQ(r2, 0x541b, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$PNPIPE_ENCAP(r4, 0x113, 0x1, 0x0, 0x0) socket$alg(0x26, 0x5, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'lo\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000001400b59527bd7000ffdbdf250a4000c8bf690bcb075f72f24cfc70870a5495786c0952fd300341a1176bb14215eec0a18d9b63737a374c758dcef556ce348588508a87091daa483a04f1903e1d7d9146a2dac24d00f05712cfbc00a67d835077f9d2a21589b7edcd13719d53b2d9cc731639cb4dc77094766c91fb41fae46a7f58e1375cc5f3960c009138a092b2ef28fae9624c023ea1ff3cab03d3295d1c40d97fbd92614e8d235a3d1df51a2f2a5397f10de07a88670c6d20da9828ac7c1077a93f898d2ed5d4538e01675640a0c2977f7ad177f57be490fee761f6f07e4dee807eb17033d9db4a6189ce", @ANYRES32=r6], 0x18}}, 0x400c0c0) r7 = socket(0x10, 0x3, 0x0) r8 = syz_genetlink_get_family_id$team(&(0x7f0000000180), r7) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_GET(r5, &(0x7f0000001840)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001800)={&(0x7f0000001700)={0xd4, r8, 0x622, 0x70bd27, 0x25dfdbfe, {}, [{{0x8, 0x1, r9}, {0xb8, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}]}}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20002000}, 0x20004001) r10 = socket$isdn_base(0x22, 0x3, 0x0) unshare(0x8040480) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) bind$isdn_base(r10, &(0x7f0000000580)={0x22, 0x7, 0xf2, 0x10, 0xad}, 0x6) r11 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r11, 0x800448d3, &(0x7f0000000080)="755ee3ccb1") r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r12, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r13, 0x6a98047402e98331, 0x70bd2c, 0xfffffffc, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x50}, 0x48c6) socket$inet_udp(0x2, 0x2, 0x0) 2.037031301s ago: executing program 3 (id=3196): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000c80)=ANY=[@ANYBLOB="bc000000210001000000000000000000fc02000000003a000000000000000000fc02000000000000000000000000000100000000000000000200002000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000050001100e000000100000000000000000000000000fffffffffffffff0000000000000000a01010000000000000000000000000064010100000000000000eb09000000003c000000000000000a000a"], 0xbc}}, 0x0) 1.872750312s ago: executing program 3 (id=3197): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x615a}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xf, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x80000001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffff80}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x27, 0xe, 0x55, &(0x7f00000003c0)="f9ad48cc42cb29fc99d41a08320a", 0x0, 0x13fd, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$IPT_SO_GET_ENTRIES(r2, 0x0, 0x41, &(0x7f0000000640)={'filter\x00', 0xb8, "772da83be0b45bd4989175ebf45342b5bc7747601c112fc8eded584043dfd42cda18504b5233965de2da40a208fc3d0a781d21c60c6b807d656087af4eb2f28672f91bc2a679f3ac1e947884e3d86db62a6c7f5963bab8c59142deb551e02a038d83efe004263ab4f1226dde6cd6c23ddb5ac06fee17de99216c3f11432189c117be0e2270e1f651c0b8d9fdb557f9798283c6a6202d5f09806fedf823a2c134f16abf35373c18f3f5219d62557a0d3bbc38452f6558d477"}, &(0x7f0000000740)=0xdc) 1.774626212s ago: executing program 4 (id=3198): syz_emit_ethernet(0x66, &(0x7f0000003580)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x30, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x5, '\x00', @dev={0xfe, 0x80, '\x00', 0x2a}, [{0x2, 0x3, "21c1e05659ae3f48e9296b2beda7add700385601f891"}]}}}}}}, 0x0) (async) r0 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={&(0x7f0000000040)=@abs, 0x6e, &(0x7f00000012c0)=[{&(0x7f00000000c0)=""/90, 0x5a}, {&(0x7f0000000140)=""/168, 0xa8}, {&(0x7f0000000200)=""/150, 0x96}, {&(0x7f00000002c0)=""/4096, 0x1000}], 0x4, &(0x7f0000001300)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xa0}, 0x40000060) 1.656668931s ago: executing program 2 (id=3199): socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="02000000040000000800400001"], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r1, &(0x7f0000000500), &(0x7f0000000080)=""/12}, 0x20) socket(0x10, 0x14080f, 0x4) ioctl$SIOCX25GSUBSCRIP(r0, 0x89e0, 0x0) sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, 0x0, 0x4800) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000004000000000000000000000300000000030000000300000000000101010000000000000800000000010000000100000506000000010000000200000000000000005f"], &(0x7f0000001540)=""/4096, 0x58, 0x1000, 0xa}, 0x28) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000005c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x24004090}, 0x4000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=ANY=[@ANYBLOB="0c0100001600010000000000010000000a01010000000000000000000000000000000000000000000000ffff000000004e240000000000000000802000000000", @ANYRES32=0x0, @ANYRESHEX=r1, @ANYBLOB="00000000000000000000ffffac1414aa0000000033000000ffffffff000000000000000000000000200000000000000000000000000000000000000000000000050000000000000068482c4500000000f1ffffffffffffff03000000000000000000000000000000000000000000004000000000000000000100000000004000feffffffffffffff000000000000000096070000000800000000000000000000030000000000000000000000b1a001000c001c00", @ANYRESOCT, @ANYBLOB="0100000008"], 0x10c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000402300090122bd7008f9ffffff020000007e092743bd4e923913272bca42d457e0df0319d30633f4f4ac9b594c3e688407aa08f1342db79ff64137fdc417aa3c6b2b93696b1fe8a92cd444767944b9e6f4299840de09cf78"], 0x14}, 0x1, 0x0, 0x0, 0x1004c957}, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f00000001c0)=0x3) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000040001000feffffff00000000017c0000040042800c055b50cc16e45a00018006000600800a000008"], 0x2c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000006, 0x4132, 0xffffffffffffffff, 0xab7ee000) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x7, 0x12, r5, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r8, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x40, 0x0, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040c10}, 0x20040010) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r11 = socket$inet_sctp(0x2, 0x1, 0x84) socket$alg(0x26, 0x5, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r11, 0x84, 0x21, 0xffffffffffffffff, 0x0) write$cgroup_int(r10, &(0x7f0000000200), 0xffffffc1) 1.5607144s ago: executing program 4 (id=3200): r0 = socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xb0}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'veth0_to_team\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@func_proto, @func_proto={0x0, 0x0, 0x0, 0xd, 0x4}, @ptr, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}]}, {0x0, [0x0, 0x0, 0x0, 0x61]}}, 0x0, 0x52}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0x4, &(0x7f0000000180)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x8}]}, &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000240)={0x1, 0x0, 0x0, 0x80}, 0x10) write(0xffffffffffffffff, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f00000000", 0x15) syz_emit_ethernet(0x36, &(0x7f0000000300)={@broadcast, @dev, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x0, 0x4, 0x0, @private2, @mcast2}}}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000000)=0x3) syz_init_net_socket$rose(0xb, 0x5, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd601823250010"], 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@link_local={0x1, 0x80, 0xc2, 0x3}, @dev, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x8, 0x11, 0x0, @private2, @mcast2, {[], {0x0, 0x4e22, 0x8}}}}}}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r2, &(0x7f0000000640)={@val={0x0, 0x6005}, @val={0x0, 0x3, 0x4, 0x8, 0x428c}, @llc={@snap={0xab, 0x1, "13", "8662b3", 0x888e, "667824745ac6c7410f9c2a1b071c3eea68113b3cd173684d639ecf2aa3e03cd38f0e48a3e7e31140e4955e8527b51cb0d14dcabc0e08afab67999a85042ba62b621cb75c83a34a742d2b11b72800eafa00ca50ae483d02b3ed895e646c19f0eb4cc81ccacd53ede2b3f9ea09d7af67e11a46d5aedeee81c277757b0a329e58bcb2e769e685206aaabf24f070cb88900d0f8c1f67afdb94d630ce0c41b1258bae7cb79f35f06c8d7a8ba8001330bbdf72d047f5d6b985dbbe5ea3044ca142a0514e8223205ca9d0e23baf288e3fed5e82be6b52015492cab99043fd6eb4f467afc383e70b6a77f2ca14ba0ca542c37b05c9b0fdb06d7163bda8ba23017a6916a9455ed155c9c6bba193df2b565f7e420d1dd5cf4276645d3951bff272a96cdc6e5ec71a26f8a16bd902fbda8af14eed6488817ef9b4a54afcb814ba01d8bb1f631280c039a1293b7ec780ddb28a3bdd5f2edc19820a1577f8e37fa13ee1706129d3ce6108fcc6487cc1f4b170db266e5d086c2863a06a40be6c5858163db591633d3b84ade5e836f205dc3f984e0fb1d83b69384bd189e5005937037d82a8b4f6efdc776e36df768faa3673a67b1552515a8a27c1e73f4e225ce432f06e27826bc16d49cfd4cac3486a86795b44ff5da6dfb260b9dd3b8263316510365ac6bb26645c048e9a95a07bd07077ef301578d5c0ae233b26f7e16694660c10758dac3527c208cda41816988140b11ee4db617cc52e7e005e78976d158ff72d887afa9dd4dc551158ce87ad1652ccbd10b703612d3eac5ac65e8d79c770c7a2404fe055156b5d3b88968214d1c1c72c8e25e777b9a794eea370b09d313d4ede13893c43d853517448d15786950e9aa85b205ac93b0f0b337b6514ab1b901f545117f9fe6b51101047b1ab2553cade80cb5a6663b108f793b595939d8c9f6143c3f53a14f5f3c6bbee1cfe132b6bee2c7d6da3b4c1408bc0ac39936319089bdfbf6c009e197754f515d422011c47ee09a0d6099cb1961b28bd568d3bbee591acf99cbc0f8d4898e5d947e5418821d6dbbeead3cab283c3b3692e6cd049dcb12915bcc3f48d5fe313a8b3726c0f957a3ccb54007c7c1d99c15380d7753c858c5361842db0fee84fdbaa2e5ad31c3d1d361ae6fdb90927dda9a3228718f113c180b27766c6e4144917d2b829a134d3150966bc54aa06121bcaadeb532bcef4c24295a5cf2cd68bfd5eb45e12437d5c93ad5c56975a19a896c8d9a60aa84587814314378eb991553503d4e73e17a6f51b11a33e7c8280ea4ac5b592ae633a0dccb63cebbd79e4714198bdf1135b1d6a51eb7fa15468f10e75d0d16514e292cca9cf9ddf96768322488887f4b55458ca7976052ec9090b42dbf56055938e5a745d2bbf323947d836430110f4489217fd7ddfbbab75f879c5946a6fbf483f788b9e598472e1c3a72af2fa93dfbe1607bc832c3e670d1e7fb421ca53f7d6cf504186e9644dbfc1e9c6ed6d8c16c941fbb5e1d053bf2a0c625ea12d172d928c382c7478fcd60c61150db5773e439e57886802f1962a4d27740750700eb31ebd0840e38b9712f17c6d0fdfc0e2c484d56b8013a61df621945b558c5cd64ccb27d2758a1b2857f46c376eb9ee96605320fb124591fa1899bbf73eb0fb62626105876e985c61839491eddd26d35b37a67f2501395bdc236377217860e5096d8f44986c486575bce52dbc4283bea128ecaaf02c7504eff8a8d1858e56c4ed9b9fd0e5771fca8dff2c355a1b5222a60b7be65939f429852595eb50cfc9f897a492d531784141d5f5bf6aeb3f8083866dd274aa67b81cc72727a20333eb9e332743d71fa29c43983f062796d3a9369f75f9f2163e4b26bf6dea715805eeabc3195287268c61db6d0fceb855fb447b74fd6e1aae0f073263d0a1bfe5d9c11fa6aa14e734399217ad5a1fda87581bf923801f2e53827dafe0988e6e9906d13341ba39c05af8d3742b4aa6207cab31368b301fe865f0aba5022510fd9414175c111d794434bc93f80961df7dd0415582b48b0395d99d78fe18b52e9aa409a7d3beaf637574e744ce00ab503a021ed614441cb10ca12b19a5bc0d17fed5520a5c64acd132317170893c7db13927bb922bac2cb346c60189c2080981ac1fa5e107b5556fb5f326f03114439f7a5c916886eaaaffaf3f8364c1e22a5eb079611051e99b506440533655fc5e9eabc54cbb7292e97b9ba29818a2716248116972c9098c3204546774690a58f8b5c2a79b07ff9f0cac6985a46c1c86e208487de966b33bbd3ce7a64c698ca5449449ead7d455ff65c01ba4b866d07fbb789e8fa8236ff0fa506f6fd96be1fc9f59783487745d490afb34763cc926335656097f1ed849631dbc5814d968a87c0f87260b498c56a0af7501ad36ae29225689538520b26335d3490cd5bc290f110a329ca984ca8a974385cff5878e61c5223fac908e7bac610f4384812b4742fcb0794e6c8e41a1bdb8cccc4477036aa1d539a978d8b7f48d0d313bb55e5dea469d9b6f8a46783d3f5bd594b72d81cc5477bac0f3bc7772f479ee971c88e8d97dc7571af3fc1fb17ad5454090b658254da42f24391c11a90e32ba6012c262a6a19d98a32dbc956f1507185e8d5c9dee30eee3059271949ea431e2dde2c6e54112464cf388fe6cec210d31e64e5e6930b3cde6977cd575087c423ce0be41fbff1085e30f7239dec3e5eaec66adbbff2a4fe711b27e233237779b9122c1d7173636020eac05c39a4d46d2386a681c0ccb791dcf6c00cc693200b497a93b3f4e5c83423110aca11ad6e454019c8f536b09a89f78cba27ab70b45d103e0c7c9fbbaac6c43bc57c2c506dd80f7a9742dd14a680dae0d6284eb52be36fd0089d76f0dcc80530aeacd5a6b7f91a20ad82d5d769f75373f79311a37eca2d0497cfbfc8278a5b1bcdfc9d1bb8ea58590c3352da5e694c62d6dfe58845d4b0777b2003f94a3fede57dfcc47bdd5c17980629c856bb0234ab8480ec34ac585bd0c847d8db131cf694097faf87e48a4e121614788c86b70f7c655985055877272723984b4668e5178ace4384808f1f8dddf78d6e36c6159974d813b426af6ea3e53db16c5582304aab94e8523d244230516c62ef49e183e4a8c956b77d50a82b9dfb7d1a8b20f0d66b944d4226897c1cf3b61a110ce17fce1c0b8d0100ad034c47175fa3568a90118ad5316d8001540067a1c90f02f100375c2db2f0b29239ad90c82dcd64d59ef34ba57eeda8b013338aa373700926355d4d82a9c31903ec99d78c7023d6e80d111e1c343bcb17a7271c6d00a5dc2a4b852424a5a7632cbd12907bb0b782a5660e232bbae9f163c2a184ceeb56be169dda8562f96c0d4cb07fd2edfbf86cc084b92d4fec14c03a69a1a743a054ae229ec905cfd0e6cecf8373cfda94a210590c38beac2754aca2bccb2032892aa010abe76b2c8f5e2563bab59f0a2da7d8509fafcc50916ab58720f48ccb07805f64707093c2ae223c8042601e8ddac6f06e56532d28a025899e33b68073e21015c7ff6a5e38eb9dd9eaad4a18d7c5ca02154fa0b53f99693f6f5bc9b712c75258450bab496d1854e4f9ca763c75233c726311faf7b86767d51fb5c0541298fa84f6a285c3587c021db3f99dd73ea869384d594658179447216e440652dcc330be50ef99db45b7a4f01837e52398fccc4092ee774a904106054b3c37a9e358c55e038046e45b7a7015d4d3a2ba1245ec33862bce79324890240666d12d55b3c3526413f8a0b0618f838a677e3966f3788c287dba86f26cecafa927dc7ff33d7ef089956f0f9e91bf9a7153344650467264e00e915557e0fb2b718b42cbb8c27462da954b245d4cc6171dd2f1bcc493d2a37c6b048a13623616c6ce548622f6574db77dc2b886bda57e00b56ada28cf28790aef8a2891cd7c2ce9787b41a6460c9027aeb478d8f3c0189e033107788f2ce4989fa73021bf4579373a2bd29f546d2df657bab44e7fe4c87d4b53bbd12d241b85dd1e2a00aa929b99d0fd43f14fb54ab80b6551e518a4f434ba9b1db28019cb4e726a7f1ca337b644289f86eca7ffbd50ca4aa50d90f3984ef8ccffd7b0bd9aecf6cbec5349133039185e563d925f1268e37951230551a400904e6d9d799aab6f752214e4fc3ca73aa183db4a1ccf92c7ad91df3c99c0195ccbb85830bab0145687c89aca8883236d22e7f331b7049902ca94045ec3fe47dbf15e20c7a12f34e793b28b00620d0070bf7a456d2941f5423560d45afa30f59a3a8e3f1ac506a049f02c7eefdb5a482adbe59d53437f4924e24aa6a7efe2efd7af07756f4e2e6d3fc77b150a43b94749828ffc0ef8ee8155193369ee53fbc5bb9748b9bd6654db745984e35463f982fc23cbd79de142fc0ae02b4715ae748d48d3e9d519cb51da8a68b0a4eb5e48044ffe71ade514e86ec6f9bbd78761983180ba5504ba291a62cf4bb1f30c6566134e0f4cef98c235b44d72ca14686556c729c6ef8d0e96ca9c6bbf4b90e57a36bff816f31b20de37eb9b095067cc99ec44df1fd51cd8166d62714ef83220329f1b4584659ba10608c394ad6c14053a9e57f70fdcfa391dea8ac4d133c64cfee804aebd1eb3e48b038358e04472fc9ff59767eef8e148d5a57a730ccc53314799da1d76aa817c89b58045b8ffbb00af75cbab5f1235e3d5b86f57c647a297a31b547b2a7ab037e3a0f8f27afbc851d05ac72a4b4f549fd1ac5aec699346dc146ab294101d6ba004b41c4937120b9109e1fa38670df496b66a4ddb9518cd1481db5df5b425801b265b79794ed199a8ab66e6078105ea3d01f970fe6e39dd96cceacf6bbc9cf469174700ca8a000072e12de35ea1bb1e0cccedbb816b9cdabefb00e098171ad0dcb3e17297d11120a99a6e6b7a8324a59b4a99866df5786d1b0450306d6ea6b1b4d7d3be2ccbe3f5d313caee0412844d4c5e90f5ba6099cf5d286ac77045560a8c9830536e4e2266cbae92f894fd2abc3d7f3673088af5297f29373048ebba430e18687d1804ebf8ed0150f695d5deeb4c3cae1c180e43ba3383c2e2fe935243ece87ebb29ebca966695faf745c94b32616728989cb5060c3a5ee0cb76a480ac7de1d6fe805d3dee410d1a04ed225f3830b6b50e0c75b5f1e6eb421cc62e04614815ff9f30163bc0bcf761a2fcfd3994de49838b40e453ebed51f2b068978d14e31b935e9a21d828218292a666b4664a5acdf2cb6a4f6d54646c642a172a79490f5fb8f8abbcb2a289237849c481fc249c2e9e6bdb5885fc7ef19ebe69ec2109ba73a9607019dcffdeb335e0eac27350eacf3aa309eecef06b393718ed50f21d1f8212ee788484f234b3ef949e5fd264a15724ac02b9df17d0f26e8b0f98085b8a656ac17c68e2c1c35b7e16501e0892596b7ae9cc10470c3b8c1ca67b0b717fe144f042b9742258f4d1ebb9f2cb8d9b61c763339c6da207855e9aa9b4648d2fbd74ea7188d137f29c3ff648ba7f85c982235c49fb4ca06f35dad7378b97b3cbc1f6370ab70c30c6916cb6fd6be853e836f075575577b8d363c85bdccd77bd71788f3275f63cbcb5cc38291cfba7ec2cf69f668fc82d78a43c9c3526c67410165f0eea4c027c5b0e5e5666ac81151f100f79ad848dc489c73454817e0dea12074af7a807babce22ea7e5d7a64f6fc66e1bb3f497deb9f763ccb972a19d77b6ec7821d0052d09ef31d1892c85baa86f0ee9fd4da44a056f43ed359487bba930af1882d9bc8d13da78a24f5dd90e343da39623ebc8c6e4c60dc"}}}, 0x1016) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="000086dd00011100"], 0xfdef) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181000b00000000010000000000000e000a000f000000028002002d1f", 0x2e}], 0x1}, 0x0) 1.559905483s ago: executing program 3 (id=3201): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)=""/206, 0xce}], 0x1}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c0300001a"], 0x34c}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c00000040000701feffffff00000000017c0000040042800c00018006000600800a0000180002801200148004000b0004"], 0x3c}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c00000002090500000000000000000000000001180002001400018008000100ffffffff08000200ac1414aac37a333eb38dc23dbb029546d7ed52119093dc5ad979225536cc6325610279d54f8e0189826c4e7eed259482a380e70c0000000000000056183634a3a57dd2308b6165923126f074"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x20010000) bind$nfc_llcp(r3, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x3, 0x0, 0xa, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000b40)={0x34, 0x40, 0x1, 0xfffffffe, 0x25dfdbff, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x17, 0x0, 0x1, [@typed={0x4, 0x1}, @nested={0x4, 0x45}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0x800c000) sendmsg(r4, &(0x7f0000000440)={&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x6, @dev={0xfe, 0x80, '\x00', 0x10}, 0xe}, 0x12, &(0x7f0000000200)=[{&(0x7f0000000140)="9b", 0x1}], 0x1}, 0x8004) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000020000000643d600000000009520000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x48, '\x00', 0x0, 0x38}, 0x94) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f00000001c0)=0x1, 0x4) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) 1.216418174s ago: executing program 3 (id=3202): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) ioctl$F2FS_IOC_SEC_TRIM_FILE(r0, 0x4018f514, &(0x7f0000000080)={0x6, 0x7, 0x2}) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r6, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r9], 0x54}}, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000007c0)=@newlink={0x50, 0x10, 0xf11, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x104}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x20, 0x20}}}}}}, @IFLA_MASTER={0x8, 0xa, r11}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r2], 0x3c}}, 0x0) 977.753191ms ago: executing program 2 (id=3203): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000440)={0xffffffffffffffff, &(0x7f0000000340)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x100, &(0x7f0000000380)={@align=0xc, {0x9, 0x7, 0x3, 0xe}}, 0xfffffffa, &(0x7f00000003c0), &(0x7f0000000400)=0x78e}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(r0, 0x1) sendmmsg(r0, &(0x7f000000c680), 0x0, 0x800) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_route(0x10, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r2 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r2, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xea, 0x440, 0x0, 0x32}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000847fff), 0x0, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 900.839423ms ago: executing program 0 (id=3204): r0 = socket$nl_generic(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0xd68210}], 0x1, 0x0, 0x1f00000000000000, 0x200000}, 0x1f00) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r4 = syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/net\x00') sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fbdbdf25ff0700000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32=r4, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 822.677569ms ago: executing program 2 (id=3205): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a0200000000001801ffb02020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) 779.181995ms ago: executing program 4 (id=3206): socket(0x2a, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) (fail_nth: 13) 648.241759ms ago: executing program 3 (id=3207): socket(0x1, 0x6, 0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x30}], 0x1, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="015904000000fcdbdfdc8566aead587fafb6251a000000"], 0x14}, 0x1, 0x0, 0x0, 0x24000800}, 0x0) socket(0x1, 0x6, 0x3) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket(0x2, 0x80805, 0x0) (async) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@sndrcv={0x30, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x30}], 0x1, 0x0) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r0) (async) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="015904000000fcdbdfdc8566aead587fafb6251a000000"], 0x14}, 0x1, 0x0, 0x0, 0x24000800}, 0x0) (async) 646.886134ms ago: executing program 2 (id=3208): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000210000000a00000000000000", @ANYRES32, @ANYBLOB="00000000001a00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={r0, &(0x7f0000000780)}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2, 0x0, 0x0, 0x41000, 0x9}, 0x94) getsockname$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000002e00090027bd7000fedbdf250400000008001a80040005"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) (async, rerun: 64) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000080)={0x84, @private=0xa010101, 0x15, 0x3, 'sh\x00', 0x2e, 0x5, 0x72}, 0x2c) (async) gettid() (async) r3 = socket$kcm(0xa, 0x2, 0x0) (async) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r5) sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000780)={0x0, 0xb4, &(0x7f0000000440)={&(0x7f0000000b40)=ANY=[@ANYBLOB="14020000", @ANYRES16=r6, @ANYBLOB="01002bbd7000fbdbdf250100000008000100010000000c000480050003000500000008000200010000000400088008000100ffffffff24000c8004000b801c000b80080009004caadf0908000a00ee65000008000a0060640000a8000c801c000b8008000900b4"], 0x214}, 0x1, 0x0, 0x0, 0x1}, 0x48084) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x88, @rand_addr=0x64000101, 0x4e21, 0x3, 'none\x00', 0x1, 0x8, 0x73}, {@local, 0x4e20, 0x2000, 0xffffffff, 0x2}}, 0x44) (async) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x4000084) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000004c0)=ANY=[@ANYBLOB="4000002cb32a75f8", @ANYRESOCT=r2, @ANYBLOB="0100fdffffff000000001d00000008000300", @ANYRES32=r8, @ANYBLOB="24002f800c000200000000000000000008000100000000000c0003800800010001000000"], 0x40}}, 0x4000040) (async, rerun: 32) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f00000000c0)=ANY=[@ANYRES32=r4, @ANYBLOB="040000000400a00e72f39fa6c3c8a5028f4f171aace4415a479fc7053c790ff33904b0938b55d9cc9c15da5d53563985daf9bf65497029cd33486e1d7beb308ace006eed114da0bfb1905c8deba76beaee647283d8"]) (async, rerun: 32) sendmsg$sock(r3, &(0x7f0000000140)={&(0x7f0000000580)=@in6={0x2, 0x4f23, 0x40, @private0={0xfc, 0x0, '\x00', 0x1}, 0xfffffffc}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe8000000000"], 0xfdef) 92.164438ms ago: executing program 3 (id=3209): r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)={0x28, 0x1, 0x4, 0x101, 0x0, 0x0, {0xd70047835c43181d}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x6}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8414}, 0x4) bind$unix(r0, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0xdf7) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) r2 = accept4(r0, 0x0, 0x0, 0x80800) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, 0xffffffffffffffff, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f00000003c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000f00)={0x0, @in={{0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x0, 0xea}, 0x90) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x1, @local}, 0x10) connect$inet(r5, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x600, 0x0, 0x48815, 0x40103}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000c80)=ANY=[@ANYBLOB="30000000400007012bbd700000000000047c0000100042800c00070006002000000000000c0001800600060080"], 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc020) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000001010000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000500000000000000000000000000000005000000000000000000000000000000050000000000000000000000000000000000000000000000000800000000000000000000000000000002000000000000010001000000000084010500fc01000000000000000000000000000100000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c00000002000000fe80000000000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000ac14144300000000000000000000000000000000330000000200000000000000000000000000ffffac1414aa000000000000000000000000000000000000000020010000000000000000000000000000000004d26c000000000000000000000000000000000000090000000100000000000000000c000000000000008f700000ac1e0101000000000000000000000000000004d23c00000000000000e00000020000000000000000000000000000000002000100"/500], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$isdn(0x22, 0x2, 0x24) close(r8) r9 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) connect$inet(r9, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x400, 0x4) r10 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r10, 0x29, 0x40, &(0x7f0000000dc0)=@mangle={'mangle\x00', 0x2, 0x6, 0x758, 0x190, 0x360, 0x450, 0x0, 0x0, 0x688, 0x688, 0x688, 0x688, 0x688, 0x6, 0x0, {[{{@ipv6={@mcast1, @empty, [], [], 'bond_slave_0\x00', 'vlan1\x00', {}, {0xff}, 0x21}, 0x0, 0x168, 0x190, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x32, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [], [0x0, 0xffffffff], [0x0, 0x0, 0x0, 0xffffffff], 0x4000, 0x50}}, @common=@inet=@dccp={{0x30}, {[0x4e24, 0x4e24], [0x4e23, 0x4e24], 0xd, 0x0, 0x4, 0x7}}]}, @HL={0x28}}, {{@ipv6={@mcast2, @dev={0xfe, 0x80, '\x00', 0x2}, [], [0x0, 0x0, 0x8000007f], 'bridge0\x00', 'veth1_vlan\x00', {}, {}, 0x0, 0x3}, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{}, {}, {0x0, 0xfd}, 0x300, 0x4}}}, {{@ipv6={@ipv4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0x0, 0x0, 0x0, 0xff], [], 'bridge0\x00', 'bond_slave_0\x00', {0xff}}, 0x0, 0xa8, 0xf0, 0x48000000}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@loopback, @ipv6=@loopback, 0x5, 0xc}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private1, 0x0, 0x37}}}, {{@uncond, 0x0, 0x210, 0x238, 0x0, {}, [@common=@ah={{0x30}, {[0x4d3, 0x4d3], 0x1, 0x9, 0x3}}, @common=@rt={{0x138}, {0x0, [0x0, 0xc], 0x0, 0x0, 0x1, [@empty, @private2={0xfc, 0x2, '\x00', 0x1}, @private0, @empty, @remote, @empty, @mcast2, @mcast2, @private0, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @remote, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @private0]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x7b8) 0s ago: executing program 4 (id=3210): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_BYTEORDER_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x55}, 0x0) recvmmsg(r0, &(0x7f0000003200)=[{{&(0x7f0000000140)=@nfc_llcp, 0x80, &(0x7f0000001580)=[{&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/234, 0xea}, {&(0x7f00000014c0)=""/93, 0x5d}, {&(0x7f0000001540)=""/14, 0xe}], 0x4, &(0x7f00000015c0)=""/4096, 0x1000}, 0x200}, {{&(0x7f00000025c0)=@isdn, 0x80, &(0x7f0000002d00)=[{&(0x7f0000002640)=""/146, 0x92}, {&(0x7f0000002700)=""/139, 0x8b}, {&(0x7f00000027c0)=""/23, 0x17}, {&(0x7f0000002800)=""/116, 0x74}, {&(0x7f0000002880)=""/142, 0x8e}, {&(0x7f0000002940)=""/75, 0x4b}, {&(0x7f00000029c0)=""/217, 0xd9}, {&(0x7f0000002ac0)=""/249, 0xf9}, {&(0x7f0000002bc0)=""/54, 0x36}, {&(0x7f0000002c00)=""/240, 0xf0}], 0xa}, 0xffffffff}, {{&(0x7f0000002dc0)=@alg, 0x80, &(0x7f0000002ec0)=[{&(0x7f0000002e40)=""/65, 0x41}], 0x1, &(0x7f0000002f00)=""/4, 0x4}}, {{&(0x7f0000002f40)=@ethernet, 0x80, &(0x7f0000003140)=[{&(0x7f0000002fc0)=""/3, 0x3}, {&(0x7f0000003000)=""/107, 0x6b}, {&(0x7f0000003080)=""/74, 0x4a}, {&(0x7f0000003100)=""/17, 0x11}], 0x4, &(0x7f0000003180)=""/103, 0x67}, 0x4}], 0x4, 0x2001, &(0x7f0000003300)={0x77359400}) kernel console output (not intermixed with test programs): tribute type 4 has an invalid length. [ 478.848766][T15366] netlink: 'syz.4.2414': attribute type 5 has an invalid length. [ 478.935806][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ff8a400: abort rx timeout. Force session deactivation [ 479.497149][T15408] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 479.505011][T15408] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 479.515474][T15408] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 479.523423][T15408] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 481.697546][T15360] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 481.719877][T15393] netlink: 'syz.1.2420': attribute type 11 has an invalid length. [ 481.990219][T15438] __nla_validate_parse: 9 callbacks suppressed [ 481.990241][T15438] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2430'. [ 482.114089][T15446] netlink: 1244 bytes leftover after parsing attributes in process `syz.0.2434'. [ 482.173819][T15443] netlink: 'syz.3.2432': attribute type 7 has an invalid length. [ 482.198972][T15443] netlink: 'syz.3.2432': attribute type 8 has an invalid length. [ 482.217047][T15443] netlink: 'syz.3.2432': attribute type 8 has an invalid length. [ 482.241162][T15443] netlink: 'syz.3.2432': attribute type 4 has an invalid length. [ 482.258760][T15443] netlink: 'syz.3.2432': attribute type 7 has an invalid length. [ 482.270314][T15443] netlink: 207236 bytes leftover after parsing attributes in process `syz.3.2432'. [ 482.653505][T15470] gre0 speed is unknown, defaulting to 1000 [ 482.796818][T15481] netlink: 'syz.3.2441': attribute type 12 has an invalid length. [ 482.829105][T15481] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2441'. [ 482.873257][T15480] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2440'. [ 482.909619][T15489] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 483.032328][T15492] netlink: zone id is out of range [ 483.046242][T15492] netlink: zone id is out of range [ 483.060807][T15492] netlink: zone id is out of range [ 483.074565][T15492] netlink: zone id is out of range [ 483.094860][T15492] netlink: zone id is out of range [ 483.117373][T15492] netlink: zone id is out of range [ 483.137371][T15492] netlink: zone id is out of range [ 483.153016][T15492] netlink: zone id is out of range [ 483.166879][T15497] netlink: 'syz.3.2443': attribute type 2 has an invalid length. [ 483.188108][T15492] netlink: zone id is out of range [ 483.193621][ C1] vcan0: j1939_tp_rxtimer: 0xffff888032592c00: rx timeout, send abort [ 483.215954][T15492] netlink: zone id is out of range [ 483.295769][T15497] : entered promiscuous mode [ 483.651948][T15520] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2449'. [ 483.701939][ C1] vcan0: j1939_tp_rxtimer: 0xffff888032592c00: abort rx timeout. Force session deactivation [ 483.981538][T15520] bond7: entered promiscuous mode [ 483.987076][T15520] 8021q: adding VLAN 0 to HW filter on device bond7 [ 484.146654][T15537] 8021q: adding VLAN 0 to HW filter on device bond7 [ 484.172319][T15537] bond7: (slave sit1): The slave device specified does not support setting the MAC address [ 484.202069][T15537] bond7: (slave sit1): Error -95 calling set_mac_address [ 484.394003][T15540] syzkaller1: entered promiscuous mode [ 484.408709][T15540] syzkaller1: entered allmulticast mode [ 484.769237][T15562] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2458'. [ 484.779516][T15564] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2457'. [ 485.070072][T15577] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2461'. [ 485.311617][T15590] nbd: must specify an index to disconnect [ 485.925878][T15613] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2469'. [ 485.955319][T15615] syzkaller0: entered promiscuous mode [ 486.017559][T15615] syzkaller0: entered allmulticast mode [ 486.757930][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 487.199703][T15650] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2474'. [ 487.264221][T15650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2474'. [ 489.050317][T15659] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.131428][T15659] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.228307][T15659] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.277349][T15666] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2480'. [ 489.333350][T15668] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 489.370721][T15668] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 489.404975][T15659] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 489.464456][T15673] tipc: Enabling of bearer rejected, already enabled [ 489.480776][T15678] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.2482'. [ 489.493175][T15680] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.2482'. [ 489.893987][T15699] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2487'. [ 490.031084][T11035] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.044972][T11035] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.104978][ T6111] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.131839][T15708] netlink: 176 bytes leftover after parsing attributes in process `syz.4.2489'. [ 490.192372][ T6111] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 490.227064][T15712] tipc: Enabling of bearer rejected, already enabled [ 490.254933][T15708] netlink: 13 bytes leftover after parsing attributes in process `syz.4.2489'. [ 490.360421][T15714] tun0: tun_chr_ioctl cmd 1074025675 [ 490.372641][T15714] tun0: persist enabled [ 490.383089][T15714] tun0: tun_chr_ioctl cmd 1074025675 [ 490.391443][T15717] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2493'. [ 490.396282][T15714] tun0: persist enabled [ 490.426208][T15714] tun0: tun_chr_ioctl cmd 3225442367 [ 490.441312][T15714] tun0: tun_chr_ioctl cmd 1074025673 [ 490.447208][T15714] net_ratelimit: 354 callbacks suppressed [ 490.447226][T15714] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0000 with DS=0x6 [ 490.536509][T15719] tipc: Enabling of bearer rejected, already enabled [ 490.579615][T15722] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2495'. [ 490.989856][T15736] macvtap0: entered promiscuous mode [ 490.993054][T15738] validate_nla: 1 callbacks suppressed [ 490.994650][T15738] netlink: 'syz.3.2500': attribute type 5 has an invalid length. [ 491.012378][T15736] team0: entered promiscuous mode [ 491.017890][T15736] team_slave_0: entered promiscuous mode [ 491.024044][T15736] team_slave_1: entered promiscuous mode [ 491.039759][T15736] macvtap0: entered allmulticast mode [ 491.053795][T15736] team0: entered allmulticast mode [ 491.059239][T15736] team_slave_0: entered allmulticast mode [ 491.073412][T15736] team_slave_1: entered allmulticast mode [ 491.080322][T15736] 8021q: adding VLAN 0 to HW filter on device macvtap0 [ 491.786011][T15752] pim6reg: entered allmulticast mode [ 491.856894][T15752] pim6reg: left allmulticast mode [ 492.480354][T15781] dvmrp0: entered allmulticast mode [ 492.605189][T15778] netlink: 'syz.2.2511': attribute type 1 has an invalid length. [ 492.790315][T15778] 8021q: adding VLAN 0 to HW filter on device bond8 [ 493.164073][T15803] __nla_validate_parse: 6 callbacks suppressed [ 493.164093][T15803] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2513'. [ 493.488773][T15818] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2520'. [ 493.545790][T15813] dvmrp1: entered allmulticast mode [ 493.655011][T15826] netlink: 'syz.4.2521': attribute type 1 has an invalid length. [ 493.663569][T15826] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2521'. [ 493.747118][T15833] netlink: 'syz.1.2522': attribute type 13 has an invalid length. [ 493.770787][T15832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2523'. [ 493.788697][T15833] netlink: 'syz.1.2522': attribute type 17 has an invalid length. [ 493.806180][T15826] xt_CT: No such helper "netbios-ns" [ 493.856631][T15835] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2523'. [ 493.924227][ T5835] block nbd0: Receive control failed (result -32) [ 494.036112][T15840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2522'. [ 494.436498][T15828] team0: left allmulticast mode [ 494.448241][T15828] team_slave_0: left allmulticast mode [ 494.453890][T15828] team_slave_1: left allmulticast mode [ 494.461170][T15828] team0: left promiscuous mode [ 494.466071][T15828] team_slave_0: left promiscuous mode [ 494.472937][T15828] team_slave_1: left promiscuous mode [ 494.529227][ T7698] gre0 speed is unknown, defaulting to 1000 [ 494.540574][ T7698] syz1: Port: 1 Link DOWN [ 494.589427][T15833] 8021q: adding VLAN 0 to HW filter on device team0 [ 494.600683][T15833] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 494.620068][ T7698] gre0 speed is unknown, defaulting to 1000 [ 494.628681][T15843] tipc: New replicast peer: 255.255.255.255 [ 494.647445][T15843] tipc: Enabled bearer , priority 10 [ 494.654520][ T7696] gre0 speed is unknown, defaulting to 1000 [ 494.660893][T11035] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 494.697350][ T7696] syz1: Port: 1 Link ACTIVE [ 494.844820][T15861] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2529'. [ 494.955096][T15871] gre0 speed is unknown, defaulting to 1000 [ 495.164004][T15879] netlink: 'syz.2.2534': attribute type 1 has an invalid length. [ 495.192249][T15879] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2534'. [ 495.470434][T15890] netlink: 'syz.2.2536': attribute type 1 has an invalid length. [ 495.559204][T15890] 8021q: adding VLAN 0 to HW filter on device bond9 [ 495.609117][T15893] veth13: entered promiscuous mode [ 496.235230][T15906] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2540'. [ 496.561723][T15915] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2543'. [ 497.597647][T15943] netlink: 'syz.1.2553': attribute type 10 has an invalid length. [ 498.122359][T15963] gre0 speed is unknown, defaulting to 1000 [ 498.437804][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 498.652335][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807aebe800: rx timeout, send abort [ 499.160754][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807aebe800: abort rx timeout. Force session deactivation [ 499.299273][T15987] __nla_validate_parse: 1 callbacks suppressed [ 499.299291][T15987] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2562'. [ 499.316890][T15990] veth1_to_bond: entered allmulticast mode [ 499.334706][T15990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2563'. [ 499.353632][T15987] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2562'. [ 499.377469][T15990] veth1_to_bond (unregistering): left allmulticast mode [ 499.846963][T16010] netlink: 'syz.4.2568': attribute type 6 has an invalid length. [ 499.890279][T16010] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 500.226286][T16029] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2571'. [ 500.257475][T16019] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2571'. [ 500.432684][T16037] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2576'. [ 500.456434][T16037] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2576'. [ 500.990177][T16069] netlink: 'syz.3.2585': attribute type 6 has an invalid length. [ 501.109016][T16073] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2586'. [ 501.134138][T16071] gre0 speed is unknown, defaulting to 1000 [ 501.296408][T16081] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2589'. [ 501.323186][T16081] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2589'. [ 501.362593][T16080] veth1_: renamed from macsec0 [ 501.831853][T16077] gre0 speed is unknown, defaulting to 1000 [ 502.107130][T16102] FAULT_INJECTION: forcing a failure. [ 502.107130][T16102] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 502.165519][T16102] CPU: 1 UID: 0 PID: 16102 Comm: syz.1.2594 Not tainted syzkaller #0 PREEMPT(full) [ 502.165561][T16102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 502.165576][T16102] Call Trace: [ 502.165586][T16102] [ 502.165595][T16102] dump_stack_lvl+0xe8/0x150 [ 502.165633][T16102] should_fail_ex+0x412/0x560 [ 502.165670][T16102] _copy_from_user+0x2d/0xb0 [ 502.165694][T16102] get_user_ifreq+0x6b/0x180 [ 502.165720][T16102] sock_ioctl+0x704/0x7f0 [ 502.165746][T16102] ? __pfx_sock_ioctl+0x10/0x10 [ 502.165772][T16102] ? __fget_files+0x3a0/0x420 [ 502.165800][T16102] ? __fget_files+0x2a/0x420 [ 502.165831][T16102] ? bpf_lsm_file_ioctl+0x9/0x20 [ 502.165854][T16102] ? __pfx_sock_ioctl+0x10/0x10 [ 502.165878][T16102] __se_sys_ioctl+0xfc/0x170 [ 502.165899][T16102] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.165923][T16102] do_syscall_64+0x15f/0xf80 [ 502.165949][T16102] ? trace_irq_disable+0x3b/0x140 [ 502.165973][T16102] ? clear_bhb_loop+0x40/0x90 [ 502.166000][T16102] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 502.166033][T16102] RIP: 0033:0x7f7e6a79c819 [ 502.166053][T16102] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 502.166072][T16102] RSP: 002b:00007f7e6b719028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 502.166097][T16102] RAX: ffffffffffffffda RBX: 00007f7e6aa15fa0 RCX: 00007f7e6a79c819 [ 502.166113][T16102] RDX: 0000200000000100 RSI: 00000000000089f1 RDI: 0000000000000004 [ 502.166128][T16102] RBP: 00007f7e6b719090 R08: 0000000000000000 R09: 0000000000000000 [ 502.166140][T16102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 502.166153][T16102] R13: 00007f7e6aa16038 R14: 00007f7e6aa15fa0 R15: 00007ffdfdae0688 [ 502.166189][T16102] [ 503.278739][T16143] netlink: 'syz.1.2601': attribute type 9 has an invalid length. [ 503.300065][T16143] netlink: 'syz.1.2601': attribute type 7 has an invalid length. [ 503.309691][T16143] netlink: 'syz.1.2601': attribute type 8 has an invalid length. [ 503.619601][T16153] syzkaller0: entered promiscuous mode [ 503.633489][T16153] syzkaller0: entered allmulticast mode [ 503.643932][T16157] tipc: Bearer : already 2 bearers with priority 10 [ 503.651694][T16157] tipc: Bearer : trying with adjusted priority [ 503.659239][T16157] tipc: Enabling of bearer rejected, failed to enable media [ 503.815749][T16160] gre0 speed is unknown, defaulting to 1000 [ 503.964719][T16167] tap0: tun_chr_ioctl cmd 1074025677 [ 503.970659][T16167] tap0: linktype set to 6 [ 503.976735][T16167] tap0: tun_chr_ioctl cmd 1074025673 [ 503.988309][T16169] tap0: tun_chr_ioctl cmd 1074025677 [ 503.996956][T16169] tap0: linktype set to 6 [ 504.104896][T16172] netlink: 'syz.0.2608': attribute type 4 has an invalid length. [ 504.154874][T16172] netlink: 'syz.0.2608': attribute type 4 has an invalid length. [ 504.677848][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 504.699972][T16199] __nla_validate_parse: 5 callbacks suppressed [ 504.699991][T16199] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2614'. [ 504.749992][T16198] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2613'. [ 504.762619][T16199] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2614'. [ 504.781130][T16198] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2613'. [ 504.793420][T16199] netlink: 'syz.4.2614': attribute type 18 has an invalid length. [ 504.805248][T16201] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2616'. [ 506.224119][T16248] netlink: 27 bytes leftover after parsing attributes in process `syz.0.2627'. [ 506.329421][T16253] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2629'. [ 506.348800][T16253] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2629'. [ 506.378735][T16254] netlink: 'syz.2.2628': attribute type 10 has an invalid length. [ 506.387904][T16254] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2628'. [ 506.598089][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 506.748641][T16246] syzkaller1: entered promiscuous mode [ 506.754516][T16246] syzkaller1: entered allmulticast mode [ 506.775786][T16254] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 506.818313][T16261] FAULT_INJECTION: forcing a failure. [ 506.818313][T16261] name failslab, interval 1, probability 0, space 0, times 0 [ 506.889466][T16261] CPU: 0 UID: 0 PID: 16261 Comm: syz.3.2630 Not tainted syzkaller #0 PREEMPT(full) [ 506.889496][T16261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 506.889509][T16261] Call Trace: [ 506.889518][T16261] [ 506.889527][T16261] dump_stack_lvl+0xe8/0x150 [ 506.889566][T16261] should_fail_ex+0x412/0x560 [ 506.889599][T16261] ? __d_alloc+0x37/0x6f0 [ 506.889629][T16261] should_failslab+0xa8/0x100 [ 506.889655][T16261] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 506.889697][T16261] __d_alloc+0x37/0x6f0 [ 506.889734][T16261] d_alloc+0x4b/0x190 [ 506.889760][T16261] ? lookup_one_qstr_excl+0xc4/0x360 [ 506.889795][T16261] lookup_one_qstr_excl+0xd8/0x360 [ 506.889825][T16261] ? lookup_noperm_common+0x245/0x430 [ 506.889858][T16261] start_dirop+0x5c/0x90 [ 506.889886][T16261] simple_start_creating+0xcc/0x110 [ 506.889918][T16261] ? __pfx_simple_start_creating+0x10/0x10 [ 506.889949][T16261] ? do_raw_spin_unlock+0xf5/0x210 [ 506.889973][T16261] ? mntput+0x65/0xc0 [ 506.890000][T16261] debugfs_start_creating+0xdb/0x1a0 [ 506.890028][T16261] __debugfs_create_file+0x6f/0x400 [ 506.890057][T16261] debugfs_create_file_full+0x3f/0x60 [ 506.890086][T16261] ref_tracker_dir_debugfs+0x197/0x360 [ 506.890119][T16261] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 506.890182][T16261] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 506.890204][T16261] ? alloc_netdev_mqs+0xa6/0x11b0 [ 506.890231][T16261] ? __raw_spin_lock_init+0x45/0x100 [ 506.890257][T16261] alloc_netdev_mqs+0x272/0x11b0 [ 506.890278][T16261] ? __pfx_ip6_tnl_dev_setup+0x10/0x10 [ 506.890308][T16261] ip6_tnl_locate+0x686/0x850 [ 506.890345][T16261] ? __pfx_ip6_tnl_locate+0x10/0x10 [ 506.890376][T16261] ? ip6_tnl_siocdevprivate+0x5ff/0xad0 [ 506.890411][T16261] ip6_tnl_siocdevprivate+0x62f/0xad0 [ 506.890442][T16261] ? __pfx_ip6_tnl_siocdevprivate+0x10/0x10 [ 506.890491][T16261] ? full_name_hash+0x92/0xe0 [ 506.890526][T16261] dev_ifsioc+0xba6/0x1280 [ 506.890565][T16261] dev_ioctl+0x84c/0x1150 [ 506.890598][T16261] sock_ioctl+0x75f/0x7f0 [ 506.890630][T16261] ? __pfx_sock_ioctl+0x10/0x10 [ 506.890657][T16261] ? __fget_files+0x3a0/0x420 [ 506.890683][T16261] ? __fget_files+0x2a/0x420 [ 506.890715][T16261] ? bpf_lsm_file_ioctl+0x9/0x20 [ 506.890738][T16261] ? __pfx_sock_ioctl+0x10/0x10 [ 506.890761][T16261] __se_sys_ioctl+0xfc/0x170 [ 506.890782][T16261] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.890806][T16261] do_syscall_64+0x15f/0xf80 [ 506.890832][T16261] ? trace_irq_disable+0x3b/0x140 [ 506.890855][T16261] ? clear_bhb_loop+0x40/0x90 [ 506.890883][T16261] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.890904][T16261] RIP: 0033:0x7fe18f19c819 [ 506.890924][T16261] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 506.890942][T16261] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 506.890967][T16261] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 506.890983][T16261] RDX: 0000200000000100 RSI: 00000000000089f1 RDI: 0000000000000004 [ 506.890997][T16261] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 506.891011][T16261] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.891024][T16261] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 506.891060][T16261] [ 507.285278][T16270] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2633'. [ 507.464010][T16271] gre0 speed is unknown, defaulting to 1000 [ 508.296519][T16310] gre0 speed is unknown, defaulting to 1000 [ 508.404316][T16315] FAULT_INJECTION: forcing a failure. [ 508.404316][T16315] name failslab, interval 1, probability 0, space 0, times 0 [ 508.431956][T16315] CPU: 1 UID: 0 PID: 16315 Comm: syz.0.2644 Not tainted syzkaller #0 PREEMPT(full) [ 508.431986][T16315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 508.431999][T16315] Call Trace: [ 508.432008][T16315] [ 508.432017][T16315] dump_stack_lvl+0xe8/0x150 [ 508.432055][T16315] should_fail_ex+0x412/0x560 [ 508.432090][T16315] ? alloc_inode+0x6a/0x1b0 [ 508.432115][T16315] should_failslab+0xa8/0x100 [ 508.432141][T16315] kmem_cache_alloc_lru_noprof+0x87/0x640 [ 508.432172][T16315] ? simple_start_creating+0xcc/0x110 [ 508.432209][T16315] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 508.432233][T16315] alloc_inode+0x6a/0x1b0 [ 508.432261][T16315] new_inode+0x22/0x170 [ 508.432294][T16315] __debugfs_create_file+0xb8/0x400 [ 508.432323][T16315] debugfs_create_file_full+0x3f/0x60 [ 508.432351][T16315] ref_tracker_dir_debugfs+0x197/0x360 [ 508.432385][T16315] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 508.432448][T16315] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 508.432470][T16315] ? alloc_netdev_mqs+0xa6/0x11b0 [ 508.432498][T16315] ? __raw_spin_lock_init+0x45/0x100 [ 508.432526][T16315] alloc_netdev_mqs+0x272/0x11b0 [ 508.432548][T16315] ? __pfx_ip6_tnl_dev_setup+0x10/0x10 [ 508.432577][T16315] ip6_tnl_locate+0x686/0x850 [ 508.432621][T16315] ? __pfx_ip6_tnl_locate+0x10/0x10 [ 508.432647][T16315] ? ip6_tnl_siocdevprivate+0x5ff/0xad0 [ 508.432675][T16315] ip6_tnl_siocdevprivate+0x62f/0xad0 [ 508.432705][T16315] ? __pfx_ip6_tnl_siocdevprivate+0x10/0x10 [ 508.432754][T16315] ? full_name_hash+0x92/0xe0 [ 508.432791][T16315] dev_ifsioc+0xba6/0x1280 [ 508.432829][T16315] dev_ioctl+0x84c/0x1150 [ 508.432863][T16315] sock_ioctl+0x75f/0x7f0 [ 508.432894][T16315] ? __pfx_sock_ioctl+0x10/0x10 [ 508.432921][T16315] ? __fget_files+0x3a0/0x420 [ 508.432948][T16315] ? __fget_files+0x2a/0x420 [ 508.432979][T16315] ? bpf_lsm_file_ioctl+0x9/0x20 [ 508.433003][T16315] ? __pfx_sock_ioctl+0x10/0x10 [ 508.433026][T16315] __se_sys_ioctl+0xfc/0x170 [ 508.433047][T16315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.433071][T16315] do_syscall_64+0x15f/0xf80 [ 508.433096][T16315] ? trace_irq_disable+0x3b/0x140 [ 508.433119][T16315] ? clear_bhb_loop+0x40/0x90 [ 508.433146][T16315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.433168][T16315] RIP: 0033:0x7fbc91b9c819 [ 508.433188][T16315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.433207][T16315] RSP: 002b:00007fbc929c8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 508.433230][T16315] RAX: ffffffffffffffda RBX: 00007fbc91e15fa0 RCX: 00007fbc91b9c819 [ 508.433246][T16315] RDX: 0000200000000100 RSI: 00000000000089f1 RDI: 0000000000000004 [ 508.433261][T16315] RBP: 00007fbc929c8090 R08: 0000000000000000 R09: 0000000000000000 [ 508.433275][T16315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.433288][T16315] R13: 00007fbc91e16038 R14: 00007fbc91e15fa0 R15: 00007fff9783e708 [ 508.433325][T16315] [ 508.435658][T16315] debugfs: out of free dentries, can not create file 'netdev@ffff88805a834620' [ 509.510238][T16341] vlan5: entered allmulticast mode [ 509.532661][T16341] bridge0: port 2(vlan5) entered blocking state [ 509.546237][T16341] bridge0: port 2(vlan5) entered disabled state [ 509.555131][T16341] vlan5: entered promiscuous mode [ 509.567884][ T7696] gre0 speed is unknown, defaulting to 1000 [ 509.577690][ T7696] syz1: Port: 1 Link DOWN [ 509.595394][ T7696] gre0 speed is unknown, defaulting to 1000 [ 510.048165][T16344] __nla_validate_parse: 6 callbacks suppressed [ 510.048189][T16344] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2651'. [ 510.737143][T16291] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 510.927113][T16351] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2654'. [ 510.971223][T16351] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2654'. [ 510.988627][T16358] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2655'. [ 511.000268][T16356] tipc: Bearer : already 2 bearers with priority 10 [ 511.021184][T16356] tipc: Bearer : trying with adjusted priority [ 511.035605][T16356] tipc: Enabling of bearer rejected, failed to enable media [ 511.047178][T16358] netlink: 148 bytes leftover after parsing attributes in process `syz.3.2655'. [ 511.063007][T16358] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 511.103999][T16355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2652'. [ 511.151281][T16365] xt_CT: You must specify a L4 protocol and not use inversions on it [ 511.178432][T16359] gre0 speed is unknown, defaulting to 1000 [ 511.221817][T16361] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2656'. [ 511.257177][T16361] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2656'. [ 511.274556][T16369] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2657'. [ 511.290791][T16370] FAULT_INJECTION: forcing a failure. [ 511.290791][T16370] name failslab, interval 1, probability 0, space 0, times 0 [ 511.334841][T16370] CPU: 0 UID: 0 PID: 16370 Comm: syz.2.2658 Not tainted syzkaller #0 PREEMPT(full) [ 511.334871][T16370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 511.334885][T16370] Call Trace: [ 511.334894][T16370] [ 511.334904][T16370] dump_stack_lvl+0xe8/0x150 [ 511.334942][T16370] should_fail_ex+0x412/0x560 [ 511.334979][T16370] should_failslab+0xa8/0x100 [ 511.335002][T16370] ? security_inode_alloc+0x39/0x310 [ 511.335033][T16370] kmem_cache_alloc_noprof+0x87/0x650 [ 511.335075][T16370] security_inode_alloc+0x39/0x310 [ 511.335107][T16370] inode_init_always_gfp+0x9c8/0xda0 [ 511.335136][T16370] ? __pfx_debugfs_alloc_inode+0x10/0x10 [ 511.335161][T16370] alloc_inode+0x82/0x1b0 [ 511.335193][T16370] new_inode+0x22/0x170 [ 511.335225][T16370] __debugfs_create_file+0xb8/0x400 [ 511.335254][T16370] debugfs_create_file_full+0x3f/0x60 [ 511.335283][T16370] ref_tracker_dir_debugfs+0x197/0x360 [ 511.335317][T16370] ? __pfx_ref_tracker_dir_debugfs+0x10/0x10 [ 511.335388][T16370] ? __kvmalloc_node_noprof+0x545/0x8a0 [ 511.335409][T16370] ? alloc_netdev_mqs+0xa6/0x11b0 [ 511.335437][T16370] ? __raw_spin_lock_init+0x45/0x100 [ 511.335464][T16370] alloc_netdev_mqs+0x272/0x11b0 [ 511.335487][T16370] ? __pfx_ip6_tnl_dev_setup+0x10/0x10 [ 511.335516][T16370] ip6_tnl_locate+0x686/0x850 [ 511.335554][T16370] ? __pfx_ip6_tnl_locate+0x10/0x10 [ 511.335580][T16370] ? ip6_tnl_siocdevprivate+0x5ff/0xad0 [ 511.335609][T16370] ip6_tnl_siocdevprivate+0x62f/0xad0 [ 511.335640][T16370] ? __pfx_ip6_tnl_siocdevprivate+0x10/0x10 [ 511.335689][T16370] ? full_name_hash+0x92/0xe0 [ 511.335725][T16370] dev_ifsioc+0xba6/0x1280 [ 511.335764][T16370] dev_ioctl+0x84c/0x1150 [ 511.335797][T16370] sock_ioctl+0x75f/0x7f0 [ 511.335825][T16370] ? __pfx_sock_ioctl+0x10/0x10 [ 511.335851][T16370] ? __fget_files+0x3a0/0x420 [ 511.335878][T16370] ? __fget_files+0x2a/0x420 [ 511.335909][T16370] ? bpf_lsm_file_ioctl+0x9/0x20 [ 511.335932][T16370] ? __pfx_sock_ioctl+0x10/0x10 [ 511.335956][T16370] __se_sys_ioctl+0xfc/0x170 [ 511.335976][T16370] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.336000][T16370] do_syscall_64+0x15f/0xf80 [ 511.336027][T16370] ? trace_irq_disable+0x3b/0x140 [ 511.336049][T16370] ? clear_bhb_loop+0x40/0x90 [ 511.336077][T16370] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.336099][T16370] RIP: 0033:0x7f5b5a59c819 [ 511.336120][T16370] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.336139][T16370] RSP: 002b:00007f5b5b42c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 511.336163][T16370] RAX: ffffffffffffffda RBX: 00007f5b5a815fa0 RCX: 00007f5b5a59c819 [ 511.336179][T16370] RDX: 0000200000000100 RSI: 00000000000089f1 RDI: 0000000000000004 [ 511.336193][T16370] RBP: 00007f5b5b42c090 R08: 0000000000000000 R09: 0000000000000000 [ 511.336207][T16370] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.336220][T16370] R13: 00007f5b5a816038 R14: 00007f5b5a815fa0 R15: 00007fff10c15068 [ 511.336257][T16370] [ 511.638875][T16370] debugfs: out of free dentries, can not create file 'netdev@ffff88807a134620' [ 511.734913][T16378] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2661'. [ 512.184561][T16399] netlink: 'syz.1.2666': attribute type 5 has an invalid length. [ 512.877705][T11033] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.889161][T11033] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.910314][T11033] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.942390][T11033] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 512.973981][T16434] tipc: Bearer : already 2 bearers with priority 10 [ 513.013838][T16434] tipc: Bearer : trying with adjusted priority [ 513.050921][T16433] netlink: 'syz.3.2678': attribute type 10 has an invalid length. [ 513.057361][T16434] tipc: Enabling of bearer rejected, failed to enable media [ 513.915173][T16467] gre0 speed is unknown, defaulting to 1000 [ 513.972515][T16470] vlan0: entered allmulticast mode [ 514.007012][T16470] bond0: entered allmulticast mode [ 514.146311][T16484] netlink: 'syz.4.2691': attribute type 7 has an invalid length. [ 514.209639][T16485] ip6tnl5: entered allmulticast mode [ 514.633518][T16508] netlink: 'syz.3.2699': attribute type 22 has an invalid length. [ 514.663601][T16508] bond0: option ad_select: invalid value (16) [ 514.711781][T16499] gre0 speed is unknown, defaulting to 1000 [ 515.438605][T16540] __nla_validate_parse: 20 callbacks suppressed [ 515.438625][T16540] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2709'. [ 515.550996][T16540] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2709'. [ 515.671319][T16540] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2709'. [ 515.834943][T16549] "syz.1.2711" (16549) uses obsolete ecb(arc4) skcipher [ 516.339226][T16568] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2716'. [ 516.854367][T16593] tipc: Invalid UDP bearer configuration [ 516.854426][T16593] tipc: Enabling of bearer rejected, failed to enable media [ 517.302100][T16619] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2724'. [ 517.467245][T16623] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2729'. [ 517.476410][T16618] gre0 speed is unknown, defaulting to 1000 [ 517.664017][T16623] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2729'. [ 517.973375][T16623] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2729'. [ 518.186466][T16636] syzkaller1: entered promiscuous mode [ 518.192462][T16636] syzkaller1: entered allmulticast mode [ 518.764450][T16668] netlink: 'syz.1.2738': attribute type 1 has an invalid length. [ 518.791905][T16668] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 519.201665][T16680] netlink: 'syz.3.2743': attribute type 1 has an invalid length. [ 519.226280][T16680] netlink: 244 bytes leftover after parsing attributes in process `syz.3.2743'. [ 519.325312][T16687] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2746'. [ 519.519063][T16696] openvswitch: netlink: Key type 10773 is out of range max 32 [ 519.774033][T16704] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 519.847912][T16714] block nbd2: Unsupported socket: should be TCP or UNIX. [ 519.869339][T16704] batadv0 (unregistering): left promiscuous mode [ 520.031287][T16718] pim6reg1: entered allmulticast mode [ 520.567150][T16751] __nla_validate_parse: 6 callbacks suppressed [ 520.567169][T16751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2759'. [ 520.658301][T16758] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2760'. [ 520.735964][T16758] syzkaller0: entered promiscuous mode [ 520.752667][T16758] syzkaller0: entered allmulticast mode [ 520.993498][T16763] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2761'. [ 521.014868][T16763] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2761'. [ 521.041475][T16772] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2764'. [ 521.441667][T16783] xt_CT: You must specify a L4 protocol and not use inversions on it [ 521.499329][T16786] gre0 speed is unknown, defaulting to 1000 [ 521.628580][T16798] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2771'. [ 521.755072][T16806] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2771'. [ 522.309704][T16821] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2776'. [ 523.385209][T16878] netlink: 'syz.1.2788': attribute type 4 has an invalid length. [ 523.826389][T16885] gre0 speed is unknown, defaulting to 1000 [ 523.981720][T16897] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.281473][T16897] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.467460][T16911] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2796'. [ 524.477341][T16911] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2796'. [ 524.512078][T16897] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.633343][T16897] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.150479][T11033] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.234340][T11035] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.304219][T11035] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.342910][T11035] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.492597][T16935] bond6 (unregistering): Released all slaves [ 525.860299][T16955] __nla_validate_parse: 2 callbacks suppressed [ 525.860318][T16955] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2809'. [ 525.891660][T16960] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2808'. [ 525.929973][T16960] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2808'. [ 526.230960][T16976] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 526.361961][T16980] IPVS: set_ctl: invalid protocol: 43 255.255.255.255:20000 [ 526.399206][T16979] bond10 (unregistering): Released all slaves [ 526.526891][T16988] netlink: 'syz.0.2817': attribute type 2 has an invalid length. [ 526.579384][T16988] !: entered promiscuous mode [ 526.601282][T16991] netlink: 'syz.0.2817': attribute type 2 has an invalid length. [ 526.616740][T16991] !: left promiscuous mode [ 526.659577][T16988] Cannot find add_set index 3 as target [ 526.681203][T16993] netlink: 'syz.2.2819': attribute type 13 has an invalid length. [ 526.838613][T17001] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 526.954118][T17011] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2823'. [ 527.097234][T17016] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2823'. [ 527.128656][T17016] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2823'. [ 527.181266][T17003] netlink: 'syz.0.2823': attribute type 2 has an invalid length. [ 527.226199][T17003] netlink: 'syz.0.2823': attribute type 2 has an invalid length. [ 527.259393][T17003] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2823'. [ 527.366831][T17032] sctp: [Deprecated]: syz.3.2831 (pid 17032) Use of struct sctp_assoc_value in delayed_ack socket option. [ 527.366831][T17032] Use struct sctp_sack_info instead [ 528.371136][T17080] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2843'. [ 528.411688][T17081] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 528.607406][T17092] netlink: 'syz.2.2846': attribute type 6 has an invalid length. [ 528.680442][T17095] tipc: Enabling of bearer rejected, failed to enable media [ 529.139848][T17117] FAULT_INJECTION: forcing a failure. [ 529.139848][T17117] name failslab, interval 1, probability 0, space 0, times 0 [ 529.180857][T17117] CPU: 1 UID: 0 PID: 17117 Comm: syz.3.2852 Not tainted syzkaller #0 PREEMPT(full) [ 529.180888][T17117] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 529.180901][T17117] Call Trace: [ 529.180910][T17117] [ 529.180919][T17117] dump_stack_lvl+0xe8/0x150 [ 529.180955][T17117] should_fail_ex+0x412/0x560 [ 529.180999][T17117] should_failslab+0xa8/0x100 [ 529.181024][T17117] __kmalloc_cache_noprof+0x88/0x660 [ 529.181057][T17117] ? nfnetlink_rcv+0xfdf/0x27b0 [ 529.181092][T17117] nfnetlink_rcv+0xfdf/0x27b0 [ 529.181159][T17117] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 529.181244][T17117] ? netlink_deliver_tap+0x2e/0x1b0 [ 529.181286][T17117] ? netlink_deliver_tap+0x2e/0x1b0 [ 529.181315][T17117] ? netlink_deliver_tap+0x2e/0x1b0 [ 529.181352][T17117] netlink_unicast+0x75c/0x8e0 [ 529.181392][T17117] netlink_sendmsg+0x813/0xb40 [ 529.181433][T17117] ? __pfx_netlink_sendmsg+0x10/0x10 [ 529.181469][T17117] ? aa_sock_msg_perm+0xf1/0x1b0 [ 529.181501][T17117] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 529.181538][T17117] ____sys_sendmsg+0x972/0x9f0 [ 529.181570][T17117] ? __might_fault+0xaf/0x130 [ 529.181605][T17117] ? __pfx_____sys_sendmsg+0x10/0x10 [ 529.181648][T17117] ? import_iovec+0x73/0xa0 [ 529.181675][T17117] ___sys_sendmsg+0x2a5/0x360 [ 529.181705][T17117] ? __lock_acquire+0x6b5/0x2cf0 [ 529.181738][T17117] ? __pfx____sys_sendmsg+0x10/0x10 [ 529.181806][T17117] ? __fget_files+0x2a/0x420 [ 529.181833][T17117] ? __fget_files+0x3a0/0x420 [ 529.181872][T17117] __x64_sys_sendmsg+0x1bd/0x2a0 [ 529.181908][T17117] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 529.181951][T17117] ? __pfx_ksys_write+0x10/0x10 [ 529.182000][T17117] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.182024][T17117] do_syscall_64+0x15f/0xf80 [ 529.182049][T17117] ? trace_irq_disable+0x3b/0x140 [ 529.182071][T17117] ? clear_bhb_loop+0x40/0x90 [ 529.182098][T17117] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 529.182119][T17117] RIP: 0033:0x7fe18f19c819 [ 529.182139][T17117] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 529.182157][T17117] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 529.182181][T17117] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 529.182196][T17117] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 529.182209][T17117] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 529.182222][T17117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 529.182235][T17117] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 529.182270][T17117] [ 529.729810][T17126] netlink: 'syz.1.2855': attribute type 1 has an invalid length. [ 529.762317][T17126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.066008][T17140] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2860'. [ 530.152450][T17143] IPVS: Scheduler module ip_vs_ not found [ 530.229216][T17161] FAULT_INJECTION: forcing a failure. [ 530.229216][T17161] name failslab, interval 1, probability 0, space 0, times 0 [ 530.267279][T17161] CPU: 1 UID: 0 PID: 17161 Comm: syz.2.2864 Not tainted syzkaller #0 PREEMPT(full) [ 530.267310][T17161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 530.267324][T17161] Call Trace: [ 530.267332][T17161] [ 530.267342][T17161] dump_stack_lvl+0xe8/0x150 [ 530.267380][T17161] should_fail_ex+0x412/0x560 [ 530.267419][T17161] should_failslab+0xa8/0x100 [ 530.267444][T17161] __kmalloc_cache_noprof+0x88/0x660 [ 530.267483][T17161] ? nf_tables_newchain+0xf8a/0x2890 [ 530.267513][T17161] nf_tables_newchain+0xf8a/0x2890 [ 530.267556][T17161] ? __pfx_nf_tables_newchain+0x10/0x10 [ 530.267614][T17161] ? nfnl_pernet+0x23/0x240 [ 530.267653][T17161] ? nfnl_pernet+0x23/0x240 [ 530.267691][T17161] ? __nla_parse+0x40/0x60 [ 530.267718][T17161] nfnetlink_rcv+0x123e/0x27b0 [ 530.267787][T17161] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 530.267840][T17161] ? ref_tracker_free+0x693/0x840 [ 530.267906][T17161] ? __netlink_deliver_tap+0x807/0x850 [ 530.267948][T17161] ? netlink_deliver_tap+0x2e/0x1b0 [ 530.267978][T17161] ? netlink_deliver_tap+0x2e/0x1b0 [ 530.268015][T17161] netlink_unicast+0x75c/0x8e0 [ 530.268056][T17161] netlink_sendmsg+0x813/0xb40 [ 530.268098][T17161] ? __pfx_netlink_sendmsg+0x10/0x10 [ 530.268134][T17161] ? aa_sock_msg_perm+0xf1/0x1b0 [ 530.268165][T17161] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 530.268200][T17161] ____sys_sendmsg+0x972/0x9f0 [ 530.268233][T17161] ? __might_fault+0xaf/0x130 [ 530.268269][T17161] ? __pfx_____sys_sendmsg+0x10/0x10 [ 530.268313][T17161] ? import_iovec+0x73/0xa0 [ 530.268339][T17161] ___sys_sendmsg+0x2a5/0x360 [ 530.268371][T17161] ? __lock_acquire+0x6b5/0x2cf0 [ 530.268404][T17161] ? __pfx____sys_sendmsg+0x10/0x10 [ 530.268479][T17161] ? __fget_files+0x2a/0x420 [ 530.268506][T17161] ? __fget_files+0x3a0/0x420 [ 530.268544][T17161] __x64_sys_sendmsg+0x1bd/0x2a0 [ 530.268581][T17161] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 530.268625][T17161] ? __pfx_ksys_write+0x10/0x10 [ 530.268676][T17161] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.268700][T17161] do_syscall_64+0x15f/0xf80 [ 530.268725][T17161] ? trace_irq_disable+0x3b/0x140 [ 530.268749][T17161] ? clear_bhb_loop+0x40/0x90 [ 530.268774][T17161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 530.268795][T17161] RIP: 0033:0x7f5b5a59c819 [ 530.268816][T17161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 530.268835][T17161] RSP: 002b:00007f5b5b42c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 530.268859][T17161] RAX: ffffffffffffffda RBX: 00007f5b5a815fa0 RCX: 00007f5b5a59c819 [ 530.268875][T17161] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 530.268889][T17161] RBP: 00007f5b5b42c090 R08: 0000000000000000 R09: 0000000000000000 [ 530.268903][T17161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 530.268915][T17161] R13: 00007f5b5a816038 R14: 00007f5b5a815fa0 R15: 00007fff10c15068 [ 530.268952][T17161] [ 530.711203][T17168] netlink: 'syz.1.2866': attribute type 6 has an invalid length. [ 530.767123][T17168] netlink: 'syz.1.2866': attribute type 23 has an invalid length. [ 530.831660][T17168] IPv6: NLM_F_CREATE should be specified when creating new route [ 530.923260][T17183] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2871'. [ 531.440332][T17187] syzkaller1: entered promiscuous mode [ 531.445289][T17203] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2874'. [ 531.458131][T17187] syzkaller1: entered allmulticast mode [ 531.561727][T17211] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2876'. [ 531.686198][T17199] gre0 speed is unknown, defaulting to 1000 [ 531.697050][T17215] ip6t_srh: unknown srh match flags 4000 [ 531.897162][T17225] netlink: 'syz.0.2879': attribute type 39 has an invalid length. [ 531.898136][T17223] netlink: 'syz.0.2879': attribute type 39 has an invalid length. [ 531.960012][T17227] FAULT_INJECTION: forcing a failure. [ 531.960012][T17227] name failslab, interval 1, probability 0, space 0, times 0 [ 531.998334][T17227] CPU: 1 UID: 0 PID: 17227 Comm: syz.4.2881 Not tainted syzkaller #0 PREEMPT(full) [ 531.998365][T17227] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 531.998380][T17227] Call Trace: [ 531.998388][T17227] [ 531.998397][T17227] dump_stack_lvl+0xe8/0x150 [ 531.998435][T17227] should_fail_ex+0x412/0x560 [ 531.998472][T17227] should_failslab+0xa8/0x100 [ 531.998498][T17227] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 531.998531][T17227] ? __alloc_skb+0x186/0x7d0 [ 531.998559][T17227] ? __alloc_skb+0x1d0/0x7d0 [ 531.998586][T17227] ? __local_bh_enable_ip+0xd0/0x130 [ 531.998622][T17227] __alloc_skb+0x1d0/0x7d0 [ 531.998651][T17227] ? netlink_ack_tlv_len+0x6c/0x210 [ 531.998685][T17227] netlink_ack+0x146/0xa50 [ 531.998722][T17227] ? __kmalloc_cache_noprof+0x31c/0x660 [ 531.998772][T17227] nfnetlink_rcv+0x251a/0x27b0 [ 531.998844][T17227] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 531.998927][T17227] ? netlink_deliver_tap+0x2e/0x1b0 [ 531.998970][T17227] ? netlink_deliver_tap+0x2e/0x1b0 [ 531.999000][T17227] ? netlink_deliver_tap+0x2e/0x1b0 [ 531.999037][T17227] netlink_unicast+0x75c/0x8e0 [ 531.999076][T17227] netlink_sendmsg+0x813/0xb40 [ 531.999118][T17227] ? __pfx_netlink_sendmsg+0x10/0x10 [ 531.999154][T17227] ? aa_sock_msg_perm+0xf1/0x1b0 [ 531.999184][T17227] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 531.999221][T17227] ____sys_sendmsg+0x972/0x9f0 [ 531.999255][T17227] ? __might_fault+0xaf/0x130 [ 531.999291][T17227] ? __pfx_____sys_sendmsg+0x10/0x10 [ 531.999336][T17227] ? import_iovec+0x73/0xa0 [ 531.999362][T17227] ___sys_sendmsg+0x2a5/0x360 [ 531.999394][T17227] ? __lock_acquire+0x6b5/0x2cf0 [ 531.999428][T17227] ? __pfx____sys_sendmsg+0x10/0x10 [ 531.999502][T17227] ? __fget_files+0x2a/0x420 [ 531.999530][T17227] ? __fget_files+0x3a0/0x420 [ 531.999569][T17227] __x64_sys_sendmsg+0x1bd/0x2a0 [ 531.999607][T17227] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 531.999652][T17227] ? __pfx_ksys_write+0x10/0x10 [ 531.999694][T17227] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.999718][T17227] do_syscall_64+0x15f/0xf80 [ 531.999744][T17227] ? trace_irq_disable+0x3b/0x140 [ 531.999776][T17227] ? clear_bhb_loop+0x40/0x90 [ 531.999803][T17227] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 531.999825][T17227] RIP: 0033:0x7f518a19c819 [ 531.999845][T17227] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 531.999864][T17227] RSP: 002b:00007f518af92028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 531.999889][T17227] RAX: ffffffffffffffda RBX: 00007f518a415fa0 RCX: 00007f518a19c819 [ 531.999904][T17227] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 531.999918][T17227] RBP: 00007f518af92090 R08: 0000000000000000 R09: 0000000000000000 [ 531.999932][T17227] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 531.999945][T17227] R13: 00007f518a416038 R14: 00007f518a415fa0 R15: 00007fffee0d1ba8 [ 531.999981][T17227] [ 532.837076][T17238] bpq0: entered promiscuous mode [ 533.145923][T17253] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2888'. [ 533.276775][T17258] netlink: 304 bytes leftover after parsing attributes in process `syz.0.2889'. [ 533.577406][T17263] netlink: 'syz.0.2891': attribute type 10 has an invalid length. [ 533.608044][T17263] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2891'. [ 533.621334][T17263] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 533.647663][T17263] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 533.677697][T17263] hsr0: entered promiscuous mode [ 533.693394][T17263] bridge0: port 1(hsr0) entered blocking state [ 533.707196][T17263] bridge0: port 1(hsr0) entered disabled state [ 533.724368][T17263] hsr0: entered allmulticast mode [ 533.740015][T17264] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2891'. [ 533.774353][T17263] hsr_slave_0: entered allmulticast mode [ 533.800963][T17263] hsr_slave_1: entered allmulticast mode [ 533.868662][T17263] netlink: 'syz.0.2891': attribute type 27 has an invalid length. [ 534.055871][T17280] netlink: 'syz.3.2898': attribute type 1 has an invalid length. [ 534.065525][T17280] netlink: 2088 bytes leftover after parsing attributes in process `syz.3.2898'. [ 534.199771][T17286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2899'. [ 534.378783][T17291] bond11: Removing last ns target with arp_interval on [ 534.632260][T17310] x_tables: unsorted underflow at hook 4 [ 534.653947][T17312] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2908'. [ 534.679730][T17313] netlink: 'syz.3.2910': attribute type 1 has an invalid length. [ 534.975590][T17316] gretap2: entered allmulticast mode [ 535.007269][T17316] bond6: (slave gretap2): making interface the new active one [ 535.030211][T17316] bond6: (slave gretap2): Enslaving as an active interface with an up link [ 536.005345][T17378] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2926'. [ 536.547774][T17399] block nbd2: Unsupported socket: should be TCP or UNIX. [ 536.980264][T17415] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2936'. [ 537.073243][T17419] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2936'. [ 537.182020][T17368] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 537.194448][T17368] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 537.208334][T17368] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 537.231895][T17368] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 537.245415][T17368] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 537.348523][T17424] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2939'. [ 537.412739][T17425] netlink: 'syz.3.2939': attribute type 4 has an invalid length. [ 537.435702][T17425] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2939'. [ 537.540852][T17425] .`: renamed from bond0 [ 537.613588][T17421] gre0 speed is unknown, defaulting to 1000 [ 537.709784][T17435] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2941'. [ 538.164395][T17448] FAULT_INJECTION: forcing a failure. [ 538.164395][T17448] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 538.206035][T17448] CPU: 0 UID: 0 PID: 17448 Comm: syz.1.2947 Not tainted syzkaller #0 PREEMPT(full) [ 538.206064][T17448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 538.206078][T17448] Call Trace: [ 538.206086][T17448] [ 538.206096][T17448] dump_stack_lvl+0xe8/0x150 [ 538.206131][T17448] should_fail_ex+0x412/0x560 [ 538.206167][T17448] _copy_from_user+0x2d/0xb0 [ 538.206191][T17448] ___sys_sendmsg+0x1c6/0x360 [ 538.206223][T17448] ? __lock_acquire+0x6b5/0x2cf0 [ 538.206256][T17448] ? __pfx____sys_sendmsg+0x10/0x10 [ 538.206333][T17448] ? __fget_files+0x2a/0x420 [ 538.206359][T17448] ? __fget_files+0x3a0/0x420 [ 538.206397][T17448] __x64_sys_sendmsg+0x1bd/0x2a0 [ 538.206432][T17448] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 538.206475][T17448] ? __pfx_ksys_write+0x10/0x10 [ 538.206513][T17448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.206534][T17448] do_syscall_64+0x15f/0xf80 [ 538.206557][T17448] ? trace_irq_disable+0x3b/0x140 [ 538.206578][T17448] ? clear_bhb_loop+0x40/0x90 [ 538.206603][T17448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 538.206621][T17448] RIP: 0033:0x7f7e6a79c819 [ 538.206640][T17448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 538.206657][T17448] RSP: 002b:00007f7e6b719028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 538.206680][T17448] RAX: ffffffffffffffda RBX: 00007f7e6aa15fa0 RCX: 00007f7e6a79c819 [ 538.206695][T17448] RDX: 0000000000000040 RSI: 0000200000000280 RDI: 0000000000000003 [ 538.206710][T17448] RBP: 00007f7e6b719090 R08: 0000000000000000 R09: 0000000000000000 [ 538.206723][T17448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 538.206735][T17448] R13: 00007f7e6aa16038 R14: 00007f7e6aa15fa0 R15: 00007ffdfdae0688 [ 538.206770][T17448] [ 538.547151][T17455] netlink: 'syz.1.2950': attribute type 4 has an invalid length. [ 538.555219][T17455] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2950'. [ 538.726798][ T6104] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 538.765796][ T6104] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 538.954130][T17468] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2953'. [ 538.968316][T17466] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2952'. [ 539.033675][ T6104] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.055966][ T6104] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.194422][T17474] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2955'. [ 539.204918][ T6104] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.215730][ T6104] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.275196][ T6104] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 539.293603][ T6104] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 539.319454][ T5835] Bluetooth: hci5: command tx timeout [ 539.356803][T17482] netlink: 'syz.4.2958': attribute type 4 has an invalid length. [ 539.431162][T17484] netlink: 'syz.3.2957': attribute type 1 has an invalid length. [ 539.443685][T17484] netlink: 'syz.3.2957': attribute type 1 has an invalid length. [ 539.489805][T17484] 8021q: adding VLAN 0 to HW filter on device bond0 [ 539.731671][T17421] chnl_net:caif_netlink_parms(): no params data found [ 539.877932][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 540.026814][ T6104] hsr0: left allmulticast mode [ 540.032349][ T6104] hsr_slave_0: left allmulticast mode [ 540.040440][ T6104] hsr_slave_1: left allmulticast mode [ 540.050017][ T6104] bridge0: port 1(hsr0) entered disabled state [ 540.096602][ T6104] dvmrp1: left allmulticast mode [ 540.716123][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ff89400: rx timeout, send abort [ 540.830942][T17535] FAULT_INJECTION: forcing a failure. [ 540.830942][T17535] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 540.856238][T17535] CPU: 0 UID: 0 PID: 17535 Comm: syz.3.2966 Not tainted syzkaller #0 PREEMPT(full) [ 540.856268][T17535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 540.856282][T17535] Call Trace: [ 540.856290][T17535] [ 540.856299][T17535] dump_stack_lvl+0xe8/0x150 [ 540.856336][T17535] should_fail_ex+0x412/0x560 [ 540.856372][T17535] _copy_from_user+0x2d/0xb0 [ 540.856400][T17535] ___sys_sendmsg+0x1c6/0x360 [ 540.856433][T17535] ? __lock_acquire+0x6b5/0x2cf0 [ 540.856467][T17535] ? __pfx____sys_sendmsg+0x10/0x10 [ 540.856539][T17535] ? __fget_files+0x2a/0x420 [ 540.856566][T17535] ? __fget_files+0x3a0/0x420 [ 540.856602][T17535] __x64_sys_sendmsg+0x1bd/0x2a0 [ 540.856638][T17535] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 540.856681][T17535] ? __pfx_ksys_write+0x10/0x10 [ 540.856724][T17535] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.856747][T17535] do_syscall_64+0x15f/0xf80 [ 540.856773][T17535] ? trace_irq_disable+0x3b/0x140 [ 540.856796][T17535] ? clear_bhb_loop+0x40/0x90 [ 540.856823][T17535] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 540.856843][T17535] RIP: 0033:0x7fe18f19c819 [ 540.856862][T17535] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 540.856889][T17535] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 540.856913][T17535] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 540.856928][T17535] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 540.856941][T17535] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 540.856953][T17535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 540.856964][T17535] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 540.856996][T17535] [ 541.224486][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807ff89400: abort rx timeout. Force session deactivation [ 541.343620][ T6104] bond5 (unregistering): (slave bridge4): Releasing active interface [ 541.398454][ T5835] Bluetooth: hci5: command tx timeout [ 541.435406][ T6104] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 541.445162][ T6104] bond0 (unregistering): Released all slaves [ 541.458946][ T6104] bond1 (unregistering): Released all slaves [ 541.475522][ T6104] bond2 (unregistering): Released all slaves [ 541.493090][ T6104] bond3 (unregistering): Released all slaves [ 541.513664][ T6104] bond4 (unregistering): (slave veth3): Releasing backup interface [ 541.530514][ T6104] bond4 (unregistering): (slave batadv1): Releasing backup interface [ 541.543182][ T6104] bond4 (unregistering): Released all slaves [ 541.561462][ T6104] bond5 (unregistering): Released all slaves [ 541.587759][ T5486] 8021q: adding VLAN 0 to HW filter on device eth1 [ 541.824737][T17552] __nla_validate_parse: 2 callbacks suppressed [ 541.824757][T17552] netlink: 9 bytes leftover after parsing attributes in process `syz.4.2969'. [ 541.899357][ T6104] tipc: Disabling bearer [ 541.921288][ T6104] tipc: Disabling bearer [ 541.927861][T17552] gretap0: entered promiscuous mode [ 541.934864][ T6104] tipc: Left network mode [ 541.962267][T17421] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.972133][T17552] netlink: 5 bytes leftover after parsing attributes in process `syz.4.2969'. [ 541.983897][T17421] bridge0: port 1(bridge_slave_0) entered disabled state [ 541.994641][T17554] netlink: 'syz.1.2972': attribute type 10 has an invalid length. [ 542.003403][T17421] bridge_slave_0: entered allmulticast mode [ 542.011513][T17421] bridge_slave_0: entered promiscuous mode [ 542.032631][T17549] gre0 speed is unknown, defaulting to 1000 [ 542.039149][T17421] bridge0: port 2(bridge_slave_1) entered blocking state [ 542.039259][T17421] bridge0: port 2(bridge_slave_1) entered disabled state [ 542.039418][T17421] bridge_slave_1: entered allmulticast mode [ 542.063539][T17421] bridge_slave_1: entered promiscuous mode [ 542.090795][T17552] 0{X: renamed from gretap0 [ 542.114302][T17552] 0{X: left promiscuous mode [ 542.133519][T17552] 0{X: entered allmulticast mode [ 542.155182][T17552] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 542.188008][ T6104] IPVS: stopping backup sync thread 10961 ... [ 542.235167][T17554] veth0_vlan: left promiscuous mode [ 542.242588][T17554] veth0_vlan: entered promiscuous mode [ 542.250773][T17554] team0: Device veth0_vlan failed to register rx_handler [ 542.435479][T17570] FAULT_INJECTION: forcing a failure. [ 542.435479][T17570] name failslab, interval 1, probability 0, space 0, times 0 [ 542.479513][T17570] CPU: 1 UID: 0 PID: 17570 Comm: syz.1.2976 Not tainted syzkaller #0 PREEMPT(full) [ 542.479544][T17570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 542.479558][T17570] Call Trace: [ 542.479567][T17570] [ 542.479577][T17570] dump_stack_lvl+0xe8/0x150 [ 542.479615][T17570] should_fail_ex+0x412/0x560 [ 542.479652][T17570] should_failslab+0xa8/0x100 [ 542.479677][T17570] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 542.479711][T17570] ? __alloc_skb+0x186/0x7d0 [ 542.479740][T17570] ? __alloc_skb+0x1d0/0x7d0 [ 542.479766][T17570] ? __local_bh_enable_ip+0xd0/0x130 [ 542.479802][T17570] __alloc_skb+0x1d0/0x7d0 [ 542.479837][T17570] netlink_sendmsg+0x5d4/0xb40 [ 542.479880][T17570] ? __pfx_netlink_sendmsg+0x10/0x10 [ 542.479916][T17570] ? aa_sock_msg_perm+0xf1/0x1b0 [ 542.479955][T17570] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 542.479993][T17570] ____sys_sendmsg+0x972/0x9f0 [ 542.480026][T17570] ? __might_fault+0xaf/0x130 [ 542.480062][T17570] ? __pfx_____sys_sendmsg+0x10/0x10 [ 542.480106][T17570] ? import_iovec+0x73/0xa0 [ 542.480132][T17570] ___sys_sendmsg+0x2a5/0x360 [ 542.480164][T17570] ? __lock_acquire+0x6b5/0x2cf0 [ 542.480198][T17570] ? __pfx____sys_sendmsg+0x10/0x10 [ 542.480272][T17570] ? __fget_files+0x2a/0x420 [ 542.480299][T17570] ? __fget_files+0x3a0/0x420 [ 542.480338][T17570] __x64_sys_sendmsg+0x1bd/0x2a0 [ 542.480374][T17570] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 542.480417][T17570] ? __pfx_ksys_write+0x10/0x10 [ 542.480457][T17570] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.480481][T17570] do_syscall_64+0x15f/0xf80 [ 542.480512][T17570] ? trace_irq_disable+0x3b/0x140 [ 542.480536][T17570] ? clear_bhb_loop+0x40/0x90 [ 542.480562][T17570] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.480584][T17570] RIP: 0033:0x7f7e6a79c819 [ 542.480605][T17570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 542.480623][T17570] RSP: 002b:00007f7e6b719028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 542.480647][T17570] RAX: ffffffffffffffda RBX: 00007f7e6aa15fa0 RCX: 00007f7e6a79c819 [ 542.480664][T17570] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 542.480678][T17570] RBP: 00007f7e6b719090 R08: 0000000000000000 R09: 0000000000000000 [ 542.480692][T17570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.480704][T17570] R13: 00007f7e6aa16038 R14: 00007f7e6aa15fa0 R15: 00007ffdfdae0688 [ 542.480740][T17570] [ 542.844687][T17421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 542.944178][T17421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 543.345861][T17421] team0: Port device team_slave_0 added [ 543.410335][T17421] team0: Port device team_slave_1 added [ 543.465178][T17598] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2982'. [ 543.498651][ T5835] Bluetooth: hci5: command tx timeout [ 543.679833][T17598] bond12: entered promiscuous mode [ 543.685378][T17598] 8021q: adding VLAN 0 to HW filter on device bond12 [ 543.784264][ T5486] 8021q: adding VLAN 0 to HW filter on device eth2 [ 543.811191][T17610] 8021q: adding VLAN 0 to HW filter on device bond12 [ 543.826202][T17610] bond12: (slave sit1): The slave device specified does not support setting the MAC address [ 543.838757][T17610] bond12: (slave sit1): Error -95 calling set_mac_address [ 543.894135][T17421] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 543.920180][T17421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 543.978934][T17421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 544.011877][T17421] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 544.032121][T17421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 544.108146][T17616] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2985'. [ 544.124706][T17421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 544.183834][T17621] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2985'. [ 544.319795][T17614] tipc: Enabled bearer , priority 14 [ 544.572720][T17634] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2991'. [ 544.664056][T17631] bond7: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 544.705650][T17631] bond7 (unregistering): Released all slaves [ 544.774184][T17421] hsr_slave_0: entered promiscuous mode [ 544.793136][T17421] hsr_slave_1: entered promiscuous mode [ 544.802601][T17421] debugfs: 'hsr0' already exists in 'hsr' [ 544.815013][T17421] Cannot create hsr debugfs directory [ 544.999580][T17641] openvswitch: netlink: Unexpected mask (mask=5000040, allowed=1010048) [ 545.181387][T17645] syzkaller0: entered promiscuous mode [ 545.197676][T17645] syzkaller0: entered allmulticast mode [ 545.559102][ T5835] Bluetooth: hci5: command tx timeout [ 547.461830][ T5486] 8021q: adding VLAN 0 to HW filter on device eth3 [ 547.558832][T17682] FAULT_INJECTION: forcing a failure. [ 547.558832][T17682] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.573948][T17682] CPU: 1 UID: 0 PID: 17682 Comm: syz.1.2997 Not tainted syzkaller #0 PREEMPT(full) [ 547.573975][T17682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 547.573988][T17682] Call Trace: [ 547.573996][T17682] [ 547.574004][T17682] dump_stack_lvl+0xe8/0x150 [ 547.574041][T17682] should_fail_ex+0x412/0x560 [ 547.574077][T17682] _copy_from_iter+0x1d3/0x1670 [ 547.574117][T17682] ? rcu_is_watching+0x15/0xb0 [ 547.574154][T17682] ? __pfx__copy_from_iter+0x10/0x10 [ 547.574195][T17682] ? netlink_sendmsg+0x650/0xb40 [ 547.574224][T17682] ? skb_put+0x11b/0x210 [ 547.574257][T17682] netlink_sendmsg+0x6c0/0xb40 [ 547.574296][T17682] ? __pfx_netlink_sendmsg+0x10/0x10 [ 547.574328][T17682] ? aa_sock_msg_perm+0xf1/0x1b0 [ 547.574358][T17682] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 547.574393][T17682] ____sys_sendmsg+0x972/0x9f0 [ 547.574424][T17682] ? __might_fault+0xaf/0x130 [ 547.574458][T17682] ? __pfx_____sys_sendmsg+0x10/0x10 [ 547.574499][T17682] ? import_iovec+0x73/0xa0 [ 547.574523][T17682] ___sys_sendmsg+0x2a5/0x360 [ 547.574554][T17682] ? __lock_acquire+0x6b5/0x2cf0 [ 547.574586][T17682] ? __pfx____sys_sendmsg+0x10/0x10 [ 547.574664][T17682] ? __fget_files+0x2a/0x420 [ 547.574690][T17682] ? __fget_files+0x3a0/0x420 [ 547.574727][T17682] __x64_sys_sendmsg+0x1bd/0x2a0 [ 547.574762][T17682] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 547.574806][T17682] ? __pfx_ksys_write+0x10/0x10 [ 547.574847][T17682] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.574870][T17682] do_syscall_64+0x15f/0xf80 [ 547.574896][T17682] ? trace_irq_disable+0x3b/0x140 [ 547.574919][T17682] ? clear_bhb_loop+0x40/0x90 [ 547.574945][T17682] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.574966][T17682] RIP: 0033:0x7f7e6a79c819 [ 547.574986][T17682] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.575004][T17682] RSP: 002b:00007f7e6b719028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 547.575026][T17682] RAX: ffffffffffffffda RBX: 00007f7e6aa15fa0 RCX: 00007f7e6a79c819 [ 547.575042][T17682] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 547.575056][T17682] RBP: 00007f7e6b719090 R08: 0000000000000000 R09: 0000000000000000 [ 547.575069][T17682] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.575081][T17682] R13: 00007f7e6aa16038 R14: 00007f7e6aa15fa0 R15: 00007ffdfdae0688 [ 547.575115][T17682] [ 547.855754][T17686] netlink: 'syz.3.2998': attribute type 3 has an invalid length. [ 547.871770][T17686] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2998'. [ 547.940041][T17691] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3001'. [ 548.011567][T17689] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 548.153055][T17697] netlink: 'syz.1.3004': attribute type 1 has an invalid length. [ 548.164768][T17697] netlink: 'syz.1.3004': attribute type 1 has an invalid length. [ 548.190095][T17697] netlink: 'syz.1.3004': attribute type 1 has an invalid length. [ 548.743591][T17709] gre0 speed is unknown, defaulting to 1000 [ 549.082389][T17731] FAULT_INJECTION: forcing a failure. [ 549.082389][T17731] name failslab, interval 1, probability 0, space 0, times 0 [ 549.101879][T17732] netlink: 'syz.4.3009': attribute type 4 has an invalid length. [ 549.146738][T17731] CPU: 0 UID: 0 PID: 17731 Comm: syz.1.3010 Not tainted syzkaller #0 PREEMPT(full) [ 549.146769][T17731] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 549.146782][T17731] Call Trace: [ 549.146791][T17731] [ 549.146805][T17731] dump_stack_lvl+0xe8/0x150 [ 549.146843][T17731] should_fail_ex+0x412/0x560 [ 549.146881][T17731] should_failslab+0xa8/0x100 [ 549.146907][T17731] __kmalloc_noprof+0xe8/0x760 [ 549.146940][T17731] ? rtm_new_nexthop+0x1c79/0x84c0 [ 549.146977][T17731] rtm_new_nexthop+0x1c79/0x84c0 [ 549.147033][T17731] ? __lock_acquire+0x6b5/0x2cf0 [ 549.147064][T17731] ? __pfx_rtm_new_nexthop+0x10/0x10 [ 549.147092][T17731] ? __lock_acquire+0x6b5/0x2cf0 [ 549.147132][T17731] ? unwind_next_frame+0xa6/0x2550 [ 549.147161][T17731] ? unwind_next_frame+0xa6/0x2550 [ 549.147185][T17731] ? is_bpf_text_address+0x26/0x2b0 [ 549.147226][T17731] ? is_bpf_text_address+0x26/0x2b0 [ 549.147258][T17731] ? __lock_acquire+0x6b5/0x2cf0 [ 549.147336][T17731] ? __pfx_rtm_new_nexthop+0x10/0x10 [ 549.147365][T17731] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 549.147394][T17731] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 549.147425][T17731] ? netlink_sendmsg+0x5d4/0xb40 [ 549.147470][T17731] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 549.147499][T17731] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 549.147529][T17731] ? __lock_acquire+0x6b5/0x2cf0 [ 549.147573][T17731] netlink_rcv_skb+0x232/0x4b0 [ 549.147605][T17731] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 549.147637][T17731] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 549.147683][T17731] ? netlink_deliver_tap+0x2e/0x1b0 [ 549.147714][T17731] ? netlink_deliver_tap+0x2e/0x1b0 [ 549.147751][T17731] netlink_unicast+0x75c/0x8e0 [ 549.147793][T17731] netlink_sendmsg+0x813/0xb40 [ 549.147836][T17731] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.147873][T17731] ? aa_sock_msg_perm+0xf1/0x1b0 [ 549.147903][T17731] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 549.147939][T17731] ____sys_sendmsg+0x972/0x9f0 [ 549.147972][T17731] ? __might_fault+0xaf/0x130 [ 549.148009][T17731] ? __pfx_____sys_sendmsg+0x10/0x10 [ 549.148073][T17731] ? import_iovec+0x73/0xa0 [ 549.148100][T17731] ___sys_sendmsg+0x2a5/0x360 [ 549.148132][T17731] ? __lock_acquire+0x6b5/0x2cf0 [ 549.148165][T17731] ? __pfx____sys_sendmsg+0x10/0x10 [ 549.148241][T17731] ? __fget_files+0x2a/0x420 [ 549.148267][T17731] ? __fget_files+0x3a0/0x420 [ 549.148307][T17731] __x64_sys_sendmsg+0x1bd/0x2a0 [ 549.148343][T17731] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 549.148387][T17731] ? __pfx_ksys_write+0x10/0x10 [ 549.148428][T17731] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.148452][T17731] do_syscall_64+0x15f/0xf80 [ 549.148485][T17731] ? trace_irq_disable+0x3b/0x140 [ 549.148508][T17731] ? clear_bhb_loop+0x40/0x90 [ 549.148535][T17731] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.148557][T17731] RIP: 0033:0x7f7e6a79c819 [ 549.148577][T17731] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.148595][T17731] RSP: 002b:00007f7e6b719028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 549.148619][T17731] RAX: ffffffffffffffda RBX: 00007f7e6aa15fa0 RCX: 00007f7e6a79c819 [ 549.148635][T17731] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 549.148649][T17731] RBP: 00007f7e6b719090 R08: 0000000000000000 R09: 0000000000000000 [ 549.148663][T17731] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 549.148676][T17731] R13: 00007f7e6aa16038 R14: 00007f7e6aa15fa0 R15: 00007ffdfdae0688 [ 549.148713][T17731] [ 549.537930][T17733] netlink: 'syz.4.3009': attribute type 4 has an invalid length. [ 549.562288][T17733] netlink: 'syz.4.3009': attribute type 4 has an invalid length. [ 549.814828][ T6104] hsr_slave_0: left promiscuous mode [ 549.835551][ T6104] hsr_slave_1: left promiscuous mode [ 550.855489][T17776] netlink: 276 bytes leftover after parsing attributes in process `syz.4.3014'. [ 551.176377][T17421] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 551.203839][T17421] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 551.224172][T17421] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 551.244218][T17788] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3018'. [ 551.270363][T17421] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 551.317979][T17421] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 551.390019][T17421] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 551.400150][T17421] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 551.441465][T17421] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 551.811305][T17421] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.839099][T17814] FAULT_INJECTION: forcing a failure. [ 551.839099][T17814] name failslab, interval 1, probability 0, space 0, times 0 [ 551.857961][T17814] CPU: 0 UID: 0 PID: 17814 Comm: syz.2.3021 Not tainted syzkaller #0 PREEMPT(full) [ 551.857991][T17814] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 551.858015][T17814] Call Trace: [ 551.858024][T17814] [ 551.858033][T17814] dump_stack_lvl+0xe8/0x150 [ 551.858071][T17814] should_fail_ex+0x412/0x560 [ 551.858108][T17814] should_failslab+0xa8/0x100 [ 551.858133][T17814] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 551.858167][T17814] ? __alloc_skb+0x186/0x7d0 [ 551.858195][T17814] ? __alloc_skb+0x1d0/0x7d0 [ 551.858222][T17814] ? __local_bh_enable_ip+0xd0/0x130 [ 551.858255][T17814] __alloc_skb+0x1d0/0x7d0 [ 551.858285][T17814] ? netlink_ack_tlv_len+0x6c/0x210 [ 551.858319][T17814] netlink_ack+0x146/0xa50 [ 551.858347][T17814] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 551.858374][T17814] ? ref_tracker_free+0x693/0x840 [ 551.858409][T17814] ? __pfx_ref_tracker_free+0x10/0x10 [ 551.858453][T17814] netlink_rcv_skb+0x2b6/0x4b0 [ 551.858485][T17814] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 551.858516][T17814] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 551.858562][T17814] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.858592][T17814] ? netlink_deliver_tap+0x2e/0x1b0 [ 551.858629][T17814] netlink_unicast+0x75c/0x8e0 [ 551.858669][T17814] netlink_sendmsg+0x813/0xb40 [ 551.858711][T17814] ? __pfx_netlink_sendmsg+0x10/0x10 [ 551.858752][T17814] ? aa_sock_msg_perm+0xf1/0x1b0 [ 551.858782][T17814] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 551.858819][T17814] ____sys_sendmsg+0x972/0x9f0 [ 551.858852][T17814] ? __might_fault+0xaf/0x130 [ 551.858887][T17814] ? __pfx_____sys_sendmsg+0x10/0x10 [ 551.858929][T17814] ? import_iovec+0x73/0xa0 [ 551.858955][T17814] ___sys_sendmsg+0x2a5/0x360 [ 551.858987][T17814] ? __lock_acquire+0x6b5/0x2cf0 [ 551.859028][T17814] ? __pfx____sys_sendmsg+0x10/0x10 [ 551.859099][T17814] ? __fget_files+0x2a/0x420 [ 551.859125][T17814] ? __fget_files+0x3a0/0x420 [ 551.859163][T17814] __x64_sys_sendmsg+0x1bd/0x2a0 [ 551.859199][T17814] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 551.859243][T17814] ? __pfx_ksys_write+0x10/0x10 [ 551.859285][T17814] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.859308][T17814] do_syscall_64+0x15f/0xf80 [ 551.859335][T17814] ? trace_irq_disable+0x3b/0x140 [ 551.859359][T17814] ? clear_bhb_loop+0x40/0x90 [ 551.859386][T17814] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.859409][T17814] RIP: 0033:0x7f5b5a59c819 [ 551.859429][T17814] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.859449][T17814] RSP: 002b:00007f5b5b42c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 551.859473][T17814] RAX: ffffffffffffffda RBX: 00007f5b5a815fa0 RCX: 00007f5b5a59c819 [ 551.859489][T17814] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 551.859503][T17814] RBP: 00007f5b5b42c090 R08: 0000000000000000 R09: 0000000000000000 [ 551.859517][T17814] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 551.859530][T17814] R13: 00007f5b5a816038 R14: 00007f5b5a815fa0 R15: 00007fff10c15068 [ 551.859565][T17814] [ 552.222418][T17421] 8021q: adding VLAN 0 to HW filter on device team0 [ 552.279873][T17421] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 552.291660][T17421] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 552.315841][T11035] bridge0: port 1(bridge_slave_0) entered blocking state [ 552.323138][T11035] bridge0: port 1(bridge_slave_0) entered forwarding state [ 552.415649][T11035] bridge0: port 2(bridge_slave_1) entered blocking state [ 552.423036][T11035] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.485080][T17819] tipc: Enabling of bearer rejected, failed to enable media [ 552.592187][T17830] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3025'. [ 552.662979][T17831] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3025'. [ 552.812910][T17828] gre0 speed is unknown, defaulting to 1000 [ 552.842415][T17421] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 553.182152][T17421] veth0_vlan: entered promiscuous mode [ 553.265692][T17421] veth1_vlan: entered promiscuous mode [ 553.293553][T17850] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3029'. [ 553.325858][T17852] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3030'. [ 553.433110][T17421] veth0_macvtap: entered promiscuous mode [ 553.487344][T17421] veth1_macvtap: entered promiscuous mode [ 553.610103][T17421] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 553.702453][T17421] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 553.796124][T11036] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.843791][T11036] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.896107][T11036] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.969615][T11036] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.137111][T17874] tipc: Enabling of bearer rejected, already enabled [ 554.285312][T17880] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 554.589585][T17890] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3039'. [ 555.094065][ T6104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 555.123398][ T6104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 555.513480][ T6111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 555.533717][ T6111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 555.636703][T17915] FAULT_INJECTION: forcing a failure. [ 555.636703][T17915] name failslab, interval 1, probability 0, space 0, times 0 [ 555.652290][T17915] CPU: 1 UID: 0 PID: 17915 Comm: syz.3.3043 Not tainted syzkaller #0 PREEMPT(full) [ 555.652315][T17915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 555.652327][T17915] Call Trace: [ 555.652335][T17915] [ 555.652344][T17915] dump_stack_lvl+0xe8/0x150 [ 555.652380][T17915] should_fail_ex+0x412/0x560 [ 555.652414][T17915] should_failslab+0xa8/0x100 [ 555.652435][T17915] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 555.652465][T17915] ? __alloc_skb+0x1d0/0x7d0 [ 555.652490][T17915] ? __local_bh_enable_ip+0xd0/0x130 [ 555.652520][T17915] __alloc_skb+0x1d0/0x7d0 [ 555.652550][T17915] alloc_skb_with_frags+0xca/0x890 [ 555.652590][T17915] ? do_raw_spin_lock+0x12b/0x2f0 [ 555.652610][T17915] ? lock_acquire+0x106/0x350 [ 555.652636][T17915] sock_alloc_send_pskb+0x878/0x990 [ 555.652671][T17915] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 555.652690][T17915] ? kasan_save_track+0x4f/0x80 [ 555.652716][T17915] ? kasan_save_track+0x3e/0x80 [ 555.652743][T17915] ? __kasan_kmalloc+0x93/0xb0 [ 555.652759][T17915] ? __kmalloc_cache_noprof+0x31c/0x660 [ 555.652786][T17915] ? ip_setup_cork+0x29b/0xa50 [ 555.652803][T17915] ? ip_append_data+0x13a/0x190 [ 555.652819][T17915] ? icmp_push_reply+0x86/0x400 [ 555.652839][T17915] ? __icmp_send+0x11e4/0x1690 [ 555.652857][T17915] ? ip_vs_leave+0x46f/0xca0 [ 555.652877][T17915] ? ip_vs_in_hook+0xc50/0x1bf0 [ 555.652897][T17915] ? nf_hook_slow+0xc5/0x220 [ 555.652913][T17915] ? nf_hook+0x22a/0x3a0 [ 555.652937][T17915] ? __ip_local_out+0x558/0x6a0 [ 555.652966][T17915] __ip_append_data+0x2bbb/0x3f30 [ 555.652992][T17915] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 555.653021][T17915] ? do_syscall_64+0x15f/0xf80 [ 555.653059][T17915] ? __pfx_icmp_glue_bits+0x10/0x10 [ 555.653099][T17915] ? __kmalloc_cache_noprof+0x31c/0x660 [ 555.653127][T17915] ? __pfx___ip_append_data+0x10/0x10 [ 555.653144][T17915] ? ip_setup_cork+0x320/0xa50 [ 555.653169][T17915] ? ip_setup_cork+0x57e/0xa50 [ 555.653194][T17915] ip_append_data+0x10d/0x190 [ 555.653220][T17915] ? __pfx_icmp_glue_bits+0x10/0x10 [ 555.653248][T17915] icmp_push_reply+0x86/0x400 [ 555.653274][T17915] ? rcu_is_watching+0x15/0xb0 [ 555.653306][T17915] ? trace_icmp_send+0x82/0x1e0 [ 555.653333][T17915] __icmp_send+0x11e4/0x1690 [ 555.653355][T17915] ? __icmp_send+0x22b/0x1690 [ 555.653393][T17915] ? __pfx___icmp_send+0x10/0x10 [ 555.653413][T17915] ? sock_alloc_send_pskb+0x878/0x990 [ 555.653486][T17915] ip_vs_leave+0x46f/0xca0 [ 555.653519][T17915] ? __ip_vs_svc_fwm_find+0x1da/0x6b0 [ 555.653553][T17915] ? __pfx_ip_vs_leave+0x10/0x10 [ 555.653584][T17915] ? __ip_vs_svc_fwm_find+0x624/0x6b0 [ 555.653622][T17915] ? ip_vs_service_find+0xbc/0x3c0 [ 555.653658][T17915] udp_conn_schedule+0x440/0x7a0 [ 555.653687][T17915] ? __pfx_udp_conn_schedule+0x10/0x10 [ 555.653724][T17915] ip_vs_in_hook+0xc50/0x1bf0 [ 555.653763][T17915] ? __pfx_ip_vs_in_hook+0x10/0x10 [ 555.653812][T17915] ? nf_nat_ipv4_local_fn+0x1de/0x540 [ 555.653842][T17915] ? __pfx_ip_vs_in_hook+0x10/0x10 [ 555.653869][T17915] nf_hook_slow+0xc5/0x220 [ 555.653891][T17915] ? __pfx_dst_output+0x10/0x10 [ 555.653922][T17915] nf_hook+0x22a/0x3a0 [ 555.653958][T17915] ? nf_hook+0xa1/0x3a0 [ 555.653997][T17915] ? __pfx_nf_hook+0x10/0x10 [ 555.654032][T17915] ? __pfx_dst_output+0x10/0x10 [ 555.654071][T17915] ? __ip_local_out+0x152/0x6a0 [ 555.654107][T17915] __ip_local_out+0x558/0x6a0 [ 555.654136][T17915] ? __pfx_dst_output+0x10/0x10 [ 555.654174][T17915] ip_local_out+0x2a/0x190 [ 555.654209][T17915] ip_send_skb+0x45/0xc0 [ 555.654232][T17915] udp_send_skb+0x7e4/0xf70 [ 555.654271][T17915] udp_sendmsg+0x1937/0x21a0 [ 555.654301][T17915] ? string+0x279/0x2b0 [ 555.654345][T17915] ? __pfx_udp_sendmsg+0x10/0x10 [ 555.654379][T17915] ? format_decode+0x5a3/0xe10 [ 555.654411][T17915] ? look_up_lock_class+0x57/0x110 [ 555.654447][T17915] ? __lock_acquire+0x6b5/0x2cf0 [ 555.654495][T17915] ? get_random_u32+0x4ce/0x8b0 [ 555.654532][T17915] udpv6_sendmsg+0x996/0x25c0 [ 555.654579][T17915] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 555.654604][T17915] ? udp_lib_get_port+0x177a/0x1c60 [ 555.654637][T17915] ? ip6_datagram_release_cb+0x7c/0x550 [ 555.654686][T17915] ? inet_send_prepare+0x1b9/0x270 [ 555.654708][T17915] ? inet_send_prepare+0x1b9/0x270 [ 555.654733][T17915] ? inet_send_prepare+0x1b9/0x270 [ 555.654752][T17915] ? __local_bh_enable_ip+0xd0/0x130 [ 555.654782][T17915] ? inet_send_prepare+0x1b9/0x270 [ 555.654807][T17915] ? inet6_sendmsg+0xe4/0x120 [ 555.654830][T17915] ____sys_sendmsg+0x5c7/0x9f0 [ 555.654866][T17915] ? __pfx_____sys_sendmsg+0x10/0x10 [ 555.654903][T17915] ? import_iovec+0x73/0xa0 [ 555.654924][T17915] ___sys_sendmsg+0x2a5/0x360 [ 555.654951][T17915] ? __lock_acquire+0x6b5/0x2cf0 [ 555.654978][T17915] ? __pfx____sys_sendmsg+0x10/0x10 [ 555.655045][T17915] ? __fget_files+0x2a/0x420 [ 555.655067][T17915] ? __fget_files+0x3a0/0x420 [ 555.655099][T17915] __x64_sys_sendmsg+0x1bd/0x2a0 [ 555.655130][T17915] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 555.655167][T17915] ? __pfx_ksys_write+0x10/0x10 [ 555.655202][T17915] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.655222][T17915] do_syscall_64+0x15f/0xf80 [ 555.655243][T17915] ? trace_irq_disable+0x3b/0x140 [ 555.655262][T17915] ? clear_bhb_loop+0x40/0x90 [ 555.655284][T17915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 555.655302][T17915] RIP: 0033:0x7fe18f19c819 [ 555.655320][T17915] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 555.655335][T17915] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 555.655356][T17915] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 555.655369][T17915] RDX: 0000000000000040 RSI: 0000200000000280 RDI: 0000000000000003 [ 555.655380][T17915] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 555.655391][T17915] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 555.655402][T17915] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 555.655431][T17915] [ 556.587051][T17926] netlink: 'syz.2.3044': attribute type 13 has an invalid length. [ 556.595380][T17929] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3045'. [ 556.645001][T17928] hsr0: entered promiscuous mode [ 556.674491][T17928] macvlan2: entered promiscuous mode [ 557.042023][T17926] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.051639][T17368] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 557.082697][T17368] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 557.099815][T17368] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 557.111399][T17368] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 557.122742][T17368] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 557.539846][T11036] netdevsim netdevsim2 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.565608][T11036] netdevsim netdevsim2 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.719422][T11036] netdevsim netdevsim2 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.744631][T11036] netdevsim netdevsim2 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.873633][T17942] gre0 speed is unknown, defaulting to 1000 [ 558.105506][T17983] netlink: 'syz.3.3054': attribute type 142 has an invalid length. [ 558.717294][T17972] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 559.065960][T18020] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3061'. [ 559.242033][ T5835] Bluetooth: hci1: command tx timeout [ 559.335714][T18028] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 559.364902][T18028] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3063'. [ 559.449061][T18028] ip6gretap0: entered promiscuous mode [ 559.460269][T18028] ip6gretap0: left promiscuous mode [ 559.649098][T18033] FAULT_INJECTION: forcing a failure. [ 559.649098][T18033] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 559.686507][T18033] CPU: 1 UID: 0 PID: 18033 Comm: syz.3.3064 Not tainted syzkaller #0 PREEMPT(full) [ 559.686547][T18033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 559.686566][T18033] Call Trace: [ 559.686581][T18033] [ 559.686594][T18033] dump_stack_lvl+0xe8/0x150 [ 559.686647][T18033] should_fail_ex+0x412/0x560 [ 559.686690][T18033] _copy_from_user+0x2d/0xb0 [ 559.686713][T18033] ___sys_sendmsg+0x1c6/0x360 [ 559.686745][T18033] ? __lock_acquire+0x6b5/0x2cf0 [ 559.686778][T18033] ? __pfx____sys_sendmsg+0x10/0x10 [ 559.686848][T18033] ? __fget_files+0x2a/0x420 [ 559.686874][T18033] ? __fget_files+0x3a0/0x420 [ 559.686911][T18033] __x64_sys_sendmsg+0x1bd/0x2a0 [ 559.686948][T18033] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 559.686991][T18033] ? __pfx_ksys_write+0x10/0x10 [ 559.687031][T18033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.687053][T18033] do_syscall_64+0x15f/0xf80 [ 559.687079][T18033] ? trace_irq_disable+0x3b/0x140 [ 559.687101][T18033] ? clear_bhb_loop+0x40/0x90 [ 559.687128][T18033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 559.687149][T18033] RIP: 0033:0x7fe18f19c819 [ 559.687168][T18033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.687187][T18033] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 559.687209][T18033] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 559.687225][T18033] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 559.687238][T18033] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 559.687269][T18033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 559.687283][T18033] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 559.687335][T18033] [ 559.992286][T17942] chnl_net:caif_netlink_parms(): no params data found [ 560.060093][ T6111] vlan3: left allmulticast mode [ 560.066274][ T6111] geneve0: left allmulticast mode [ 560.091732][ T6111] vlan3: left promiscuous mode [ 560.096704][ T6111] geneve0: left promiscuous mode [ 560.102528][ T6111] bridge0: port 3(vlan3) entered disabled state [ 560.119386][ T6111] bridge_slave_1: left allmulticast mode [ 560.127450][ T6111] bridge_slave_1: left promiscuous mode [ 560.139876][ T6111] bridge0: port 2(bridge_slave_1) entered disabled state [ 561.167325][ T6111] bond9 (unregistering): (slave bridge4): Releasing backup interface [ 561.176703][ T6111] bridge4 (unregistering): left promiscuous mode [ 561.214614][ T6111] team0: Port device bridge5 removed [ 561.304528][ T6111] bond0 (unregistering): (slave 45): Releasing backup interface [ 561.315004][ T6111] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 561.323708][ T5835] Bluetooth: hci1: command tx timeout [ 561.332304][ T6111] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 561.345082][ T6111] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 561.366343][ T6111] bond0 (unregistering): Released all slaves [ 561.380301][ T6111] bond1 (unregistering): (slave vcan1): Releasing backup interface [ 561.389247][ T6111] bond1 (unregistering): Released all slaves [ 561.413712][ T6111] bond2 (unregistering): Released all slaves [ 561.430464][ T6111] bond3 (unregistering): Released all slaves [ 561.449599][ T6111] bond4 (unregistering): Released all slaves [ 561.473990][ T6111] bond5 (unregistering): (slave veth7): Releasing active interface [ 561.490303][ T6111] batadv1: entered promiscuous mode [ 561.498321][ T6111] bond5 (unregistering): (slave batadv1): Releasing active interface [ 561.507759][ T6111] bond5 (unregistering): Released all slaves [ 561.525277][ T6111] bond6 (unregistering): Released all slaves [ 561.542964][ T6111] bond7 (unregistering): Released all slaves [ 561.570719][ T6111] bond8 (unregistering): (slave veth9): Releasing active interface [ 561.580571][ T6111] bond8 (unregistering): (slave batadv2): Releasing active interface [ 561.590222][ T6111] bond8 (unregistering): Released all slaves [ 561.607212][ T6111] bond9 (unregistering): Released all slaves [ 561.623681][ T6111] bond10 (unregistering): Released all slaves [ 561.648399][ T6111] bond11 (unregistering): Released all slaves [ 561.665866][ T6111] bond12 (unregistering): Released all slaves [ 561.721700][ T5486] 8021q: adding VLAN 0 to HW filter on device eth1 [ 561.919425][T18087] FAULT_INJECTION: forcing a failure. [ 561.919425][T18087] name failslab, interval 1, probability 0, space 0, times 0 [ 561.994214][T18087] CPU: 1 UID: 0 PID: 18087 Comm: syz.2.3076 Not tainted syzkaller #0 PREEMPT(full) [ 561.994242][T18087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 561.994255][T18087] Call Trace: [ 561.994263][T18087] [ 561.994272][T18087] dump_stack_lvl+0xe8/0x150 [ 561.994309][T18087] should_fail_ex+0x412/0x560 [ 561.994342][T18087] should_failslab+0xa8/0x100 [ 561.994366][T18087] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 561.994396][T18087] ? __alloc_skb+0x186/0x7d0 [ 561.994423][T18087] ? __alloc_skb+0x1d0/0x7d0 [ 561.994447][T18087] ? __local_bh_enable_ip+0xd0/0x130 [ 561.994489][T18087] __alloc_skb+0x1d0/0x7d0 [ 561.994522][T18087] netlink_sendmsg+0x5d4/0xb40 [ 561.994562][T18087] ? __pfx_netlink_sendmsg+0x10/0x10 [ 561.994595][T18087] ? aa_sock_msg_perm+0xf1/0x1b0 [ 561.994624][T18087] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 561.994658][T18087] ____sys_sendmsg+0x972/0x9f0 [ 561.994689][T18087] ? __might_fault+0xaf/0x130 [ 561.994722][T18087] ? __pfx_____sys_sendmsg+0x10/0x10 [ 561.994763][T18087] ? import_iovec+0x73/0xa0 [ 561.994787][T18087] ___sys_sendmsg+0x2a5/0x360 [ 561.994816][T18087] ? __lock_acquire+0x6b5/0x2cf0 [ 561.994847][T18087] ? __pfx____sys_sendmsg+0x10/0x10 [ 561.994913][T18087] ? __fget_files+0x2a/0x420 [ 561.994938][T18087] ? __fget_files+0x3a0/0x420 [ 561.994973][T18087] __x64_sys_sendmsg+0x1bd/0x2a0 [ 561.995007][T18087] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 561.995048][T18087] ? __pfx_ksys_write+0x10/0x10 [ 561.995087][T18087] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.995109][T18087] do_syscall_64+0x15f/0xf80 [ 561.995133][T18087] ? trace_irq_disable+0x3b/0x140 [ 561.995154][T18087] ? clear_bhb_loop+0x40/0x90 [ 561.995179][T18087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 561.995199][T18087] RIP: 0033:0x7f5b5a59c819 [ 561.995220][T18087] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 561.995242][T18087] RSP: 002b:00007f5b5b42c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 561.995264][T18087] RAX: ffffffffffffffda RBX: 00007f5b5a815fa0 RCX: 00007f5b5a59c819 [ 561.995279][T18087] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 561.995291][T18087] RBP: 00007f5b5b42c090 R08: 0000000000000000 R09: 0000000000000000 [ 561.995303][T18087] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 561.995314][T18087] R13: 00007f5b5a816038 R14: 00007f5b5a815fa0 R15: 00007fff10c15068 [ 561.995347][T18087] [ 562.247136][T18094] netlink: 'syz.1.3077': attribute type 13 has an invalid length. [ 562.256295][T18094] netlink: 'syz.1.3077': attribute type 17 has an invalid length. [ 562.297693][ T6111] tipc: Disabling bearer [ 562.305296][ T6111] tipc: Left network mode [ 562.311233][T18093] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3077'. [ 562.367242][T18096] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3079'. [ 562.482984][T18094] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.493301][T18094] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 562.512694][T17942] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.551472][T17942] bridge0: port 1(bridge_slave_0) entered disabled state [ 562.581873][T17942] bridge_slave_0: entered allmulticast mode [ 562.624728][T17942] bridge_slave_0: entered promiscuous mode [ 562.664592][ T7695] gre0 speed is unknown, defaulting to 1000 [ 562.667089][T17942] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.679994][T17942] bridge0: port 2(bridge_slave_1) entered disabled state [ 562.682284][ T7695] syz1: Port: 1 Link ACTIVE [ 562.692279][T17942] bridge_slave_1: entered allmulticast mode [ 562.701028][T17942] bridge_slave_1: entered promiscuous mode [ 562.907411][ T5919] gre0 speed is unknown, defaulting to 1000 [ 563.021819][T17942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 563.139400][T17942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 563.221470][T11033] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 563.233745][T18126] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3085'. [ 563.283284][T18129] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3084'. [ 563.335221][T18128] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3085'. [ 563.364964][T18128] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3085'. [ 563.403399][ T5835] Bluetooth: hci1: command tx timeout [ 563.418083][T18128] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3085'. [ 563.533349][T18124] netlink: 'syz.3.3084': attribute type 2 has an invalid length. [ 563.555272][T18124] netlink: 'syz.3.3084': attribute type 1 has an invalid length. [ 563.586987][T18124] netlink: 'syz.3.3084': attribute type 1 has an invalid length. [ 563.800564][ T7695] gre0 speed is unknown, defaulting to 1000 [ 563.832548][ T7695] syz1: Port: 1 Link DOWN [ 563.853849][ T5486] 8021q: adding VLAN 0 to HW filter on device eth2 [ 563.901717][T17942] team0: Port device team_slave_0 added [ 563.965801][T17942] team0: Port device team_slave_1 added [ 563.992635][ T7695] gre0 speed is unknown, defaulting to 1000 [ 564.160939][T17942] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 564.184764][T17942] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 564.189652][T18156] __nla_validate_parse: 211 callbacks suppressed [ 564.189704][T18156] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3089'. [ 564.259261][T17942] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 564.337379][T17942] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 564.346065][T18159] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3093'. [ 564.377647][T17942] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 564.460738][T17942] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 564.604854][ T6111] hsr_slave_0: left promiscuous mode [ 564.612872][T18164] netlink: 'syz.0.3089': attribute type 1 has an invalid length. [ 564.631649][ T6111] hsr_slave_1: left promiscuous mode [ 565.144403][ T6111] team0 (unregistering): Port device team_slave_1 removed [ 565.176926][ T6111] team0 (unregistering): Port device team_slave_0 removed [ 565.322539][T17942] hsr_slave_0: entered promiscuous mode [ 565.330741][T17942] hsr_slave_1: entered promiscuous mode [ 565.337052][T17942] debugfs: 'hsr0' already exists in 'hsr' [ 565.343101][T17942] Cannot create hsr debugfs directory [ 565.478509][ T5835] Bluetooth: hci1: command tx timeout [ 565.528204][T18181] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3098'. [ 565.590522][T18181] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3098'. [ 565.679668][T18181] hsr0: left promiscuous mode [ 565.810654][T18189] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3101'. [ 565.865626][T18189] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3101'. [ 565.986665][T18197] FAULT_INJECTION: forcing a failure. [ 565.986665][T18197] name failslab, interval 1, probability 0, space 0, times 0 [ 566.019257][T18197] CPU: 0 UID: 0 PID: 18197 Comm: syz.0.3102 Not tainted syzkaller #0 PREEMPT(full) [ 566.019288][T18197] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 566.019302][T18197] Call Trace: [ 566.019310][T18197] [ 566.019320][T18197] dump_stack_lvl+0xe8/0x150 [ 566.019357][T18197] should_fail_ex+0x412/0x560 [ 566.019393][T18197] should_failslab+0xa8/0x100 [ 566.019416][T18197] ? skb_clone+0x212/0x3a0 [ 566.019436][T18197] kmem_cache_alloc_noprof+0x87/0x650 [ 566.019468][T18197] ? __netlink_lookup+0xc6/0x8b0 [ 566.019507][T18197] skb_clone+0x212/0x3a0 [ 566.019534][T18197] __netlink_deliver_tap+0x404/0x850 [ 566.019579][T18197] ? netlink_deliver_tap+0x2e/0x1b0 [ 566.019612][T18197] netlink_deliver_tap+0x19c/0x1b0 [ 566.019645][T18197] netlink_unicast+0x730/0x8e0 [ 566.019686][T18197] netlink_sendmsg+0x813/0xb40 [ 566.019729][T18197] ? __pfx_netlink_sendmsg+0x10/0x10 [ 566.019766][T18197] ? aa_sock_msg_perm+0xf1/0x1b0 [ 566.019798][T18197] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 566.019834][T18197] ____sys_sendmsg+0x972/0x9f0 [ 566.019872][T18197] ? __might_fault+0xaf/0x130 [ 566.019907][T18197] ? __pfx_____sys_sendmsg+0x10/0x10 [ 566.019950][T18197] ? import_iovec+0x73/0xa0 [ 566.019977][T18197] ___sys_sendmsg+0x2a5/0x360 [ 566.020010][T18197] ? __lock_acquire+0x6b5/0x2cf0 [ 566.020042][T18197] ? __pfx____sys_sendmsg+0x10/0x10 [ 566.020116][T18197] ? __fget_files+0x2a/0x420 [ 566.020143][T18197] ? __fget_files+0x3a0/0x420 [ 566.020195][T18197] __x64_sys_sendmsg+0x1bd/0x2a0 [ 566.020232][T18197] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 566.020277][T18197] ? __pfx_ksys_write+0x10/0x10 [ 566.020320][T18197] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.020345][T18197] do_syscall_64+0x15f/0xf80 [ 566.020371][T18197] ? trace_irq_disable+0x3b/0x140 [ 566.020395][T18197] ? clear_bhb_loop+0x40/0x90 [ 566.020422][T18197] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.020444][T18197] RIP: 0033:0x7f7511b9c819 [ 566.020464][T18197] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.020484][T18197] RSP: 002b:00007f75129cc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 566.020509][T18197] RAX: ffffffffffffffda RBX: 00007f7511e15fa0 RCX: 00007f7511b9c819 [ 566.020525][T18197] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 566.020539][T18197] RBP: 00007f75129cc090 R08: 0000000000000000 R09: 0000000000000000 [ 566.020553][T18197] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 566.020565][T18197] R13: 00007f7511e16038 R14: 00007f7511e15fa0 R15: 00007ffc7003aeb8 [ 566.020601][T18197] [ 566.020660][T18197] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3102'. [ 566.377763][T18197] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3102'. [ 566.448337][T18197] ip6gretap0: entered promiscuous mode [ 566.455732][T18197] syz_tun: entered promiscuous mode [ 566.563158][T18209] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3106'. [ 566.879420][ T6111] IPVS: stop unused estimator thread 0... [ 567.152573][T18221] tipc: Enabling of bearer rejected, already enabled [ 567.811985][T18257] FAULT_INJECTION: forcing a failure. [ 567.811985][T18257] name failslab, interval 1, probability 0, space 0, times 0 [ 567.841892][T18241] gre0 speed is unknown, defaulting to 1000 [ 567.848311][T18257] CPU: 0 UID: 0 PID: 18257 Comm: syz.3.3115 Not tainted syzkaller #0 PREEMPT(full) [ 567.848340][T18257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 567.848354][T18257] Call Trace: [ 567.848363][T18257] [ 567.848372][T18257] dump_stack_lvl+0xe8/0x150 [ 567.848412][T18257] should_fail_ex+0x412/0x560 [ 567.848449][T18257] should_failslab+0xa8/0x100 [ 567.848474][T18257] __kmalloc_cache_noprof+0x88/0x660 [ 567.848509][T18257] ? rtnl_newlink+0x136/0x1bb0 [ 567.848545][T18257] rtnl_newlink+0x136/0x1bb0 [ 567.848588][T18257] ? __pfx_rtnl_newlink+0x10/0x10 [ 567.848624][T18257] ? __lock_acquire+0x6b5/0x2cf0 [ 567.848656][T18257] ? __lock_acquire+0x6b5/0x2cf0 [ 567.848696][T18257] ? unwind_next_frame+0xa6/0x2550 [ 567.848725][T18257] ? unwind_next_frame+0xa6/0x2550 [ 567.848749][T18257] ? is_bpf_text_address+0x26/0x2b0 [ 567.848789][T18257] ? is_bpf_text_address+0x26/0x2b0 [ 567.848821][T18257] ? __lock_acquire+0x6b5/0x2cf0 [ 567.848853][T18257] ? kernel_text_address+0xa5/0xe0 [ 567.848879][T18257] ? __kernel_text_address+0xd/0x30 [ 567.848902][T18257] ? unwind_get_return_address+0x4d/0x90 [ 567.848922][T18257] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 567.848948][T18257] ? arch_stack_walk+0xfb/0x150 [ 567.848981][T18257] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 567.849026][T18257] ? __pfx_rtnl_newlink+0x10/0x10 [ 567.849054][T18257] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 567.849082][T18257] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 567.849121][T18257] ? netlink_sendmsg+0x5d4/0xb40 [ 567.849155][T18257] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 567.849183][T18257] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 567.849218][T18257] ? __lock_acquire+0x6b5/0x2cf0 [ 567.849260][T18257] netlink_rcv_skb+0x232/0x4b0 [ 567.849292][T18257] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 567.849323][T18257] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 567.849369][T18257] ? netlink_deliver_tap+0x2e/0x1b0 [ 567.849398][T18257] ? netlink_deliver_tap+0x2e/0x1b0 [ 567.849447][T18257] netlink_unicast+0x75c/0x8e0 [ 567.849487][T18257] netlink_sendmsg+0x813/0xb40 [ 567.849530][T18257] ? __pfx_netlink_sendmsg+0x10/0x10 [ 567.849567][T18257] ? aa_sock_msg_perm+0xf1/0x1b0 [ 567.849599][T18257] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 567.849636][T18257] ____sys_sendmsg+0x972/0x9f0 [ 567.849670][T18257] ? __might_fault+0xaf/0x130 [ 567.849706][T18257] ? __pfx_____sys_sendmsg+0x10/0x10 [ 567.849749][T18257] ? import_iovec+0x73/0xa0 [ 567.849775][T18257] ___sys_sendmsg+0x2a5/0x360 [ 567.849805][T18257] ? __lock_acquire+0x6b5/0x2cf0 [ 567.849837][T18257] ? __pfx____sys_sendmsg+0x10/0x10 [ 567.849909][T18257] ? __fget_files+0x2a/0x420 [ 567.849936][T18257] ? __fget_files+0x3a0/0x420 [ 567.849982][T18257] __x64_sys_sendmsg+0x1bd/0x2a0 [ 567.850018][T18257] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 567.850063][T18257] ? __pfx_ksys_write+0x10/0x10 [ 567.850104][T18257] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.850135][T18257] do_syscall_64+0x15f/0xf80 [ 567.850161][T18257] ? trace_irq_disable+0x3b/0x140 [ 567.850185][T18257] ? clear_bhb_loop+0x40/0x90 [ 567.850212][T18257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.850234][T18257] RIP: 0033:0x7fe18f19c819 [ 567.850255][T18257] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 567.850274][T18257] RSP: 002b:00007fe18ff84028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 567.850298][T18257] RAX: ffffffffffffffda RBX: 00007fe18f415fa0 RCX: 00007fe18f19c819 [ 567.850314][T18257] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 567.850328][T18257] RBP: 00007fe18ff84090 R08: 0000000000000000 R09: 0000000000000000 [ 567.850342][T18257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.850355][T18257] R13: 00007fe18f416038 R14: 00007fe18f415fa0 R15: 00007ffc2d27b238 [ 567.850389][T18257] [ 568.573251][T18272] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3118'. [ 568.650502][T17942] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 568.671827][T17942] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 568.697004][T17942] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 568.739107][T17942] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 568.764562][T17942] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 568.816753][T17942] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 568.861751][T17942] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 568.895417][T17942] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 568.913707][T18282] tipc: Started in network mode [ 568.919421][T18282] tipc: Node identity ac1414aa, cluster identity 4711 [ 568.929709][T18282] tipc: Enabled bearer , priority 10 [ 569.007242][T18289] bridge4: entered promiscuous mode [ 569.040267][T18289] bridge4: port 1(macvtap0) entered blocking state [ 569.061433][T18289] bridge4: port 1(macvtap0) entered disabled state [ 569.077899][T18289] macvtap0: entered allmulticast mode [ 569.083533][T18289] bridge4: entered allmulticast mode [ 569.092898][T18289] macvtap0: left allmulticast mode [ 569.111490][T18289] bridge4: left allmulticast mode [ 569.133179][T18289] bridge4: left promiscuous mode [ 569.234792][T18295] __nla_validate_parse: 2 callbacks suppressed [ 569.234880][T18295] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3123'. [ 569.292067][T18295] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3123'. [ 569.344404][T18295] bond0: entered promiscuous mode [ 569.357711][T18295] bond_slave_0: entered promiscuous mode [ 569.364370][T18295] bond_slave_1: entered promiscuous mode [ 569.398575][T18295] bond0: left promiscuous mode [ 569.413390][T18295] bond_slave_0: left promiscuous mode [ 569.426905][T18295] bond_slave_1: left promiscuous mode [ 569.484097][T18310] netlink: 84 bytes leftover after parsing attributes in process `syz.3.3124'. [ 569.729194][T17942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 569.806878][T18320] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3126'. [ 569.825690][T18317] gre0 speed is unknown, defaulting to 1000 [ 569.825937][T18320] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3126'. [ 569.866973][T17942] 8021q: adding VLAN 0 to HW filter on device team0 [ 569.916733][T11037] bridge0: port 1(bridge_slave_0) entered blocking state [ 569.924068][T11037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 569.979904][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 569.987177][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 570.070993][ T9489] tipc: Node number set to 2886997162 [ 570.636492][T18343] tipc: Enabled bearer , priority 10 [ 570.784497][T17942] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 570.827695][T18329] gre0 speed is unknown, defaulting to 1000 [ 571.631309][T18377] tipc: Enabling of bearer rejected, already enabled [ 571.743306][T18377] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3133'. [ 571.763441][T18377] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3133'. [ 571.817981][T18377] ip6gretap0: entered promiscuous mode [ 571.846253][T18377] ip6gretap0: left promiscuous mode [ 571.872420][T18382] netlink: 'syz.2.3134': attribute type 58 has an invalid length. [ 572.193027][T18386] tipc: Enabled bearer , priority 0 [ 572.497420][T18382] syzkaller0: entered promiscuous mode [ 572.541290][T18382] syzkaller0: entered allmulticast mode [ 572.553649][T18382] tipc: Resetting bearer [ 572.649441][T17942] veth0_vlan: entered promiscuous mode [ 572.704191][T17942] veth1_vlan: entered promiscuous mode [ 572.846634][T18380] tipc: Resetting bearer [ 573.666990][T18431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3141'. [ 573.676348][T18431] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3141'. [ 575.143756][T18380] tipc: Disabling bearer [ 575.193229][T17942] veth0_macvtap: entered promiscuous mode [ 575.204646][T17942] veth1_macvtap: entered promiscuous mode [ 575.233096][T17942] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 575.263597][T17942] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 575.310735][T11035] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 575.354277][T11035] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 575.398550][T11033] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 575.430037][T11033] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 575.480372][T18436] netlink: 'syz.2.3145': attribute type 2 has an invalid length. [ 575.513948][T18438] netlink: 'syz.3.3143': attribute type 1 has an invalid length. [ 575.972383][T18460] bpq0: left promiscuous mode [ 576.012080][T11035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 576.057421][T11035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 576.295161][T18470] bond0: up delay (1024) is not a multiple of miimon (100), value rounded to 1000 ms [ 576.321958][T18470] bond0: down delay (4) is not a multiple of miimon (100), value rounded to 0 ms [ 576.392032][ T9697] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 576.424543][ T9697] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 576.457167][T18478] gre0 speed is unknown, defaulting to 1000 [ 576.873641][T18499] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3155'. [ 577.373960][T17368] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 577.386176][T17368] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 577.394576][T17368] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 577.408921][T17368] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 577.417382][T17368] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 577.783063][T18513] gre0 speed is unknown, defaulting to 1000 [ 579.478034][T17368] Bluetooth: hci2: command tx timeout [ 579.711713][T18513] chnl_net:caif_netlink_parms(): no params data found [ 580.013732][T18513] bridge0: port 1(bridge_slave_0) entered blocking state [ 580.028167][T18513] bridge0: port 1(bridge_slave_0) entered disabled state [ 580.038234][T18513] bridge_slave_0: entered allmulticast mode [ 580.092783][T18513] bridge_slave_0: entered promiscuous mode [ 580.143034][T18513] bridge0: port 2(bridge_slave_1) entered blocking state [ 580.148127][T18597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3169'. [ 580.172773][T18513] bridge0: port 2(bridge_slave_1) entered disabled state [ 580.183685][T18513] bridge_slave_1: entered allmulticast mode [ 580.201398][T18513] bridge_slave_1: entered promiscuous mode [ 580.258829][T18608] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3172'. [ 580.290344][T18608] openvswitch: netlink: Flow key attr not present in new flow. [ 580.430663][T18513] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.489736][T18513] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 580.642298][T18619] gtp2: entered promiscuous mode [ 580.661390][T18619] gtp2: entered allmulticast mode [ 580.758662][T18513] team0: Port device team_slave_0 added [ 580.785375][T18513] team0: Port device team_slave_1 added [ 581.009785][T18632] gre0 speed is unknown, defaulting to 1000 [ 581.020996][T18513] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 581.054225][T18513] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.104524][T18513] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 581.122726][T18513] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 581.130482][T18513] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 581.187387][T18513] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 581.238536][T18649] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3180'. [ 581.300733][T18649] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3180'. [ 581.486386][T18513] hsr_slave_0: entered promiscuous mode [ 581.504647][T18513] hsr_slave_1: entered promiscuous mode [ 581.521065][T18513] debugfs: 'hsr0' already exists in 'hsr' [ 581.535141][T18513] Cannot create hsr debugfs directory [ 581.559948][T17368] Bluetooth: hci2: command tx timeout [ 582.003768][T18647] gre0 speed is unknown, defaulting to 1000 [ 582.531483][T18681] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3185'. [ 582.751317][T18686] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3187'. [ 582.763193][T18686] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3187'. [ 583.455366][T11036] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.593011][T11036] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.629815][T11036] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.638781][T17368] Bluetooth: hci2: command tx timeout [ 583.653803][T11036] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 583.968551][T18513] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 584.004327][T18513] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 584.017336][T18513] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 584.055473][T18513] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 584.086769][T18513] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 584.106493][T18513] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 584.126783][T18513] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 584.143525][T18513] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 584.155172][T18719] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3196'. [ 584.495736][T18513] 8021q: adding VLAN 0 to HW filter on device bond0 [ 584.573792][T18513] 8021q: adding VLAN 0 to HW filter on device team0 [ 584.623865][T11037] bridge0: port 1(bridge_slave_0) entered blocking state [ 584.631120][T11037] bridge0: port 1(bridge_slave_0) entered forwarding state [ 584.636929][T18712] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3194'. [ 584.656258][T18712] netlink: 'syz.0.3194': attribute type 6 has an invalid length. [ 584.665189][T18739] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3199'. [ 584.675499][T18738] netlink: 'syz.3.3201': attribute type 29 has an invalid length. [ 584.687300][T18738] netlink: 'syz.3.3201': attribute type 29 has an invalid length. [ 584.699804][T18712] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 584.717223][T18738] netlink: 508 bytes leftover after parsing attributes in process `syz.3.3201'. [ 584.738386][T18738] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 584.750142][T18712] bridge0: port 2(bridge_slave_1) entered disabled state [ 584.761772][T18712] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.781293][T18743] netlink: 'syz.4.3200': attribute type 10 has an invalid length. [ 584.790534][T18738] netlink: 'syz.3.3201': attribute type 1 has an invalid length. [ 584.867913][T18743] syz_tun: entered promiscuous mode [ 584.906549][T18743] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 584.940207][T11036] bridge0: port 2(bridge_slave_1) entered blocking state [ 584.947445][T11036] bridge0: port 2(bridge_slave_1) entered forwarding state [ 585.001526][T18746] netlink: 'syz.3.3202': attribute type 1 has an invalid length. [ 585.146552][T18748] bond9: (slave ip6gretap0): Enslaving as a backup interface with an up link [ 585.178985][T18751] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3202'. [ 585.199633][T18751] 8021q: adding VLAN 0 to HW filter on device bond9 [ 585.218082][ T36] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 585.247363][T18746] veth9: entered promiscuous mode [ 585.262016][T18746] bond9: (slave veth9): Enslaving as a backup interface with a down link [ 585.359610][T11036] bond9: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 585.493285][T18761] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3206'. [ 585.524005][T18761] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3206'. [ 585.549131][T18761] FAULT_INJECTION: forcing a failure. [ 585.549131][T18761] name failslab, interval 1, probability 0, space 0, times 0 [ 585.575759][T18761] CPU: 0 UID: 0 PID: 18761 Comm: syz.4.3206 Not tainted syzkaller #0 PREEMPT(full) [ 585.575790][T18761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 585.575803][T18761] Call Trace: [ 585.575812][T18761] [ 585.575822][T18761] dump_stack_lvl+0xe8/0x150 [ 585.575860][T18761] should_fail_ex+0x412/0x560 [ 585.575898][T18761] should_failslab+0xa8/0x100 [ 585.575925][T18761] __kvmalloc_node_noprof+0x178/0x8a0 [ 585.575947][T18761] ? alloc_netdev_mqs+0x8a6/0x11b0 [ 585.575982][T18761] alloc_netdev_mqs+0x8a6/0x11b0 [ 585.576015][T18761] rtnl_create_link+0x31f/0xd70 [ 585.576048][T18761] rtnl_newlink_create+0x277/0xb70 [ 585.576081][T18761] ? __pfx___nla_validate_parse+0x10/0x10 [ 585.576116][T18761] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 585.576154][T18761] ? __pfx___mutex_lock+0x10/0x10 [ 585.576194][T18761] ? ns_capable+0x89/0xe0 [ 585.576228][T18761] rtnl_newlink+0x166a/0x1bb0 [ 585.576276][T18761] ? __pfx_rtnl_newlink+0x10/0x10 [ 585.576303][T18761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.576369][T18761] ? kasan_quarantine_put+0xbb/0x1f0 [ 585.576400][T18761] ? lockdep_hardirqs_on+0x7a/0x110 [ 585.576432][T18761] ? nlmon_xmit+0xb0/0x100 [ 585.576456][T18761] ? kmem_cache_free+0x180/0x630 [ 585.576504][T18761] ? __lock_acquire+0x6b5/0x2cf0 [ 585.576545][T18761] ? __dev_queue_xmit+0x2b6/0x3950 [ 585.576572][T18761] ? __local_bh_enable_ip+0xd0/0x130 [ 585.576602][T18761] ? lockdep_hardirqs_on+0x7a/0x110 [ 585.576627][T18761] ? __dev_queue_xmit+0x2b6/0x3950 [ 585.576647][T18761] ? __local_bh_enable_ip+0xd0/0x130 [ 585.576675][T18761] ? __dev_queue_xmit+0x2b6/0x3950 [ 585.576706][T18761] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 585.576754][T18761] ? __pfx_rtnl_newlink+0x10/0x10 [ 585.576788][T18761] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 585.576822][T18761] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 585.576850][T18761] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 585.576878][T18761] ? ref_tracker_free+0x693/0x840 [ 585.576913][T18761] ? __pfx_ref_tracker_free+0x10/0x10 [ 585.576959][T18761] netlink_rcv_skb+0x232/0x4b0 [ 585.576992][T18761] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 585.577024][T18761] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 585.577071][T18761] ? netlink_deliver_tap+0x2e/0x1b0 [ 585.577101][T18761] ? netlink_deliver_tap+0x2e/0x1b0 [ 585.577139][T18761] netlink_unicast+0x75c/0x8e0 [ 585.577182][T18761] netlink_sendmsg+0x813/0xb40 [ 585.577225][T18761] ? __pfx_netlink_sendmsg+0x10/0x10 [ 585.577261][T18761] ? aa_sock_msg_perm+0xf1/0x1b0 [ 585.577294][T18761] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 585.577331][T18761] ____sys_sendmsg+0x972/0x9f0 [ 585.577365][T18761] ? __might_fault+0xaf/0x130 [ 585.577402][T18761] ? __pfx_____sys_sendmsg+0x10/0x10 [ 585.577448][T18761] ? import_iovec+0x73/0xa0 [ 585.577474][T18761] ___sys_sendmsg+0x2a5/0x360 [ 585.577507][T18761] ? __lock_acquire+0x6b5/0x2cf0 [ 585.577548][T18761] ? __pfx____sys_sendmsg+0x10/0x10 [ 585.577625][T18761] ? __fget_files+0x2a/0x420 [ 585.577653][T18761] ? __fget_files+0x3a0/0x420 [ 585.577694][T18761] __x64_sys_sendmsg+0x1bd/0x2a0 [ 585.577733][T18761] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 585.577780][T18761] ? __pfx_ksys_write+0x10/0x10 [ 585.577823][T18761] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.577848][T18761] do_syscall_64+0x15f/0xf80 [ 585.577875][T18761] ? trace_irq_disable+0x3b/0x140 [ 585.577898][T18761] ? clear_bhb_loop+0x40/0x90 [ 585.577926][T18761] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.577949][T18761] RIP: 0033:0x7f7641b9c819 [ 585.577970][T18761] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 585.577991][T18761] RSP: 002b:00007f7642afa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 585.578015][T18761] RAX: ffffffffffffffda RBX: 00007f7641e15fa0 RCX: 00007f7641b9c819 [ 585.578031][T18761] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 000000000000000b [ 585.578046][T18761] RBP: 00007f7642afa090 R08: 0000000000000000 R09: 0000000000000000 [ 585.578059][T18761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 585.578073][T18761] R13: 00007f7641e16038 R14: 00007f7641e15fa0 R15: 00007ffe18343ac8 [ 585.578109][T18761] [ 586.078641][T17368] Bluetooth: hci2: command tx timeout [ 586.152175][T18764] gre0 speed is unknown, defaulting to 1000 [ 586.310032][T18777] delete_channel: no stack [ 586.345209][T18777] ip6t_srh: unknown srh match flags 4000 [ 586.380606][T18775] bridge0: entered promiscuous mode [ 586.387670][T18775] vlan3: entered promiscuous mode [ 586.392763][T18775] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:609 [ 586.402240][T18775] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 18775, name: syz.3.3209 [ 586.411527][T18775] preempt_count: 201, expected: 0 [ 586.416575][T18775] RCU nest depth: 0, expected: 0 [ 586.421616][T18775] 2 locks held by syz.3.3209/18775: [ 586.426847][T18775] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 586.436072][T18775] #1: ffff88807bc20370 (&dev_addr_list_lock_key#7/2){+...}-{3:3}, at: dev_set_rx_mode+0x65/0x2d0 [ 586.446842][T18775] Preemption disabled at: [ 586.446859][T18775] [] dev_set_rx_mode+0x54/0x2d0 [ 586.457787][T18775] CPU: 0 UID: 0 PID: 18775 Comm: syz.3.3209 Not tainted syzkaller #0 PREEMPT(full) [ 586.457815][T18775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 586.457830][T18775] Call Trace: [ 586.457839][T18775] [ 586.457854][T18775] dump_stack_lvl+0xe8/0x150 [ 586.457893][T18775] __might_resched+0x378/0x4d0 [ 586.457929][T18775] ? dev_set_rx_mode+0x54/0x2d0 [ 586.457967][T18775] __mutex_lock+0x11c/0x1550 [ 586.458003][T18775] ? __pfx__printk+0x10/0x10 [ 586.458026][T18775] ? vprintk_emit+0x4eb/0x560 [ 586.458062][T18775] ? dev_set_promiscuity+0x10e/0x260 [ 586.458092][T18775] ? __netdev_printk+0x36f/0x480 [ 586.458118][T18775] ? __pfx___mutex_lock+0x10/0x10 [ 586.458148][T18775] ? netdev_info+0x11e/0x180 [ 586.458178][T18775] ? __pfx_netdev_info+0x10/0x10 [ 586.458211][T18775] dev_set_promiscuity+0x10e/0x260 [ 586.458247][T18775] ? __pfx_vlan_dev_change_rx_flags+0x10/0x10 [ 586.458280][T18775] __dev_set_promiscuity+0x515/0x710 [ 586.458315][T18775] ? netdev_info+0x11e/0x180 [ 586.458343][T18775] netif_set_promiscuity+0x50/0xe0 [ 586.458379][T18775] dev_set_promiscuity+0x126/0x260 [ 586.458425][T18775] br_manage_promisc+0x180/0x560 [ 586.458465][T18775] ? __pfx_br_dev_change_rx_flags+0x10/0x10 [ 586.458491][T18775] __dev_set_promiscuity+0x515/0x710 [ 586.458534][T18775] dev_set_rx_mode+0x1c9/0x2d0 [ 586.458570][T18775] __dev_open+0x672/0x830 [ 586.458605][T18775] ? __pfx___dev_open+0x10/0x10 [ 586.458630][T18775] ? __dev_change_flags+0x1b0/0x690 [ 586.458665][T18775] ? __local_bh_enable_ip+0xd0/0x130 [ 586.458703][T18775] __dev_change_flags+0x1f7/0x690 [ 586.458744][T18775] ? __pfx___dev_change_flags+0x10/0x10 [ 586.458775][T18775] ? netif_state_change+0x297/0x3a0 [ 586.458806][T18775] ? __pfx_netif_state_change+0x10/0x10 [ 586.458842][T18775] netif_change_flags+0x88/0x1a0 [ 586.458882][T18775] do_setlink+0xf82/0x4590 [ 586.458919][T18775] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 586.458958][T18775] ? __pfx_do_setlink+0x10/0x10 [ 586.458995][T18775] ? __pfx_stack_trace_save+0x10/0x10 [ 586.459043][T18775] ? __mutex_trylock_common+0x158/0x260 [ 586.459082][T18775] ? __pfx___mutex_trylock_common+0x10/0x10 [ 586.459122][T18775] ? rcu_is_watching+0x15/0xb0 [ 586.459155][T18775] ? trace_contention_end+0x3d/0x140 [ 586.459178][T18775] ? __mutex_lock+0x319/0x1550 [ 586.459207][T18775] ? __pfx___nla_validate_parse+0x10/0x10 [ 586.459244][T18775] ? rtnl_newlink+0x883/0x1bb0 [ 586.459275][T18775] ? __pfx___mutex_lock+0x10/0x10 [ 586.459316][T18775] ? ns_capable+0x89/0xe0 [ 586.459354][T18775] rtnl_newlink+0x14ca/0x1bb0 [ 586.459396][T18775] ? __pfx_rtnl_newlink+0x10/0x10 [ 586.459440][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 586.459472][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 586.459513][T18775] ? unwind_next_frame+0xa6/0x2550 [ 586.459539][T18775] ? unwind_next_frame+0xa6/0x2550 [ 586.459559][T18775] ? is_bpf_text_address+0x26/0x2b0 [ 586.459591][T18775] ? is_bpf_text_address+0x26/0x2b0 [ 586.459618][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 586.459644][T18775] ? kernel_text_address+0xa5/0xe0 [ 586.459667][T18775] ? __kernel_text_address+0xd/0x30 [ 586.459687][T18775] ? unwind_get_return_address+0x4d/0x90 [ 586.459704][T18775] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 586.459724][T18775] ? arch_stack_walk+0xfb/0x150 [ 586.459751][T18775] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 586.459789][T18775] ? __pfx_rtnl_newlink+0x10/0x10 [ 586.459813][T18775] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 586.459835][T18775] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 586.459862][T18775] ? netlink_sendmsg+0x5d4/0xb40 [ 586.459890][T18775] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 586.459914][T18775] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 586.459939][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 586.459975][T18775] netlink_rcv_skb+0x232/0x4b0 [ 586.460002][T18775] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 586.460028][T18775] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 586.460065][T18775] ? netlink_deliver_tap+0x2e/0x1b0 [ 586.460091][T18775] ? netlink_deliver_tap+0x2e/0x1b0 [ 586.460122][T18775] netlink_unicast+0x75c/0x8e0 [ 586.460160][T18775] netlink_sendmsg+0x813/0xb40 [ 586.460196][T18775] ? __pfx_netlink_sendmsg+0x10/0x10 [ 586.460226][T18775] ? aa_sock_msg_perm+0xf1/0x1b0 [ 586.460253][T18775] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 586.460284][T18775] ____sys_sendmsg+0x972/0x9f0 [ 586.460312][T18775] ? __might_fault+0xaf/0x130 [ 586.460343][T18775] ? __pfx_____sys_sendmsg+0x10/0x10 [ 586.460380][T18775] ? import_iovec+0x73/0xa0 [ 586.460401][T18775] ___sys_sendmsg+0x2a5/0x360 [ 586.460436][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 586.460464][T18775] ? __pfx____sys_sendmsg+0x10/0x10 [ 586.460499][T18775] ? futex_wake+0x4ac/0x580 [ 586.460541][T18775] ? __fget_files+0x2a/0x420 [ 586.460564][T18775] ? __fget_files+0x3a0/0x420 [ 586.460597][T18775] __x64_sys_sendmsg+0x1bd/0x2a0 [ 586.460628][T18775] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 586.460665][T18775] ? rcu_is_watching+0x15/0xb0 [ 586.460700][T18775] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.460720][T18775] do_syscall_64+0x15f/0xf80 [ 586.460742][T18775] ? trace_irq_disable+0x3b/0x140 [ 586.460761][T18775] ? clear_bhb_loop+0x40/0x90 [ 586.460783][T18775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 586.460802][T18775] RIP: 0033:0x7fe18f19c819 [ 586.460820][T18775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 586.460836][T18775] RSP: 002b:00007fe18d3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 586.460857][T18775] RAX: ffffffffffffffda RBX: 00007fe18f416090 RCX: 00007fe18f19c819 [ 586.460870][T18775] RDX: 0000000004000000 RSI: 0000200000000200 RDI: 0000000000000008 [ 586.460882][T18775] RBP: 00007fe18f232c91 R08: 0000000000000000 R09: 0000000000000000 [ 586.460893][T18775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 586.460904][T18775] R13: 00007fe18f416128 R14: 00007fe18f416090 R15: 00007ffc2d27b238 [ 586.460932][T18775] [ 586.460956][T18775] [ 587.039593][T18775] ============================= [ 587.044474][T18775] [ BUG: Invalid wait context ] [ 587.049339][T18775] syzkaller #0 Tainted: G W [ 587.055337][T18775] ----------------------------- [ 587.060205][T18775] syz.3.3209/18775 is trying to lock: [ 587.065607][T18775] ffff888035eded88 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: dev_set_promiscuity+0x10e/0x260 [ 587.076014][T18775] other info that might help us debug this: [ 587.081920][T18775] context-{5:5} [ 587.085390][T18775] 2 locks held by syz.3.3209/18775: [ 587.090691][T18775] #0: ffffffff8fdceac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 [ 587.099787][T18775] #1: ffff88807bc20370 (&dev_addr_list_lock_key#7/2){+...}-{3:3}, at: dev_set_rx_mode+0x65/0x2d0 [ 587.110462][T18775] stack backtrace: [ 587.114212][T18775] CPU: 0 UID: 0 PID: 18775 Comm: syz.3.3209 Tainted: G W syzkaller #0 PREEMPT(full) [ 587.114238][T18775] Tainted: [W]=WARN [ 587.114244][T18775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 587.114256][T18775] Call Trace: [ 587.114264][T18775] [ 587.114273][T18775] dump_stack_lvl+0xe8/0x150 [ 587.114301][T18775] __lock_acquire+0xec1/0x2cf0 [ 587.114327][T18775] ? lockdep_hardirqs_on+0x7a/0x110 [ 587.114350][T18775] ? irqentry_exit+0x218/0x730 [ 587.114370][T18775] ? trace_irq_disable+0x3b/0x140 [ 587.114396][T18775] ? dev_set_promiscuity+0x10e/0x260 [ 587.114428][T18775] lock_acquire+0x106/0x350 [ 587.114451][T18775] ? dev_set_promiscuity+0x10e/0x260 [ 587.114480][T18775] ? __might_resched+0x378/0x4d0 [ 587.114509][T18775] __mutex_lock+0x1a3/0x1550 [ 587.114532][T18775] ? dev_set_promiscuity+0x10e/0x260 [ 587.114560][T18775] ? __pfx__printk+0x10/0x10 [ 587.114577][T18775] ? vprintk_emit+0x4eb/0x560 [ 587.114605][T18775] ? dev_set_promiscuity+0x10e/0x260 [ 587.114633][T18775] ? __pfx___mutex_lock+0x10/0x10 [ 587.114656][T18775] ? netdev_info+0x11e/0x180 [ 587.114677][T18775] ? __pfx_netdev_info+0x10/0x10 [ 587.114699][T18775] dev_set_promiscuity+0x10e/0x260 [ 587.114727][T18775] ? __pfx_vlan_dev_change_rx_flags+0x10/0x10 [ 587.114753][T18775] __dev_set_promiscuity+0x515/0x710 [ 587.114780][T18775] ? netdev_info+0x11e/0x180 [ 587.114800][T18775] netif_set_promiscuity+0x50/0xe0 [ 587.114827][T18775] dev_set_promiscuity+0x126/0x260 [ 587.114856][T18775] br_manage_promisc+0x180/0x560 [ 587.114886][T18775] ? __pfx_br_dev_change_rx_flags+0x10/0x10 [ 587.114907][T18775] __dev_set_promiscuity+0x515/0x710 [ 587.114937][T18775] dev_set_rx_mode+0x1c9/0x2d0 [ 587.114964][T18775] __dev_open+0x672/0x830 [ 587.114989][T18775] ? __pfx___dev_open+0x10/0x10 [ 587.115009][T18775] ? __dev_change_flags+0x1b0/0x690 [ 587.115037][T18775] ? __local_bh_enable_ip+0xd0/0x130 [ 587.115063][T18775] __dev_change_flags+0x1f7/0x690 [ 587.115093][T18775] ? __pfx___dev_change_flags+0x10/0x10 [ 587.115118][T18775] ? netif_state_change+0x297/0x3a0 [ 587.115141][T18775] ? __pfx_netif_state_change+0x10/0x10 [ 587.115165][T18775] netif_change_flags+0x88/0x1a0 [ 587.115194][T18775] do_setlink+0xf82/0x4590 [ 587.115221][T18775] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 587.115247][T18775] ? __pfx_do_setlink+0x10/0x10 [ 587.115274][T18775] ? __pfx_stack_trace_save+0x10/0x10 [ 587.115302][T18775] ? __mutex_trylock_common+0x158/0x260 [ 587.115332][T18775] ? __pfx___mutex_trylock_common+0x10/0x10 [ 587.115362][T18775] ? rcu_is_watching+0x15/0xb0 [ 587.115388][T18775] ? trace_contention_end+0x3d/0x140 [ 587.115412][T18775] ? __mutex_lock+0x319/0x1550 [ 587.115435][T18775] ? __pfx___nla_validate_parse+0x10/0x10 [ 587.115458][T18775] ? rtnl_newlink+0x883/0x1bb0 [ 587.115482][T18775] ? __pfx___mutex_lock+0x10/0x10 [ 587.115509][T18775] ? ns_capable+0x89/0xe0 [ 587.115535][T18775] rtnl_newlink+0x14ca/0x1bb0 [ 587.115566][T18775] ? __pfx_rtnl_newlink+0x10/0x10 [ 587.115592][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 587.115616][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 587.115644][T18775] ? unwind_next_frame+0xa6/0x2550 [ 587.115665][T18775] ? unwind_next_frame+0xa6/0x2550 [ 587.115682][T18775] ? is_bpf_text_address+0x26/0x2b0 [ 587.115709][T18775] ? is_bpf_text_address+0x26/0x2b0 [ 587.115733][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 587.115758][T18775] ? kernel_text_address+0xa5/0xe0 [ 587.115779][T18775] ? __kernel_text_address+0xd/0x30 [ 587.115798][T18775] ? unwind_get_return_address+0x4d/0x90 [ 587.115814][T18775] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 587.115834][T18775] ? arch_stack_walk+0xfb/0x150 [ 587.115856][T18775] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 587.115886][T18775] ? __pfx_rtnl_newlink+0x10/0x10 [ 587.115910][T18775] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 587.115933][T18775] ? kmem_cache_alloc_node_noprof+0x384/0x690 [ 587.115961][T18775] ? netlink_sendmsg+0x5d4/0xb40 [ 587.115988][T18775] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 587.116011][T18775] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 587.116036][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 587.116064][T18775] netlink_rcv_skb+0x232/0x4b0 [ 587.116090][T18775] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 587.116115][T18775] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 587.116146][T18775] ? netlink_deliver_tap+0x2e/0x1b0 [ 587.116171][T18775] ? netlink_deliver_tap+0x2e/0x1b0 [ 587.116199][T18775] netlink_unicast+0x75c/0x8e0 [ 587.116226][T18775] netlink_sendmsg+0x813/0xb40 [ 587.116256][T18775] ? __pfx_netlink_sendmsg+0x10/0x10 [ 587.116284][T18775] ? aa_sock_msg_perm+0xf1/0x1b0 [ 587.116309][T18775] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 587.116338][T18775] ____sys_sendmsg+0x972/0x9f0 [ 587.116366][T18775] ? __might_fault+0xaf/0x130 [ 587.116393][T18775] ? __pfx_____sys_sendmsg+0x10/0x10 [ 587.116430][T18775] ? import_iovec+0x73/0xa0 [ 587.116448][T18775] ___sys_sendmsg+0x2a5/0x360 [ 587.116475][T18775] ? __lock_acquire+0x6b5/0x2cf0 [ 587.116500][T18775] ? __pfx____sys_sendmsg+0x10/0x10 [ 587.116531][T18775] ? futex_wake+0x4ac/0x580 [ 587.116560][T18775] ? __fget_files+0x2a/0x420 [ 587.116582][T18775] ? __fget_files+0x3a0/0x420 [ 587.116609][T18775] __x64_sys_sendmsg+0x1bd/0x2a0 [ 587.116638][T18775] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 587.116672][T18775] ? rcu_is_watching+0x15/0xb0 [ 587.116702][T18775] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.116721][T18775] do_syscall_64+0x15f/0xf80 [ 587.116742][T18775] ? trace_irq_disable+0x3b/0x140 [ 587.116760][T18775] ? clear_bhb_loop+0x40/0x90 [ 587.116781][T18775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.116799][T18775] RIP: 0033:0x7fe18f19c819 [ 587.116816][T18775] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 587.116832][T18775] RSP: 002b:00007fe18d3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 587.116852][T18775] RAX: ffffffffffffffda RBX: 00007fe18f416090 RCX: 00007fe18f19c819 [ 587.116865][T18775] RDX: 0000000004000000 RSI: 0000200000000200 RDI: 0000000000000008 [ 587.116878][T18775] RBP: 00007fe18f232c91 R08: 0000000000000000 R09: 0000000000000000 [ 587.116890][T18775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 587.116900][T18775] R13: 00007fe18f416128 R14: 00007fe18f416090 R15: 00007ffc2d27b238 [ 587.116922][T18775] [ 587.728117][T18775] dummy0: entered promiscuous mode [ 587.816267][T18775] 8021q: adding VLAN 0 to HW filter on device .` [ 587.845891][T18775] 8021q: adding VLAN 0 to HW filter on device team0 [ 587.856670][T18775] bridge0: port 3(vlan3) entered blocking state [ 587.863063][T18775] bridge0: port 3(vlan3) entered forwarding state [ 587.873848][T18775] chnl_net:chnl_net_open(): err: Unable to register and open device, Err:-19 [ 587.884242][T18775] caif:caif_disconnect_client(): nothing to disconnect [ 587.891307][T18775] chnl_net:chnl_flowctrl_cb(): NET flowctrl func called flow: CLOSE/DEINIT [ 587.900301][T18775] chnl_net:chnl_net_open(): state disconnected [ 587.906492][T18775] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 587.998574][T18513] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 588.036238][T18513] veth0_vlan: entered promiscuous mode [ 588.049597][T18513] veth1_vlan: entered promiscuous mode [ 588.081178][T18513] veth0_macvtap: entered promiscuous mode [ 588.114419][T18513] veth1_macvtap: entered promiscuous mode [ 588.143630][T18513] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 588.156476][T18513] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 588.176213][ T36] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.186662][ T36] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.200073][ T36] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.212399][ T36] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 588.236716][T18513] ieee80211 phy38: Selected rate control algorithm 'minstrel_ht' [ 588.263689][T18513] ieee80211 phy39: Selected rate control algorithm 'minstrel_ht' [ 588.273045][ T9697] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.281369][ T9697] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 588.308181][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 588.316132][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50