last executing test programs: 2.020205095s ago: executing program 1 (id=6520): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000200000000000000b00000008000300", @ANYRES32=r2, @ANYBLOB="0500080000000000090007004ff5677c1a000000080009000cac0f"], 0x38}}, 0x0) 1.901869194s ago: executing program 1 (id=6525): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_DELTABLE={0x2c, 0x2, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x54}}, 0x0) 1.840443702s ago: executing program 1 (id=6527): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)={0x20, 0xd, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 1.727221884s ago: executing program 1 (id=6529): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f0000000440)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x20, 0x0, 0x5, 0xfffff010}, {0x6, 0x0, 0x2}]}, 0x10) connect$qrtr(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x16a, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa0008004a01015c006400000921"], 0x0) 1.689014731s ago: executing program 1 (id=6533): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000540)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x800, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x58, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0x9}, {}, {0x1, 0xfff1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x28, 0x2, [@TCA_CGROUP_EMATCHES={0x24, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x14, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x80}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x58}}, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.547495642s ago: executing program 1 (id=6537): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x5e20, 0xc8, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x4}, 0x1c) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000500)={0xa, 0x5e20, 0xc8, @ipv4={'\x00', '\xff\xff', @private}, 0x4}, 0x1c) 1.377624117s ago: executing program 0 (id=6544): r0 = socket(0x200000000000011, 0x2, 0xd) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0xe0, 0x0, 0x6, 0x0, @local, @private=0xa010102}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) 1.211113759s ago: executing program 0 (id=6548): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000cc0)={0x2c, r1, 0x605, 0x70bd25, 0x25dfdc01, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x41840) 1.043903397s ago: executing program 0 (id=6550): bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x8, 0x0, 0x0, 0x8}, [@call={0x85, 0x0, 0x0, 0xf}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.043635727s ago: executing program 4 (id=6551): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'batadv_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32=r1], 0x270}}, 0x0) 877.566733ms ago: executing program 3 (id=6552): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="180000002500010324bd7002ffdbdf250180"], 0x18}, 0x1, 0x0, 0x0, 0x4008}, 0x0) recvmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x40000000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) 818.951397ms ago: executing program 4 (id=6554): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001a00010a"], 0x14}}, 0x0) 818.885307ms ago: executing program 0 (id=6555): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1, 0x53, 0xffffffff, {}, {}, {}, 0x1, @can={{0x2, 0x0, 0x1}, 0x5, 0x2, 0x0, 0x0, "001bd300058edb7c"}}, 0x48}, 0x1, 0x0, 0x0, 0x881}, 0x0) 711.767405ms ago: executing program 4 (id=6557): socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) getsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000180), &(0x7f0000000280)=0x4) 696.753308ms ago: executing program 0 (id=6558): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r4) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x100, 0x3, 0x6361, 0x5, 0xfffffff9, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x71b923, 0x80000, {0x0, 0x0, 0x0, r7, {0x0, 0xffe0}, {0x2, 0xb}, {0xd, 0xd}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4010804) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 661.547676ms ago: executing program 3 (id=6559): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000017c0)="707385412dba2208dd760fa5e0f43810e557775f0eb0f3c4fd0ee36ee36a478bc7c66a6ca78ee507e5c07e75a1badc903bf0b26a8e53bd61a0d0561766f2851a4b97c68942b797b8444e07b4fb76ed5dfdbb391a2cc9facc65f29d62c7bfbb76c4baa767b56ccb6e2616d73a6b279746c6aedf1221758ee8ba7c48aad9296d71335d4867a5921b3e0ff39d99f09aaa7941cb4481d866687abce49d6f73ec68b52791e7c9fb9882f52eb8115139d40e6ae340ace42dd0c9ce57a84c9b6ec3ef5c1c9fce105b91b8e9c9928a869adff7af59809832f16b166c444a4df56e77b63f1a3dbde35f8b3416e05c6897543b130544738e943c8266517cc91b12786089a49b33c04d634356004a9a25736de3d69ee1deade46faabfb1db03a3119019f7cce78500a680bf898d3fe9f4693d99e543420048c6829c6a2d1586695a1c8553fe89c914f0829a998b60ba34fb0c04c99fea5a4582bd7075bda27313e51967ed732b3f2daf7827ac04a81f5166218bd6a6d34a69aa1c9a6d4161887711fc459ce7e1405d2c9329f01421ab8a2ce3124e57f70c56215d386030e8bca8b45ae8a043eb3643be1e1765de4ce2b3ca8183852e794fba4b7e905cdb123c59751062adee0d8c5a09360448b529ea4df8f33d4f89d7dc6038a3602bdd4c4054095819c57944bbab17882f17c21c996c3ded6fe6cb28458e5cb572d70afdcefc54518d5fb84bc2c9ace8e130931d8024f1967d62f28545ef6337396a265d02d6765c8ceac474cf5e2bf8ff85e8776bd40bd2b790e399b4afd7d67867cdca55a66b7925452fd3290953fea96a4bed0106d881b94a79b93d57bfee93db4d664a8a1658b97b39136f9c733de0785333b218f3d95178d2caa29f3b5f6beba9128c8d35d169179d6c3db7113802a25201dffd18ccd8d5d7d893abec80508a91e577c2f01e682c9aeebe9699d9f4f0a47fef71a32b47459dfe2450708819e4cbd1ea457a893cfa4ae820b66fb84afe83f1ea77c49da8a9749ced9f7b7fc5ec03327195262260ae82e7204405cbbe9f3bd1e9d944a403930745893d847df0aad3a7ba09df2955240e5d100e89f5386706c30f1f352960f743f8f8a7f77db2af883c6a1b93b585d97f9253554af5ef2233b8e8897056543c43450c0150970f6bc933c561428289f6aa2057970e630a8e482933edfba68c2a8aa262be45d664fbe71508137f390b5ee6ad798aba02459425e78cbdf8f92e585c17c0540b1efc925357d7c3a80cd01e5f57cb491ffbe9f92b9307f5cbcfb7ac599eb50439aea330b7d96b3a1a9e1fd65ea0ed832e8619dceb4b1973cff5e80816f5344053094fb2931892d58a0b18bb70dd2cd4c997341e8deb2351670560e2ce9452cbd30a268b600b69fb730a39908ab5fa1932a570d90daebc9d783971b7a68f3e42a13e2cef88f7799e332c44467e3d88485b9ce3cff6b65a848b63af849e5d175b8d1a51137a431c853097d64e05d05302ddfbc668d97289620fd1040fb15bf28cf9ab21cc6e730cf1e18a1bce81fff1248a7fafd288639f024eb269541ff0aeb34d803b158c1626873f880644764d6c0fa72606f819673afaaafc9cfee32b9dddc2f36c6bf228be031a84e4f3cd2b75ec", 0x483}], 0x1}}], 0x1, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 493.751649ms ago: executing program 3 (id=6560): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x369080, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0xffffffff}]}) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40107447, &(0x7f0000000180)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x4004743d, 0x110e22fff6) write$cgroup_type(r2, &(0x7f0000000280), 0x9) 493.647171ms ago: executing program 2 (id=6561): socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_CREATE(0x2000000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="0500000005000000008020005c"], 0x50) 430.741546ms ago: executing program 2 (id=6562): unshare(0x2c020400) r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000000)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) connect$pptp(r0, &(0x7f0000000040)={0x18, 0x2, {0x0, @empty}}, 0x1e) 429.206683ms ago: executing program 4 (id=6563): unshare(0x2c020400) getsockopt$IP_VS_SO_GET_TIMEOUT(0xffffffffffffffff, 0x0, 0x486, 0x0, 0x0) 326.883151ms ago: executing program 2 (id=6564): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000680)=@newsa={0x128, 0x10, 0x633, 0x70bd29, 0x0, {{@in6=@private0, @in=@broadcast, 0xffff, 0x4000, 0x0, 0x8001, 0x0, 0x20}, {@in=@dev, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0xb}, {0x323}, {}, {}, 0x70bd29, 0x0, 0xa}, [@encap={0x1c, 0x20, {0x0, 0x4e1e, 0x0, @in=@broadcast}}, @encap={0x1c, 0x4, {0x1, 0x4e21}}]}, 0x128}}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000040)=[{{&(0x7f0000000400)={0xa, 0x201, 0x0, @private0}, 0x1c, 0x0}}], 0x1, 0x4008040) r0 = socket(0x10, 0x803, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000000)=""/102, 0x365}, {&(0x7f0000000280)=""/76, 0x14c}, {&(0x7f0000000fc0)=""/4083, 0x197}, {&(0x7f00000006c0)=""/107, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/76, 0x188}, {&(0x7f00000007c0)=""/154, 0x2c}, {&(0x7f00000001c0)=""/7, 0x1e0}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x40010360, &(0x7f0000003700)={0x77359400}) 254.930339ms ago: executing program 3 (id=6565): r0 = socket(0xa, 0x5, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000180)={'gretap0\x00', 0x0, 0x20, 0x7, 0x2, 0x3, {{0x5, 0x4, 0x1, 0x13, 0x14, 0x68, 0x0, 0x3, 0x2f, 0x0, @broadcast, @broadcast}}}}) 254.719244ms ago: executing program 4 (id=6566): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x7c, 0x2c, 0xd27, 0x70bd1d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x4c, 0x2, [@TCA_FLOWER_ACT={0x48, 0x3, [@m_bpf={0x44, 0x1, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x1, 0x7, 0x8, 0x6, 0x5f3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x8848}, 0x4080) 213.104085ms ago: executing program 2 (id=6567): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1, 0x53, 0xffffffff, {}, {}, {}, 0x1, @can={{0x2, 0x0, 0x1}, 0x5, 0x2, 0x0, 0x0, "001bd300058edb7c"}}, 0x48}, 0x1, 0x0, 0x0, 0x881}, 0x0) 172.256744ms ago: executing program 2 (id=6568): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'macvlan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 136.568127ms ago: executing program 3 (id=6569): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x2, 0xa, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, [@sadb_x_filter={0x5, 0x1a, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x0, 0x0, 0x90132adf0ecb33f3}]}, 0x38}}, 0x10) 135.145569ms ago: executing program 0 (id=6570): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000040)=0xffffffffffff2836) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x0, 0x2, 0xfffffffffffffffc, 0x7, 0x40, 0x4}, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x1, 0x4) 23.100435ms ago: executing program 4 (id=6571): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) r1 = socket(0x2, 0x805, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e20, @rand_addr=0x64010102}]}, &(0x7f00000007c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r3, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, &(0x7f00000001c0)=0x9c) 22.994432ms ago: executing program 3 (id=6572): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fc010000190001000000000000000000fc0000000000000000000000000000000000000000000000000000000000000000000003000000000a0000005e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000090000000000000000000000000000000000000000000000fcffffffffffffff000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000004401050000000000000000000000000000000000000000003200000000000000e0000001000000000000000000000000ff3400000000ff00000000000000000001000000fc020000000000000000000000000000000000043200000000000000fc02000000000000000000000000000000000000000000000000000000000000fcffffff0a010101000000000000000000000000000000003c0000000200000000000000000000000000000000000000000000000103000000000000000000000000000000000000000000000000000000000000000000002b00000002"], 0x1fc}}, 0x0) 0s ago: executing program 2 (id=6573): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) syz_emit_ethernet(0x66, &(0x7f00000029c0)={@random="e33110495bfd", @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\r', 0x30, 0x3a, 0xff, @dev, @local, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [{0x1, 0x1, "9595f429ae08"}]}}}}}}, 0x0) kernel console output (not intermixed with test programs): 0/0x10 [ 688.964124][T26153] ____sys_sendmsg+0xa68/0xad0 [ 688.964144][T26153] ? __might_fault+0xaf/0x130 [ 688.964170][T26153] ? __pfx_____sys_sendmsg+0x10/0x10 [ 688.964197][T26153] ? import_iovec+0x73/0xa0 [ 688.964218][T26153] ___sys_sendmsg+0x2a5/0x360 [ 688.964236][T26153] ? __lock_acquire+0x6b5/0x2cf0 [ 688.964258][T26153] ? __pfx____sys_sendmsg+0x10/0x10 [ 688.964310][T26153] ? __fget_files+0x2a/0x420 [ 688.964326][T26153] ? __fget_files+0x3a0/0x420 [ 688.964352][T26153] __x64_sys_sendmsg+0x1bd/0x2a0 [ 688.964373][T26153] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 688.964401][T26153] ? __pfx_ksys_write+0x10/0x10 [ 688.964431][T26153] do_syscall_64+0x14d/0xf80 [ 688.964452][T26153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.964467][T26153] ? trace_irq_disable+0x37/0x100 [ 688.964491][T26153] ? clear_bhb_loop+0x40/0x90 [ 688.964511][T26153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 688.964531][T26153] RIP: 0033:0x7fcea0b9bf79 [ 688.964549][T26153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 688.964563][T26153] RSP: 002b:00007fcea1a32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 688.964581][T26153] RAX: ffffffffffffffda RBX: 00007fcea0e15fa0 RCX: 00007fcea0b9bf79 [ 688.964594][T26153] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 688.964605][T26153] RBP: 00007fcea1a32090 R08: 0000000000000000 R09: 0000000000000000 [ 688.964616][T26153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 688.964627][T26153] R13: 00007fcea0e16038 R14: 00007fcea0e15fa0 R15: 00007ffc1f794188 [ 688.964655][T26153] [ 689.824406][T26175] FAULT_INJECTION: forcing a failure. [ 689.824406][T26175] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 689.843995][T26175] CPU: 1 UID: 0 PID: 26175 Comm: syz.1.5862 Not tainted syzkaller #0 PREEMPT(full) [ 689.844019][T26175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 689.844030][T26175] Call Trace: [ 689.844036][T26175] [ 689.844043][T26175] dump_stack_lvl+0xe8/0x150 [ 689.844069][T26175] should_fail_ex+0x412/0x560 [ 689.844102][T26175] _copy_from_user+0x2d/0xb0 [ 689.844120][T26175] __sys_bpf+0x229/0x950 [ 689.844138][T26175] ? __pfx___sys_bpf+0x10/0x10 [ 689.844169][T26175] ? ksys_write+0x242/0x270 [ 689.844190][T26175] ? __pfx_ksys_write+0x10/0x10 [ 689.844213][T26175] __x64_sys_bpf+0x7c/0x90 [ 689.844229][T26175] do_syscall_64+0x14d/0xf80 [ 689.844248][T26175] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.844263][T26175] ? trace_irq_disable+0x37/0x100 [ 689.844278][T26175] ? clear_bhb_loop+0x40/0x90 [ 689.844296][T26175] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.844311][T26175] RIP: 0033:0x7f394d39bf79 [ 689.844324][T26175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 689.844339][T26175] RSP: 002b:00007f394e28d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 689.844357][T26175] RAX: ffffffffffffffda RBX: 00007f394d615fa0 RCX: 00007f394d39bf79 [ 689.844369][T26175] RDX: 0000000000000094 RSI: 0000200000000240 RDI: 0000000000000005 [ 689.844379][T26175] RBP: 00007f394e28d090 R08: 0000000000000000 R09: 0000000000000000 [ 689.844389][T26175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.844399][T26175] R13: 00007f394d616038 R14: 00007f394d615fa0 R15: 00007fff260c7698 [ 689.844424][T26175] [ 690.163105][T26168] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5860'. [ 690.180948][ T5141] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 690.190253][ T5141] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 690.206763][ T5141] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 690.215323][ T5141] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 690.223124][ T5141] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 690.734617][T26192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5867'. [ 690.786620][T26178] ip6_vti0 speed is unknown, defaulting to 1000 [ 690.964308][T26211] netdevsim netdevsim2: Direct firmware load for ..€ failed with error -2 [ 690.973527][T26211] netdevsim netdevsim2: Falling back to sysfs fallback for: ..€ [ 691.160867][T26220] FAULT_INJECTION: forcing a failure. [ 691.160867][T26220] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 691.174148][T26220] CPU: 1 UID: 0 PID: 26220 Comm: syz.4.5874 Not tainted syzkaller #0 PREEMPT(full) [ 691.174171][T26220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 691.174181][T26220] Call Trace: [ 691.174188][T26220] [ 691.174195][T26220] dump_stack_lvl+0xe8/0x150 [ 691.174218][T26220] should_fail_ex+0x412/0x560 [ 691.174243][T26220] _copy_from_user+0x2d/0xb0 [ 691.174261][T26220] ___sys_sendmsg+0x1c6/0x360 [ 691.174278][T26220] ? __lock_acquire+0x6b5/0x2cf0 [ 691.174298][T26220] ? __pfx____sys_sendmsg+0x10/0x10 [ 691.174341][T26220] ? __fget_files+0x2a/0x420 [ 691.174357][T26220] ? __fget_files+0x3a0/0x420 [ 691.174379][T26220] __x64_sys_sendmsg+0x1bd/0x2a0 [ 691.174400][T26220] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 691.174427][T26220] ? __pfx_ksys_write+0x10/0x10 [ 691.174457][T26220] do_syscall_64+0x14d/0xf80 [ 691.174475][T26220] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.174491][T26220] ? trace_irq_disable+0x37/0x100 [ 691.174509][T26220] ? clear_bhb_loop+0x40/0x90 [ 691.174529][T26220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.174545][T26220] RIP: 0033:0x7f9d0839bf79 [ 691.174560][T26220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.174575][T26220] RSP: 002b:00007f9d09331028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 691.174593][T26220] RAX: ffffffffffffffda RBX: 00007f9d08615fa0 RCX: 00007f9d0839bf79 [ 691.174605][T26220] RDX: 0000000000000804 RSI: 0000200000000080 RDI: 0000000000000003 [ 691.174615][T26220] RBP: 00007f9d09331090 R08: 0000000000000000 R09: 0000000000000000 [ 691.174628][T26220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 691.174638][T26220] R13: 00007f9d08616038 R14: 00007f9d08615fa0 R15: 00007ffcb0a26498 [ 691.174666][T26220] [ 691.585108][T15446] bond2 (unregistering): (slave gretap1): Releasing backup interface [ 691.604472][T26231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5877'. [ 691.613955][T26231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5877'. [ 691.629216][T26231] netlink: 'syz.0.5877': attribute type 13 has an invalid length. [ 691.653715][T26231] netlink: 'syz.0.5877': attribute type 11 has an invalid length. [ 691.670674][T15446] bond1 (unregistering): (slave geneve3): Releasing active interface [ 691.776730][T15446] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 691.787846][T15446] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 691.798002][T15446] bond0 (unregistering): Released all slaves [ 691.810106][T15446] bond1 (unregistering): Released all slaves [ 691.823103][T15446] bond2 (unregistering): (slave bond3): Releasing backup interface [ 691.832350][T15446] bond3 (unregistering): left promiscuous mode [ 691.839504][T15446] bond2 (unregistering): Released all slaves [ 691.852970][T15446] bond3 (unregistering): Released all slaves [ 691.871221][T15446] bond4 (unregistering): Released all slaves [ 691.900372][T26231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5877'. [ 691.909528][T26231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5877'. [ 691.918658][T26231] netlink: 'syz.0.5877': attribute type 13 has an invalid length. [ 691.926764][T26231] netlink: 'syz.0.5877': attribute type 11 has an invalid length. [ 691.969181][T26231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5877'. [ 691.996190][T26231] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5877'. [ 692.025586][T26231] netlink: 'syz.0.5877': attribute type 13 has an invalid length. [ 692.033426][T26231] netlink: 'syz.0.5877': attribute type 11 has an invalid length. [ 692.053652][T15446] tipc: Left network mode [ 692.072205][T26231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5877'. [ 692.094780][T26231] netlink: 'syz.0.5877': attribute type 13 has an invalid length. [ 692.113985][T26231] netlink: 'syz.0.5877': attribute type 11 has an invalid length. [ 692.164060][T26231] netlink: 'syz.0.5877': attribute type 13 has an invalid length. [ 692.195602][T26231] netlink: 'syz.0.5877': attribute type 11 has an invalid length. [ 692.325785][ T51] Bluetooth: hci5: command tx timeout [ 692.333327][T26178] chnl_net:caif_netlink_parms(): no params data found [ 692.670792][T26272] xt_l2tp: invalid flags combination: 0 [ 692.738528][T26272] syzkaller0: entered promiscuous mode [ 692.758302][T26272] syzkaller0: entered allmulticast mode [ 692.769346][T26287] FAULT_INJECTION: forcing a failure. [ 692.769346][T26287] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.787698][T26287] CPU: 1 UID: 0 PID: 26287 Comm: syz.0.5887 Not tainted syzkaller #0 PREEMPT(full) [ 692.787723][T26287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 692.787732][T26287] Call Trace: [ 692.787739][T26287] [ 692.787746][T26287] dump_stack_lvl+0xe8/0x150 [ 692.787773][T26287] should_fail_ex+0x412/0x560 [ 692.787800][T26287] _copy_to_user+0x31/0xb0 [ 692.787819][T26287] finalize_log+0xe3/0x160 [ 692.787842][T26287] ? __pfx_finalize_log+0x10/0x10 [ 692.787862][T26287] ? btf_check_type_tags+0x679/0x680 [ 692.787888][T26287] btf_new_fd+0x787/0xd10 [ 692.787915][T26287] ? __pfx_btf_new_fd+0x10/0x10 [ 692.787934][T26287] ? bpf_token_put+0x143/0x160 [ 692.787955][T26287] ? bpf_btf_load+0x126/0x190 [ 692.787977][T26287] __sys_bpf+0x4e5/0x950 [ 692.787997][T26287] ? __pfx___sys_bpf+0x10/0x10 [ 692.788029][T26287] ? ksys_write+0x242/0x270 [ 692.788051][T26287] ? __pfx_ksys_write+0x10/0x10 [ 692.788074][T26287] __x64_sys_bpf+0x7c/0x90 [ 692.788091][T26287] do_syscall_64+0x14d/0xf80 [ 692.788110][T26287] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.788126][T26287] ? trace_irq_disable+0x37/0x100 [ 692.788143][T26287] ? clear_bhb_loop+0x40/0x90 [ 692.788162][T26287] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.788177][T26287] RIP: 0033:0x7ffbc0f9bf79 [ 692.788192][T26287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.788206][T26287] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 692.788225][T26287] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 692.788237][T26287] RDX: 0000000000000028 RSI: 00002000000002c0 RDI: 0000000000000012 [ 692.788248][T26287] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 692.788259][T26287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 692.788269][T26287] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 692.788297][T26287] [ 693.128424][T26178] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.135975][T26178] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.143315][T26178] bridge_slave_0: entered allmulticast mode [ 693.152176][T26178] bridge_slave_0: entered promiscuous mode [ 693.200695][T26178] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.208597][T26178] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.216554][T26178] bridge_slave_1: entered allmulticast mode [ 693.224135][T26178] bridge_slave_1: entered promiscuous mode [ 693.248778][T26295] netdevsim netdevsim2: Direct firmware load for ..€ failed with error -2 [ 693.260886][T26299] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 693.264179][T26178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 693.271252][T26295] netdevsim netdevsim2: Falling back to sysfs fallback for: ..€ [ 693.298394][T26178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 693.494164][T26178] team0: Port device team_slave_0 added [ 693.510991][T26308] tipc: Enabled bearer , priority 0 [ 693.519685][T26308] syzkaller0: entered promiscuous mode [ 693.525176][T26308] syzkaller0: entered allmulticast mode [ 693.601317][T26178] team0: Port device team_slave_1 added [ 693.695146][T26311] bond6: entered promiscuous mode [ 693.700377][T26311] bond6: entered allmulticast mode [ 693.715992][T26311] 8021q: adding VLAN 0 to HW filter on device bond6 [ 693.762266][T26178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 693.781191][T26178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 693.815650][T26178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 693.857158][T26178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 693.864136][T26178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 693.891023][T26178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 693.959344][T26308] tipc: Resetting bearer [ 693.973454][T15446] hsr_slave_0: left promiscuous mode [ 693.979970][T15446] hsr_slave_1: left promiscuous mode [ 693.986399][T15446] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 693.994085][T15446] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 694.189791][T26307] tipc: Resetting bearer [ 694.269351][T26307] tipc: Disabling bearer [ 694.411251][ T51] Bluetooth: hci5: command tx timeout [ 694.420236][T26178] hsr_slave_0: entered promiscuous mode [ 694.489221][T26178] hsr_slave_1: entered promiscuous mode [ 694.511974][T26178] debugfs: 'hsr0' already exists in 'hsr' [ 694.513024][T26340] openvswitch: netlink: Actions may not be safe on all matching packets [ 694.534007][T26178] Cannot create hsr debugfs directory [ 694.660662][T26341] syzkaller0: entered promiscuous mode [ 694.672191][T26341] syzkaller0: entered allmulticast mode [ 694.731371][T26353] __nla_validate_parse: 56 callbacks suppressed [ 694.731388][T26353] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5903'. [ 694.756706][T15446] IPVS: stop unused estimator thread 0... [ 694.869686][T26360] FAULT_INJECTION: forcing a failure. [ 694.869686][T26360] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 694.885761][T26360] CPU: 1 UID: 0 PID: 26360 Comm: syz.2.5904 Not tainted syzkaller #0 PREEMPT(full) [ 694.885787][T26360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 694.885799][T26360] Call Trace: [ 694.885805][T26360] [ 694.885813][T26360] dump_stack_lvl+0xe8/0x150 [ 694.885839][T26360] should_fail_ex+0x412/0x560 [ 694.885865][T26360] _copy_from_user+0x2d/0xb0 [ 694.885884][T26360] generic_map_update_batch+0x69a/0x990 [ 694.885917][T26360] ? __pfx_generic_map_update_batch+0x10/0x10 [ 694.885940][T26360] ? __fget_files+0x2a/0x420 [ 694.885963][T26360] ? __pfx_generic_map_update_batch+0x10/0x10 [ 694.885986][T26360] bpf_map_do_batch+0x39b/0x630 [ 694.886011][T26360] __sys_bpf+0x7c1/0x950 [ 694.886033][T26360] ? __pfx___sys_bpf+0x10/0x10 [ 694.886066][T26360] ? ksys_write+0x242/0x270 [ 694.886089][T26360] ? __pfx_ksys_write+0x10/0x10 [ 694.886115][T26360] __x64_sys_bpf+0x7c/0x90 [ 694.886134][T26360] do_syscall_64+0x14d/0xf80 [ 694.886155][T26360] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.886171][T26360] ? trace_irq_disable+0x37/0x100 [ 694.886189][T26360] ? clear_bhb_loop+0x40/0x90 [ 694.886209][T26360] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 694.886225][T26360] RIP: 0033:0x7fcea0b9bf79 [ 694.886241][T26360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 694.886256][T26360] RSP: 002b:00007fcea1a32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 694.886275][T26360] RAX: ffffffffffffffda RBX: 00007fcea0e15fa0 RCX: 00007fcea0b9bf79 [ 694.886288][T26360] RDX: 0000000000000038 RSI: 0000200000000200 RDI: 000000000000001a [ 694.886299][T26360] RBP: 00007fcea1a32090 R08: 0000000000000000 R09: 0000000000000000 [ 694.886310][T26360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 694.886320][T26360] R13: 00007fcea0e16038 R14: 00007fcea0e15fa0 R15: 00007ffc1f794188 [ 694.886348][T26360] [ 694.890614][T26353] vlan2: entered promiscuous mode [ 695.091028][T26353] geneve1: entered promiscuous mode [ 695.136176][T26363] netdevsim netdevsim2: Direct firmware load for ..€ failed with error -2 [ 695.152033][T26363] netdevsim netdevsim2: Falling back to sysfs fallback for: ..€ [ 695.271161][T26371] xt_TPROXY: Can be used only with -p tcp or -p udp [ 695.551917][T26374] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5907'. [ 696.495606][ T51] Bluetooth: hci5: command tx timeout [ 696.879094][T26391] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5909'. [ 696.888743][T26391] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5909'. [ 697.374542][T26418] netdevsim netdevsim0: Direct firmware load for ..€ failed with error -2 [ 697.385337][T26425] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5917'. [ 697.416109][T26418] netdevsim netdevsim0: Falling back to sysfs fallback for: ..€ [ 697.516625][T26178] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 697.556885][T26178] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 697.603460][T26178] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 697.634674][T26178] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 697.712136][T26438] gretap1: entered allmulticast mode [ 697.869818][T26398] ip6_vti0 speed is unknown, defaulting to 1000 [ 697.888732][T26454] sch_tbf: burst 0 is lower than device tunl0 mtu (129) ! [ 697.917443][T26178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 697.952409][T26178] 8021q: adding VLAN 0 to HW filter on device team0 [ 697.983128][T14466] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.990322][T14466] bridge0: port 1(bridge_slave_0) entered forwarding state [ 698.028520][T15446] bridge0: port 2(bridge_slave_1) entered blocking state [ 698.035721][T15446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 698.065376][T26458] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5922'. [ 698.399865][T26471] validate_nla: 47 callbacks suppressed [ 698.399884][T26471] netlink: 'syz.4.5925': attribute type 10 has an invalid length. [ 698.566414][ T51] Bluetooth: hci5: command tx timeout [ 698.799018][T26178] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 698.842627][T26491] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5928'. [ 698.971372][T26498] netlink: 180 bytes leftover after parsing attributes in process `syz.0.5931'. [ 698.980925][T26498] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5931'. [ 698.999577][T15247] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.012029][T15247] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.063377][T26178] veth0_vlan: entered promiscuous mode [ 699.119944][T26178] veth1_vlan: entered promiscuous mode [ 699.281474][T26178] veth0_macvtap: entered promiscuous mode [ 699.305261][T26178] veth1_macvtap: entered promiscuous mode [ 699.382298][T26178] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 699.418386][T26178] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 699.493258][T15442] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.502902][T15442] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.536576][T15442] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.564732][T15442] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 699.765733][T15442] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.785639][T15442] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.878780][T15442] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 699.879400][T26523] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5936'. [ 699.895518][T15442] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 699.918349][T26523] tc_dump_action: action bad kind [ 700.043230][T26494] ip6_vti0 speed is unknown, defaulting to 1000 [ 700.456067][T26546] netlink: 180 bytes leftover after parsing attributes in process `syz.4.5942'. [ 700.473768][T26546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5942'. [ 700.505046][T26554] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.5940'. [ 700.556612][T26551] netdevsim netdevsim0: Direct firmware load for ..€ failed with error -2 [ 700.585625][T26551] netdevsim netdevsim0: Falling back to sysfs fallback for: ..€ [ 700.647395][ T51] Bluetooth: hci5: command tx timeout [ 701.201988][T26568] vlan2: entered promiscuous mode [ 701.208125][T26568] geneve1: entered promiscuous mode [ 701.213447][T26568] vlan2: entered allmulticast mode [ 701.220460][T26568] geneve1: entered allmulticast mode [ 701.415359][T26577] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5950'. [ 701.542360][T26580] netlink: 'syz.0.5951': attribute type 10 has an invalid length. [ 701.642322][T26570] ip6_vti0 speed is unknown, defaulting to 1000 [ 701.889062][T26597] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5958'. [ 701.923916][T26597] macvtap0: entered promiscuous mode [ 701.930140][T26597] bridge0: entered promiscuous mode [ 701.935748][T26597] macvtap0: entered allmulticast mode [ 701.941184][T26597] bridge0: entered allmulticast mode [ 701.948157][T26597] bridge0: port 1(macvtap0) entered blocking state [ 701.954835][T26597] bridge0: port 1(macvtap0) entered disabled state [ 701.965070][T26597] bridge0: left allmulticast mode [ 701.970217][T26597] bridge0: left promiscuous mode [ 702.031097][T26603] netdevsim netdevsim0: Direct firmware load for ..€ failed with error -2 [ 702.048658][T26603] netdevsim netdevsim0: Falling back to sysfs fallback for: ..€ [ 702.353449][T26618] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5966'. [ 703.311152][T26635] netlink: 51 bytes leftover after parsing attributes in process `syz.0.5975'. [ 703.336144][T26633] team_slave_0: entered promiscuous mode [ 703.345815][T26633] team_slave_0: entered allmulticast mode [ 703.473484][T26639] vlan2: entered allmulticast mode [ 703.668005][T26653] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5982'. [ 703.695486][T26653] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 703.700494][T26657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5983'. [ 703.725345][T26657] netlink: 'syz.2.5983': attribute type 6 has an invalid length. [ 703.751263][T14466] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.751531][T26657] netlink: 'syz.2.5983': attribute type 6 has an invalid length. [ 703.765484][T14466] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.794357][T14466] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 703.814269][T14466] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 704.424296][T26668] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 704.555880][T26668] team0 (unregistering): Port device team_slave_0 removed [ 704.600905][T26668] team0 (unregistering): Failed to send options change via netlink (err -105) [ 704.631104][T26668] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 704.641158][T26677] netlink: 'syz.0.5988': attribute type 10 has an invalid length. [ 704.661691][T26668] team0 (unregistering): Port device team_slave_1 removed [ 704.694469][T26681] x_tables: duplicate underflow at hook 1 [ 704.712816][T26672] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.724753][T26672] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.812763][T26672] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.823873][T26672] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.890973][T26672] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 704.905945][T26672] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.930130][T26691] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 704.941270][T26691] team0 (unregistering): Port device team_slave_0 removed [ 704.958914][T26691] team0 (unregistering): Failed to send options change via netlink (err -105) [ 704.969025][T26691] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 704.980379][T26691] team0 (unregistering): Port device team_slave_1 removed [ 705.008918][T26672] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 705.020059][T26672] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.086959][T26691] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.141421][T14466] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.151153][T14466] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.169180][T14466] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.177700][T14466] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.200999][T26691] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.223501][T15247] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.232152][T15247] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.249201][T15247] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 705.259375][T15247] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.300085][T26691] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.355882][T26691] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.459551][T15247] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.483885][T14466] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.526354][T14466] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.576810][T15442] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 705.643978][T26710] __nla_validate_parse: 4 callbacks suppressed [ 705.643995][T26710] netlink: 7 bytes leftover after parsing attributes in process `syz.3.5999'. [ 705.868263][T26726] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6005'. [ 705.877710][T26726] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6005'. [ 705.888111][T26714] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6001'. [ 705.899990][T26726] tc_dump_action: action bad kind [ 705.920679][T26726] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6005'. [ 706.381559][T26714] ip6_vti0 speed is unknown, defaulting to 1000 [ 706.395000][T26737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6008'. [ 706.413235][T26737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6008'. [ 706.426259][T26737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6008'. [ 706.437220][T26737] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6008'. [ 706.482241][T26739] netlink: 'syz.4.6009': attribute type 1 has an invalid length. [ 706.512675][T26739] 8021q: adding VLAN 0 to HW filter on device bond5 [ 706.531455][T26739] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6009'. [ 706.549869][T26739] bond5 (unregistering): Released all slaves [ 706.717213][T26745] tipc: Enabled bearer , priority 0 [ 706.724744][T26745] syzkaller0: entered promiscuous mode [ 706.731805][T26745] syzkaller0: entered allmulticast mode [ 706.768675][T26745] tipc: Resetting bearer [ 707.081584][T26745] tipc: Resetting bearer [ 707.102497][T26745] tipc: Disabling bearer [ 707.642807][T26774] syzkaller0: entered promiscuous mode [ 707.653397][T26774] syzkaller0: entered allmulticast mode [ 707.995285][T26766] ip6_vti0 speed is unknown, defaulting to 1000 [ 708.214997][T26785] x_tables: duplicate underflow at hook 3 [ 708.751243][T26795] xt_TPROXY: Can be used only with -p tcp or -p udp [ 708.759258][T26795] netlink: 'syz.3.6030': attribute type 3 has an invalid length. [ 708.888100][T26799] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 708.901099][T26799] team0 (unregistering): Port device team_slave_0 removed [ 708.913932][T26799] team0 (unregistering): Failed to send options change via netlink (err -105) [ 708.925973][T26799] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 708.948413][T26799] team0 (unregistering): Port device team_slave_1 removed [ 709.029284][T26800] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.113926][T26802] dummy0: entered allmulticast mode [ 709.130881][T26801] dummy0: left allmulticast mode [ 709.205329][T26800] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.330813][T26800] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.462007][T26800] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 709.892329][T14466] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.949467][T14466] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 709.993410][T15442] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.038374][T14466] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 710.199957][T26836] netlink: 'syz.3.6041': attribute type 1 has an invalid length. [ 710.322316][T26836] bond1 (unregistering): Released all slaves [ 710.582978][T26850] xt_bpf: check failed: parse error [ 710.589993][T26836] syzkaller0: entered promiscuous mode [ 710.605926][T26836] syzkaller0: entered allmulticast mode [ 710.617360][T26827] ip6_vti0 speed is unknown, defaulting to 1000 [ 710.622653][T26850] xt_l2tp: missing protocol rule (udp|l2tpip) [ 710.924398][T26864] netlink: 'syz.2.6047': attribute type 10 has an invalid length. [ 710.940029][T26868] FAULT_INJECTION: forcing a failure. [ 710.940029][T26868] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 710.969100][T26868] CPU: 0 UID: 0 PID: 26868 Comm: syz.0.6049 Not tainted syzkaller #0 PREEMPT(full) [ 710.969128][T26868] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 710.969140][T26868] Call Trace: [ 710.969149][T26868] [ 710.969156][T26868] dump_stack_lvl+0xe8/0x150 [ 710.969186][T26868] should_fail_ex+0x412/0x560 [ 710.969214][T26868] _copy_from_user+0x2d/0xb0 [ 710.969233][T26868] ___sys_sendmsg+0x1c6/0x360 [ 710.969256][T26868] ? __lock_acquire+0x6b5/0x2cf0 [ 710.969279][T26868] ? __pfx____sys_sendmsg+0x10/0x10 [ 710.969330][T26868] ? __fget_files+0x2a/0x420 [ 710.969348][T26868] ? __fget_files+0x3a0/0x420 [ 710.969374][T26868] __x64_sys_sendmsg+0x1bd/0x2a0 [ 710.969398][T26868] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 710.969425][T26868] ? __pfx_ksys_write+0x10/0x10 [ 710.969456][T26868] do_syscall_64+0x14d/0xf80 [ 710.969477][T26868] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.969494][T26868] ? trace_irq_disable+0x37/0x100 [ 710.969512][T26868] ? clear_bhb_loop+0x40/0x90 [ 710.969533][T26868] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 710.969548][T26868] RIP: 0033:0x7ffbc0f9bf79 [ 710.969565][T26868] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 710.969579][T26868] RSP: 002b:00007ffbbf1d5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 710.969599][T26868] RAX: ffffffffffffffda RBX: 00007ffbc1216090 RCX: 00007ffbc0f9bf79 [ 710.969612][T26868] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 710.969624][T26868] RBP: 00007ffbbf1d5090 R08: 0000000000000000 R09: 0000000000000000 [ 710.969635][T26868] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 710.969645][T26868] R13: 00007ffbc1216128 R14: 00007ffbc1216090 R15: 00007fffc33a3938 [ 710.969672][T26868] [ 712.994215][T26897] __nla_validate_parse: 11 callbacks suppressed [ 712.994235][T26897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6054'. [ 713.026237][T26897] netlink: 72 bytes leftover after parsing attributes in process `syz.2.6054'. [ 713.069527][T26900] netlink: 'syz.4.6056': attribute type 10 has an invalid length. [ 713.147885][T26903] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6057'. [ 713.157749][T26903] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6057'. [ 713.368071][ T5822] Bluetooth: hci3: command 0x0406 tx timeout [ 713.937897][T26936] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6069'. [ 713.966436][T26943] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 713.983874][T26943] bond1 (unregistering): Released all slaves [ 714.116583][T26954] syzkaller0: entered promiscuous mode [ 714.125784][T26954] syzkaller0: entered allmulticast mode [ 714.135306][T26954] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 714.245013][T26954] tipc: Started in network mode [ 714.250090][T26954] tipc: Node identity bebd2185d7a5, cluster identity 4711 [ 714.261620][T26954] tipc: Enabled bearer , priority 0 [ 714.320183][T26962] netlink: 'syz.4.6075': attribute type 1 has an invalid length. [ 714.338358][T26959] tipc: Resetting bearer [ 714.370014][T26966] netlink: 'syz.2.6074': attribute type 2 has an invalid length. [ 714.386030][T26962] 8021q: adding VLAN 0 to HW filter on device bond5 [ 714.409556][T26966] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6074'. [ 714.456765][T26953] tipc: Resetting bearer [ 714.480431][T26953] tipc: Disabling bearer [ 715.106108][T27000] bond6: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 715.183709][T27000] bond6 (unregistering): Released all slaves [ 715.604094][T27027] netlink: 7 bytes leftover after parsing attributes in process `syz.4.6090'. [ 715.867711][T26992] lec:lec_atm_close: lec0: Shut down! [ 715.924763][T27047] FAULT_INJECTION: forcing a failure. [ 715.924763][T27047] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 715.945062][T27047] CPU: 0 UID: 0 PID: 27047 Comm: syz.1.6093 Not tainted syzkaller #0 PREEMPT(full) [ 715.945085][T27047] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 715.945095][T27047] Call Trace: [ 715.945102][T27047] [ 715.945110][T27047] dump_stack_lvl+0xe8/0x150 [ 715.945138][T27047] should_fail_ex+0x412/0x560 [ 715.945167][T27047] _copy_from_iter+0x1d3/0x1670 [ 715.945196][T27047] ? rcu_is_watching+0x15/0xb0 [ 715.945216][T27047] ? __pfx__copy_from_iter+0x10/0x10 [ 715.945245][T27047] ? netlink_sendmsg+0x650/0xb40 [ 715.945262][T27047] ? skb_put+0x11b/0x210 [ 715.945284][T27047] netlink_sendmsg+0x6c0/0xb40 [ 715.945307][T27047] ? __pfx_netlink_sendmsg+0x10/0x10 [ 715.945334][T27047] ? aa_sock_msg_perm+0xf1/0x1b0 [ 715.945357][T27047] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 715.945379][T27047] ? __pfx_netlink_sendmsg+0x10/0x10 [ 715.945406][T27047] ____sys_sendmsg+0xa68/0xad0 [ 715.945425][T27047] ? __might_fault+0xaf/0x130 [ 715.945447][T27047] ? __pfx_____sys_sendmsg+0x10/0x10 [ 715.945473][T27047] ? import_iovec+0x73/0xa0 [ 715.945491][T27047] ___sys_sendmsg+0x2a5/0x360 [ 715.945507][T27047] ? __lock_acquire+0x6b5/0x2cf0 [ 715.945529][T27047] ? __pfx____sys_sendmsg+0x10/0x10 [ 715.945577][T27047] ? __fget_files+0x2a/0x420 [ 715.945594][T27047] ? __fget_files+0x3a0/0x420 [ 715.945625][T27047] __x64_sys_sendmsg+0x1bd/0x2a0 [ 715.945647][T27047] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 715.945675][T27047] ? __pfx_ksys_write+0x10/0x10 [ 715.945707][T27047] do_syscall_64+0x14d/0xf80 [ 715.945728][T27047] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.945745][T27047] ? trace_irq_disable+0x37/0x100 [ 715.945763][T27047] ? clear_bhb_loop+0x40/0x90 [ 715.945784][T27047] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.945800][T27047] RIP: 0033:0x7f394d39bf79 [ 715.945816][T27047] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 715.945830][T27047] RSP: 002b:00007f394e28d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 715.945850][T27047] RAX: ffffffffffffffda RBX: 00007f394d615fa0 RCX: 00007f394d39bf79 [ 715.945879][T27047] RDX: 0000000008000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 715.945890][T27047] RBP: 00007f394e28d090 R08: 0000000000000000 R09: 0000000000000000 [ 715.945901][T27047] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 715.945910][T27047] R13: 00007f394d616038 R14: 00007f394d615fa0 R15: 00007fff260c7698 [ 715.945936][T27047] [ 716.463192][T27063] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.6098'. [ 716.807108][ T5822] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 716.817145][ T5822] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 716.854407][ T5822] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 716.863694][ T5822] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 716.874411][ T5822] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 717.514590][T27123] netlink: 'syz.3.6113': attribute type 10 has an invalid length. [ 717.590027][T27081] ip6_vti0 speed is unknown, defaulting to 1000 [ 717.739904][T27132] FAULT_INJECTION: forcing a failure. [ 717.739904][T27132] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 717.775693][T27132] CPU: 0 UID: 0 PID: 27132 Comm: syz.3.6116 Not tainted syzkaller #0 PREEMPT(full) [ 717.775717][T27132] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 717.775728][T27132] Call Trace: [ 717.775736][T27132] [ 717.775743][T27132] dump_stack_lvl+0xe8/0x150 [ 717.775770][T27132] should_fail_ex+0x412/0x560 [ 717.775796][T27132] _copy_from_user+0x2d/0xb0 [ 717.775815][T27132] rds_setsockopt+0x99f/0xd90 [ 717.775836][T27132] ? aa_sk_perm+0x15a/0x960 [ 717.775860][T27132] ? __pfx_rds_setsockopt+0x10/0x10 [ 717.775879][T27132] ? __fget_files+0x2a/0x420 [ 717.775918][T27132] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 717.775938][T27132] ? __pfx_rds_setsockopt+0x10/0x10 [ 717.775959][T27132] do_sock_setsockopt+0x17c/0x1b0 [ 717.775984][T27132] __x64_sys_setsockopt+0x13d/0x1b0 [ 717.776016][T27132] do_syscall_64+0x14d/0xf80 [ 717.776036][T27132] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.776052][T27132] ? trace_irq_disable+0x37/0x100 [ 717.776070][T27132] ? clear_bhb_loop+0x40/0x90 [ 717.776090][T27132] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.776105][T27132] RIP: 0033:0x7f0c1659bf79 [ 717.776121][T27132] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 717.776134][T27132] RSP: 002b:00007f0c1747e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 717.776151][T27132] RAX: ffffffffffffffda RBX: 00007f0c16815fa0 RCX: 00007f0c1659bf79 [ 717.776163][T27132] RDX: 0000000000000001 RSI: 0000000000000114 RDI: 0000000000000005 [ 717.776173][T27132] RBP: 00007f0c1747e090 R08: 0000000000000010 R09: 0000000000000000 [ 717.776184][T27132] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000001 [ 717.776195][T27132] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 717.776224][T27132] [ 718.337281][T27136] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6117'. [ 718.620394][ T5485] lec:lec_start_xmit: lec0:No lecd attached [ 718.716073][T27179] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6127'. [ 718.924759][T27193] FAULT_INJECTION: forcing a failure. [ 718.924759][T27193] name failslab, interval 1, probability 0, space 0, times 0 [ 718.932697][T27081] chnl_net:caif_netlink_parms(): no params data found [ 718.973687][T27193] CPU: 0 UID: 0 PID: 27193 Comm: syz.3.6130 Not tainted syzkaller #0 PREEMPT(full) [ 718.973709][T27193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 718.973720][T27193] Call Trace: [ 718.973727][T27193] [ 718.973734][T27193] dump_stack_lvl+0xe8/0x150 [ 718.973760][T27193] should_fail_ex+0x412/0x560 [ 718.973786][T27193] should_failslab+0xa8/0x100 [ 718.973807][T27193] __kmalloc_cache_noprof+0x88/0x660 [ 718.973827][ T5822] Bluetooth: hci0: command tx timeout [ 718.973824][T27193] ? __pfx_stack_trace_save+0x10/0x10 [ 718.973844][T27193] ? rtnl_newlink+0x136/0x1be0 [ 718.973866][T27193] rtnl_newlink+0x136/0x1be0 [ 718.973881][T27193] ? kasan_save_track+0x4f/0x80 [ 718.973897][T27193] ? kasan_save_track+0x3e/0x80 [ 718.973910][T27193] ? kasan_save_free_info+0x46/0x50 [ 718.973921][T27193] ? __kasan_slab_free+0x5c/0x80 [ 718.973935][T27193] ? kmem_cache_free+0x180/0x610 [ 718.973950][T27193] ? __dev_queue_xmit+0x168f/0x3850 [ 718.973965][T27193] ? __netlink_deliver_tap+0x5ad/0x850 [ 718.973978][T27193] ? netlink_deliver_tap+0x19c/0x1b0 [ 718.973989][T27193] ? netlink_unicast+0x7e3/0x9b0 [ 718.974004][T27193] ? netlink_sendmsg+0x813/0xb40 [ 718.974018][T27193] ? __pfx_rtnl_newlink+0x10/0x10 [ 718.974031][T27193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.974070][T27193] ? kasan_quarantine_put+0xbb/0x1f0 [ 718.974086][T27193] ? lockdep_hardirqs_on+0x7a/0x110 [ 718.974107][T27193] ? nlmon_xmit+0xb0/0x100 [ 718.974128][T27193] ? kmem_cache_free+0x180/0x610 [ 718.974157][T27193] ? __lock_acquire+0x6b5/0x2cf0 [ 718.974183][T27193] ? __local_bh_enable_ip+0xd0/0x130 [ 718.974200][T27193] ? lockdep_hardirqs_on+0x7a/0x110 [ 718.974219][T27193] ? __dev_queue_xmit+0x274/0x3850 [ 718.974237][T27193] ? __local_bh_enable_ip+0xd0/0x130 [ 718.974253][T27193] ? __dev_queue_xmit+0x274/0x3850 [ 718.974278][T27193] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 718.974317][T27193] ? __pfx_rtnl_newlink+0x10/0x10 [ 718.974333][T27193] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 718.974353][T27193] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 718.974369][T27193] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.974385][T27193] ? ref_tracker_free+0x693/0x840 [ 718.974406][T27193] ? __copy_skb_header+0xa3/0x4a0 [ 718.974426][T27193] ? __pfx_ref_tracker_free+0x10/0x10 [ 718.974446][T27193] ? __skb_clone+0x63/0x7a0 [ 718.974472][T27193] netlink_rcv_skb+0x232/0x4b0 [ 718.974490][T27193] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 718.974508][T27193] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 718.974534][T27193] ? netlink_deliver_tap+0x2e/0x1b0 [ 718.974557][T27193] netlink_unicast+0x80f/0x9b0 [ 718.974585][T27193] ? __pfx_netlink_unicast+0x10/0x10 [ 718.974608][T27193] ? netlink_sendmsg+0x650/0xb40 [ 718.974622][T27193] ? skb_put+0x11b/0x210 [ 718.974643][T27193] netlink_sendmsg+0x813/0xb40 [ 718.974667][T27193] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.974687][T27193] ? aa_sock_msg_perm+0xf1/0x1b0 [ 718.974709][T27193] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 718.974731][T27193] ? __pfx_netlink_sendmsg+0x10/0x10 [ 718.974747][T27193] ____sys_sendmsg+0xa68/0xad0 [ 718.974766][T27193] ? __might_fault+0xaf/0x130 [ 718.974793][T27193] ? __pfx_____sys_sendmsg+0x10/0x10 [ 718.974819][T27193] ? import_iovec+0x73/0xa0 [ 718.974839][T27193] ___sys_sendmsg+0x2a5/0x360 [ 718.974857][T27193] ? __lock_acquire+0x6b5/0x2cf0 [ 718.974877][T27193] ? __pfx____sys_sendmsg+0x10/0x10 [ 718.974926][T27193] ? __fget_files+0x2a/0x420 [ 718.974941][T27193] ? __fget_files+0x3a0/0x420 [ 718.974966][T27193] __x64_sys_sendmsg+0x1bd/0x2a0 [ 718.974987][T27193] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 718.975014][T27193] ? __pfx_ksys_write+0x10/0x10 [ 718.975043][T27193] do_syscall_64+0x14d/0xf80 [ 718.975063][T27193] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.975078][T27193] ? trace_irq_disable+0x37/0x100 [ 718.975095][T27193] ? clear_bhb_loop+0x40/0x90 [ 718.975113][T27193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.975128][T27193] RIP: 0033:0x7f0c1659bf79 [ 718.975144][T27193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 718.975158][T27193] RSP: 002b:00007f0c1747e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 718.975175][T27193] RAX: ffffffffffffffda RBX: 00007f0c16815fa0 RCX: 00007f0c1659bf79 [ 718.975187][T27193] RDX: 0000000000000000 RSI: 0000200000000280 RDI: 0000000000000003 [ 718.975197][T27193] RBP: 00007f0c1747e090 R08: 0000000000000000 R09: 0000000000000000 [ 718.975208][T27193] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.975217][T27193] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 718.975244][T27193] [ 719.359624][T27081] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.462060][T27081] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.469843][T27081] bridge_slave_0: entered allmulticast mode [ 719.478135][T27081] bridge_slave_0: entered promiscuous mode [ 719.486920][T27187] ip6_vti0 speed is unknown, defaulting to 1000 [ 719.514230][T27081] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.531458][T27081] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.545968][T27081] bridge_slave_1: entered allmulticast mode [ 719.564425][T27081] bridge_slave_1: entered promiscuous mode [ 719.638498][T27081] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 719.658918][T27081] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 719.900812][T27081] team0: Port device team_slave_0 added [ 719.938594][T27081] team0: Port device team_slave_1 added [ 720.038760][T27081] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 720.075522][T27081] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 720.108987][T27081] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 720.148554][T27081] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 720.164045][T27081] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 720.251705][T27081] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 720.366064][T27220] tipc: Started in network mode [ 720.371162][T27220] tipc: Node identity 2659127cdc49, cluster identity 4711 [ 720.379104][T27220] tipc: Enabled bearer , priority 0 [ 720.444514][T27221] syzkaller0: entered promiscuous mode [ 720.450357][T27221] syzkaller0: entered allmulticast mode [ 720.498564][T27081] hsr_slave_0: entered promiscuous mode [ 720.505983][T27081] hsr_slave_1: entered promiscuous mode [ 720.517278][T27081] debugfs: 'hsr0' already exists in 'hsr' [ 720.523051][T27081] Cannot create hsr debugfs directory [ 720.595926][T27224] tipc: Resetting bearer [ 720.681007][T27224] tipc: Disabling bearer [ 720.821750][T27237] xt_bpf: check failed: parse error [ 720.859973][T27237] xt_l2tp: missing protocol rule (udp|l2tpip) [ 720.902870][T27242] netlink: 'syz.0.6146': attribute type 1 has an invalid length. [ 720.955709][T27236] syzkaller0: entered promiscuous mode [ 720.961343][T27236] syzkaller0: entered allmulticast mode [ 720.996212][T27246] netlink: 180 bytes leftover after parsing attributes in process `syz.2.6148'. [ 721.020422][T27246] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6148'. [ 721.445893][ T5822] Bluetooth: hci0: command tx timeout [ 721.489231][T27267] FAULT_INJECTION: forcing a failure. [ 721.489231][T27267] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 721.505614][T27267] CPU: 1 UID: 0 PID: 27267 Comm: syz.1.6157 Not tainted syzkaller #0 PREEMPT(full) [ 721.505641][T27267] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 721.505653][T27267] Call Trace: [ 721.505661][T27267] [ 721.505669][T27267] dump_stack_lvl+0xe8/0x150 [ 721.505699][T27267] should_fail_ex+0x412/0x560 [ 721.505728][T27267] _copy_from_user+0x2d/0xb0 [ 721.505756][T27267] ___sys_sendmsg+0x1c6/0x360 [ 721.505777][T27267] ? __lock_acquire+0x6b5/0x2cf0 [ 721.505801][T27267] ? __pfx____sys_sendmsg+0x10/0x10 [ 721.505853][T27267] ? __fget_files+0x2a/0x420 [ 721.505870][T27267] ? __fget_files+0x3a0/0x420 [ 721.505895][T27267] __x64_sys_sendmsg+0x1bd/0x2a0 [ 721.505918][T27267] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 721.505947][T27267] ? __pfx_ksys_write+0x10/0x10 [ 721.505977][T27267] do_syscall_64+0x14d/0xf80 [ 721.505998][T27267] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.506015][T27267] ? trace_irq_disable+0x37/0x100 [ 721.506034][T27267] ? clear_bhb_loop+0x40/0x90 [ 721.506054][T27267] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.506070][T27267] RIP: 0033:0x7f394d39bf79 [ 721.506087][T27267] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.506101][T27267] RSP: 002b:00007f394e28d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 721.506121][T27267] RAX: ffffffffffffffda RBX: 00007f394d615fa0 RCX: 00007f394d39bf79 [ 721.506134][T27267] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 721.506143][T27267] RBP: 00007f394e28d090 R08: 0000000000000000 R09: 0000000000000000 [ 721.506154][T27267] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 721.506165][T27267] R13: 00007f394d616038 R14: 00007f394d615fa0 R15: 00007fff260c7698 [ 721.506192][T27267] [ 721.879074][T27275] syzkaller0: entered promiscuous mode [ 721.884642][T27275] syzkaller0: entered allmulticast mode [ 721.892211][T27269] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6155'. [ 722.144587][T27081] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 722.153103][T27290] netlink: 180 bytes leftover after parsing attributes in process `syz.3.6161'. [ 722.172973][T27290] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6161'. [ 722.180022][T27081] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 722.200869][T27081] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 722.232775][T27081] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 722.464176][T27081] 8021q: adding VLAN 0 to HW filter on device bond0 [ 722.519644][T27081] 8021q: adding VLAN 0 to HW filter on device team0 [ 722.551032][T15440] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.558245][T15440] bridge0: port 1(bridge_slave_0) entered forwarding state [ 722.568772][T27317] FAULT_INJECTION: forcing a failure. [ 722.568772][T27317] name failslab, interval 1, probability 0, space 0, times 0 [ 722.594799][T15440] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.602019][T15440] bridge0: port 2(bridge_slave_1) entered forwarding state [ 722.634967][T27317] CPU: 0 UID: 0 PID: 27317 Comm: syz.0.6170 Not tainted syzkaller #0 PREEMPT(full) [ 722.634991][T27317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 722.635003][T27317] Call Trace: [ 722.635010][T27317] [ 722.635018][T27317] dump_stack_lvl+0xe8/0x150 [ 722.635047][T27317] should_fail_ex+0x412/0x560 [ 722.635076][T27317] should_failslab+0xa8/0x100 [ 722.635099][T27317] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 722.635120][T27317] ? __alloc_skb+0x186/0x7d0 [ 722.635147][T27317] ? __alloc_skb+0x1d0/0x7d0 [ 722.635162][T27317] ? __local_bh_enable_ip+0xd0/0x130 [ 722.635185][T27317] __alloc_skb+0x1d0/0x7d0 [ 722.635203][T27317] ? netlink_ack_tlv_len+0x6c/0x210 [ 722.635222][T27317] netlink_ack+0x146/0xa50 [ 722.635236][T27317] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.635253][T27317] ? ref_tracker_free+0x693/0x840 [ 722.635273][T27317] ? __copy_skb_header+0xa3/0x4a0 [ 722.635295][T27317] ? __pfx_ref_tracker_free+0x10/0x10 [ 722.635314][T27317] ? __skb_clone+0x63/0x7a0 [ 722.635340][T27317] netlink_rcv_skb+0x2b6/0x4b0 [ 722.635357][T27317] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 722.635375][T27317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 722.635404][T27317] ? netlink_deliver_tap+0x2e/0x1b0 [ 722.635425][T27317] netlink_unicast+0x80f/0x9b0 [ 722.635453][T27317] ? __pfx_netlink_unicast+0x10/0x10 [ 722.635475][T27317] ? netlink_sendmsg+0x650/0xb40 [ 722.635490][T27317] ? skb_put+0x11b/0x210 [ 722.635510][T27317] netlink_sendmsg+0x813/0xb40 [ 722.635533][T27317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.635552][T27317] ? aa_sock_msg_perm+0xf1/0x1b0 [ 722.635574][T27317] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 722.635596][T27317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 722.635611][T27317] ____sys_sendmsg+0xa68/0xad0 [ 722.635631][T27317] ? __might_fault+0xaf/0x130 [ 722.635655][T27317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 722.635683][T27317] ? import_iovec+0x73/0xa0 [ 722.635703][T27317] ___sys_sendmsg+0x2a5/0x360 [ 722.635722][T27317] ? __lock_acquire+0x6b5/0x2cf0 [ 722.635743][T27317] ? __pfx____sys_sendmsg+0x10/0x10 [ 722.635793][T27317] ? __fget_files+0x2a/0x420 [ 722.635809][T27317] ? __fget_files+0x3a0/0x420 [ 722.635835][T27317] __x64_sys_sendmsg+0x1bd/0x2a0 [ 722.635857][T27317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 722.635885][T27317] ? __pfx_ksys_write+0x10/0x10 [ 722.635916][T27317] do_syscall_64+0x14d/0xf80 [ 722.635938][T27317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.635954][T27317] ? trace_irq_disable+0x37/0x100 [ 722.635972][T27317] ? clear_bhb_loop+0x40/0x90 [ 722.635991][T27317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 722.636007][T27317] RIP: 0033:0x7ffbc0f9bf79 [ 722.636022][T27317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.636036][T27317] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 722.636053][T27317] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 722.636065][T27317] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 722.636076][T27317] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 722.636085][T27317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 722.636095][T27317] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 722.636123][T27317] [ 722.669450][T27081] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 722.878136][T27325] netlink: 180 bytes leftover after parsing attributes in process `syz.1.6174'. [ 722.888766][T27081] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 722.918787][T27325] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6174'. [ 723.044657][T27321] IPv6: sit1: Disabled Multicast RS [ 723.155350][T27081] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 723.178830][T27337] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6176'. [ 723.426662][T27352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6180'. [ 723.528854][ T5822] Bluetooth: hci0: command tx timeout [ 723.648012][T27368] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6185'. [ 723.765439][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5140 ms [ 723.773981][ C1] lec:lec_tx_timeout: lec0 [ 723.778719][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 723.993854][T27081] veth0_vlan: entered promiscuous mode [ 724.195020][T27395] IPv6: addrconf: prefix option has invalid lifetime [ 724.201423][T27081] veth1_vlan: entered promiscuous mode [ 724.221238][T27394] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6192'. [ 724.250926][T27081] veth0_macvtap: entered promiscuous mode [ 724.272744][T27081] veth1_macvtap: entered promiscuous mode [ 724.308137][T27081] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 724.344788][T27081] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 724.361482][T15442] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 724.372067][T15442] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 724.420732][T15442] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 724.507608][T15442] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 724.527556][T27404] FAULT_INJECTION: forcing a failure. [ 724.527556][T27404] name failslab, interval 1, probability 0, space 0, times 0 [ 724.550922][T27404] CPU: 0 UID: 0 PID: 27404 Comm: syz.3.6196 Not tainted syzkaller #0 PREEMPT(full) [ 724.550947][T27404] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 724.550965][T27404] Call Trace: [ 724.550973][T27404] [ 724.550981][T27404] dump_stack_lvl+0xe8/0x150 [ 724.551008][T27404] should_fail_ex+0x412/0x560 [ 724.551036][T27404] should_failslab+0xa8/0x100 [ 724.551060][T27404] __kmalloc_noprof+0xe8/0x760 [ 724.551081][T27404] ? ioctl_standard_iw_point+0x516/0xd90 [ 724.551102][T27404] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 724.551127][T27404] ioctl_standard_iw_point+0x516/0xd90 [ 724.551160][T27404] ? __pfx_cfg80211_wext_giwscan+0x10/0x10 [ 724.551177][T27404] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 724.551199][T27404] ? __pfx___mutex_lock+0x10/0x10 [ 724.551227][T27404] ? __pfx_cfg80211_wext_giwscan+0x10/0x10 [ 724.551245][T27404] ioctl_standard_call+0xaf/0x1b0 [ 724.551266][T27404] ? __pfx_cfg80211_wext_giwscan+0x10/0x10 [ 724.551281][T27404] wext_ioctl_dispatch+0xee/0x410 [ 724.551299][T27404] ? __pfx_ioctl_standard_call+0x10/0x10 [ 724.551325][T27404] wext_handle_ioctl+0x10f/0x1d0 [ 724.551350][T27404] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 724.551367][T27404] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 724.551403][T27404] sock_ioctl+0x159/0x7f0 [ 724.551428][T27404] ? __pfx_sock_ioctl+0x10/0x10 [ 724.551449][T27404] ? __fget_files+0x2a/0x420 [ 724.551465][T27404] ? __fget_files+0x3a0/0x420 [ 724.551480][T27404] ? __fget_files+0x2a/0x420 [ 724.551499][T27404] ? bpf_lsm_file_ioctl+0x9/0x20 [ 724.551515][T27404] ? __pfx_sock_ioctl+0x10/0x10 [ 724.551536][T27404] __se_sys_ioctl+0xfc/0x170 [ 724.551558][T27404] do_syscall_64+0x14d/0xf80 [ 724.551579][T27404] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.551594][T27404] ? trace_irq_disable+0x37/0x100 [ 724.551611][T27404] ? clear_bhb_loop+0x40/0x90 [ 724.551632][T27404] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.551648][T27404] RIP: 0033:0x7f0c1659bf79 [ 724.551663][T27404] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 724.551678][T27404] RSP: 002b:00007f0c1747e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 724.551696][T27404] RAX: ffffffffffffffda RBX: 00007f0c16815fa0 RCX: 00007f0c1659bf79 [ 724.551708][T27404] RDX: 0000200000000040 RSI: 0000000000008b19 RDI: 0000000000000004 [ 724.551719][T27404] RBP: 00007f0c1747e090 R08: 0000000000000000 R09: 0000000000000000 [ 724.551730][T27404] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 724.551740][T27404] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 724.551769][T27404] [ 724.815213][T27402] bond7: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 724.900618][T27402] bond7 (unregistering): Released all slaves [ 724.948683][T27412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6197'. [ 724.964842][T27414] netlink: 'syz.3.6198': attribute type 10 has an invalid length. [ 725.202112][T15440] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.224278][T15440] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.301311][T27423] netlink: 'syz.1.6201': attribute type 2 has an invalid length. [ 725.311660][T15449] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.326773][T15449] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.337754][T27423] netlink: 224 bytes leftover after parsing attributes in process `syz.1.6201'. [ 725.431717][T27427] FAULT_INJECTION: forcing a failure. [ 725.431717][T27427] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 725.495519][T27427] CPU: 0 UID: 0 PID: 27427 Comm: syz.0.6203 Not tainted syzkaller #0 PREEMPT(full) [ 725.495547][T27427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 725.495559][T27427] Call Trace: [ 725.495566][T27427] [ 725.495575][T27427] dump_stack_lvl+0xe8/0x150 [ 725.495603][T27427] should_fail_ex+0x412/0x560 [ 725.495630][T27427] prepare_alloc_pages+0x22a/0x650 [ 725.495660][T27427] __alloc_frozen_pages_noprof+0x12f/0x380 [ 725.495684][T27427] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 725.495708][T27427] ? __pfx_policy_nodemask+0x10/0x10 [ 725.495731][T27427] ? __lock_acquire+0x6b5/0x2cf0 [ 725.495755][T27427] alloc_pages_mpol+0x232/0x4a0 [ 725.495778][T27427] alloc_pages_noprof+0xa8/0x190 [ 725.495799][T27427] pte_alloc_one+0x23/0x370 [ 725.495817][T27427] ? __pte_alloc+0x1d/0x430 [ 725.495839][T27427] __pte_alloc+0x25/0x430 [ 725.495861][T27427] do_pte_missing+0x2edb/0x37a0 [ 725.495884][T27427] ? do_raw_spin_unlock+0xf5/0x210 [ 725.495915][T27427] handle_mm_fault+0x1b8c/0x32a0 [ 725.495946][T27427] ? handle_mm_fault+0xee/0x32a0 [ 725.495978][T27427] ? __pfx_handle_mm_fault+0x10/0x10 [ 725.496009][T27427] ? __lock_acquire+0x6b5/0x2cf0 [ 725.496030][T27427] ? lock_mm_and_find_vma+0xa7/0x340 [ 725.496053][T27427] do_user_addr_fault+0x75b/0x1360 [ 725.496087][T27427] exc_page_fault+0x6a/0xc0 [ 725.496110][T27427] asm_exc_page_fault+0x26/0x30 [ 725.496126][T27427] RIP: 0010:rep_movs_alternative+0x30/0x90 [ 725.496144][T27427] Code: 83 f9 08 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <48> 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 [ 725.496158][T27427] RSP: 0018:ffffc9000bd1fa18 EFLAGS: 00050202 [ 725.496175][T27427] RAX: 00007ffffffff001 RBX: 0000000000000028 RCX: 0000000000000028 [ 725.496187][T27427] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: ffffc9000bd1fbe0 [ 725.496198][T27427] RBP: ffffc9000bd1fb30 R08: ffffc9000bd1fc07 R09: 1ffff920017a3f80 [ 725.496211][T27427] R10: dffffc0000000000 R11: fffff520017a3f81 R12: ffffc9000bd1fbe0 [ 725.496223][T27427] R13: ffff8880530e0010 R14: ffffc9000bd1fbe0 R15: 00002000000000c0 [ 725.496252][T27427] _copy_from_user+0x7a/0xb0 [ 725.496272][T27427] xt_copy_counters+0x199/0x4c0 [ 725.496297][T27427] ? __pfx_xt_copy_counters+0x10/0x10 [ 725.496318][T27427] ? apparmor_capable+0x137/0x1a0 [ 725.496339][T27427] ? bpf_lsm_capable+0x9/0x20 [ 725.496357][T27427] ? security_capable+0x7e/0x2c0 [ 725.496385][T27427] do_arpt_set_ctl+0x1c2/0x1050 [ 725.496410][T27427] ? __mutex_trylock_common+0x158/0x260 [ 725.496435][T27427] ? __pfx___mutex_trylock_common+0x10/0x10 [ 725.496455][T27427] ? __pfx_do_arpt_set_ctl+0x10/0x10 [ 725.496478][T27427] ? trace_contention_end+0x39/0x100 [ 725.496506][T27427] ? nf_setsockopt+0x221/0x290 [ 725.496532][T27427] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 725.496557][T27427] ? __pfx___mutex_lock+0x10/0x10 [ 725.496578][T27427] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 725.496605][T27427] ? __pfx_aa_sk_perm+0x10/0x10 [ 725.496630][T27427] nf_setsockopt+0x26f/0x290 [ 725.496649][T27427] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 725.496667][T27427] do_sock_setsockopt+0x17c/0x1b0 [ 725.496691][T27427] __x64_sys_setsockopt+0x13d/0x1b0 [ 725.496713][T27427] do_syscall_64+0x14d/0xf80 [ 725.496729][T27427] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.496742][T27427] ? trace_irq_disable+0x37/0x100 [ 725.496758][T27427] ? clear_bhb_loop+0x40/0x90 [ 725.496774][T27427] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 725.496789][T27427] RIP: 0033:0x7ffbc0f9bf79 [ 725.496805][T27427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 725.496819][T27427] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 725.496834][T27427] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 725.496844][T27427] RDX: 0000000000000061 RSI: 0000000000000000 RDI: 0000000000000003 [ 725.496853][T27427] RBP: 00007ffbbf1f6090 R08: 0000000000000068 R09: 0000000000000000 [ 725.496863][T27427] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 725.496872][T27427] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 725.496896][T27427] [ 725.957179][ T5822] Bluetooth: hci0: command tx timeout [ 726.283627][T27444] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 726.314229][T27444] bond1 (unregistering): Released all slaves [ 726.457196][T27455] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6210'. [ 726.466554][T27455] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6210'. [ 726.640157][T27458] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6211'. [ 726.807882][T27470] FAULT_INJECTION: forcing a failure. [ 726.807882][T27470] name failslab, interval 1, probability 0, space 0, times 0 [ 726.825550][T27470] CPU: 0 UID: 0 PID: 27470 Comm: syz.0.6212 Not tainted syzkaller #0 PREEMPT(full) [ 726.825572][T27470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 726.825581][T27470] Call Trace: [ 726.825588][T27470] [ 726.825595][T27470] dump_stack_lvl+0xe8/0x150 [ 726.825621][T27470] should_fail_ex+0x412/0x560 [ 726.825649][T27470] should_failslab+0xa8/0x100 [ 726.825669][T27470] ? __kernfs_new_node+0xe9/0x8e0 [ 726.825688][T27470] kmem_cache_alloc_noprof+0x87/0x650 [ 726.825704][T27470] ? kasan_save_track+0x3e/0x80 [ 726.825720][T27470] ? __kasan_slab_alloc+0x6c/0x80 [ 726.825737][T27470] ? __kernfs_new_node+0xe9/0x8e0 [ 726.825759][T27470] __kernfs_new_node+0xe9/0x8e0 [ 726.825782][T27470] ? __pfx___kernfs_new_node+0x10/0x10 [ 726.825801][T27470] ? kernfs_root+0x1c/0x230 [ 726.825823][T27470] ? kernfs_root+0x1c/0x230 [ 726.825840][T27470] ? kernfs_root+0x1c/0x230 [ 726.825855][T27470] ? kernfs_root+0x1c/0x230 [ 726.825876][T27470] kernfs_new_node+0x102/0x210 [ 726.825899][T27470] __kernfs_create_file+0x4b/0x2e0 [ 726.825917][T27470] sysfs_add_file_mode_ns+0x238/0x300 [ 726.825941][T27470] internal_create_group+0x673/0x1180 [ 726.825981][T27470] ? __pfx_internal_create_group+0x10/0x10 [ 726.825998][T27470] ? kernfs_add_one+0x477/0x5c0 [ 726.826020][T27470] ? up_write+0x1ab/0x410 [ 726.826043][T27470] sysfs_create_groups+0x59/0x120 [ 726.826063][T27470] device_add_attrs+0x1bf/0x5b0 [ 726.826079][T27470] ? kernfs_put+0x40e/0x470 [ 726.826098][T27470] ? __pfx_device_add_attrs+0x10/0x10 [ 726.826111][T27470] ? kobject_put+0x516/0x560 [ 726.826136][T27470] ? device_add_class_symlinks+0x21f/0x240 [ 726.826155][T27470] device_add+0x496/0xb70 [ 726.826170][T27470] ? device_initialize+0x24b/0x440 [ 726.826187][T27470] wakeup_source_sysfs_add+0x1d3/0x2c0 [ 726.826209][T27470] wakeup_source_register+0x18a/0x380 [ 726.826228][T27470] ep_insert+0x1022/0x1a40 [ 726.826261][T27470] ? __pfx_ep_insert+0x10/0x10 [ 726.826288][T27470] ? ep_loop_check+0x50/0x1b0 [ 726.826310][T27470] do_epoll_ctl+0x7f4/0xe80 [ 726.826333][T27470] __x64_sys_epoll_ctl+0x165/0x1b0 [ 726.826350][T27470] ? __pfx___x64_sys_epoll_ctl+0x10/0x10 [ 726.826376][T27470] do_syscall_64+0x14d/0xf80 [ 726.826395][T27470] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.826410][T27470] ? trace_irq_disable+0x37/0x100 [ 726.826427][T27470] ? clear_bhb_loop+0x40/0x90 [ 726.826446][T27470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.826460][T27470] RIP: 0033:0x7ffbc0f9bf79 [ 726.826474][T27470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 726.826488][T27470] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 [ 726.826505][T27470] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 726.826516][T27470] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000003 [ 726.826525][T27470] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 726.826534][T27470] R10: 0000200000000100 R11: 0000000000000246 R12: 0000000000000002 [ 726.826544][T27470] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 726.826571][T27470] [ 727.660074][T27483] delete_channel: no stack [ 727.674238][T27483] delete_channel: no stack [ 728.427542][T27479] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.443958][T27479] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.468918][T27482] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 728.476745][T27482] syzkaller1: linktype set to 270 [ 728.519996][T27479] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.531012][T27479] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.587639][T27487] syzkaller0: entered promiscuous mode [ 728.596215][T27487] syzkaller0: entered allmulticast mode [ 728.628865][T27479] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.644787][T27479] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.683676][T27492] netlink: 'syz.0.6218': attribute type 1 has an invalid length. [ 728.700704][T27492] netlink: 2088 bytes leftover after parsing attributes in process `syz.0.6218'. [ 728.747229][T27479] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 728.765620][T27479] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 728.795514][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 728.803546][ C1] lec:lec_tx_timeout: lec0 [ 728.808685][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 728.876887][T27497] netlink: 'syz.4.6219': attribute type 10 has an invalid length. [ 729.270846][T27455] ip6_vti0 speed is unknown, defaulting to 1000 [ 729.377850][T27510] netlink: 64 bytes leftover after parsing attributes in process `syz.1.6222'. [ 729.429420][T15247] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 729.439623][T15247] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.462587][T15247] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 729.470954][T15247] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.481010][T15247] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 729.528478][T15247] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.635499][T15439] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 729.643705][T15439] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 729.934421][T27531] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 730.352265][T27531] bond1 (unregistering): Released all slaves [ 730.648595][T27571] netlink: 'syz.1.6234': attribute type 10 has an invalid length. [ 731.252969][T27569] ip6_vti0 speed is unknown, defaulting to 1000 [ 731.292631][T27590] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6238'. [ 731.326291][T27592] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6240'. [ 731.448346][T27590] bond1: option broadcast_neighbor: invalid value (30) [ 731.511170][T27590] bond1 (unregistering): Released all slaves [ 731.628168][T27592] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6240'. [ 731.665769][T27592] tipc: Enabled bearer , priority 0 [ 731.796137][T27612] netlink: 'syz.0.6242': attribute type 10 has an invalid length. [ 732.122643][T27620] netdevsim netdevsim4: Direct firmware load for ..€ failed with error -2 [ 732.138521][T27620] netdevsim netdevsim4: Falling back to sysfs fallback for: ..€ [ 732.153862][T27626] tipc: Resetting bearer [ 732.169932][T27626] tipc: Resetting bearer [ 732.249500][T27573] ip6_vti0 speed is unknown, defaulting to 1000 [ 732.622450][T27638] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6248'. [ 733.197896][T27671] FAULT_INJECTION: forcing a failure. [ 733.197896][T27671] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 733.257834][T27671] CPU: 0 UID: 0 PID: 27671 Comm: syz.0.6255 Not tainted syzkaller #0 PREEMPT(full) [ 733.257864][T27671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 733.257875][T27671] Call Trace: [ 733.257883][T27671] [ 733.257892][T27671] dump_stack_lvl+0xe8/0x150 [ 733.257920][T27671] should_fail_ex+0x412/0x560 [ 733.257949][T27671] _copy_from_user+0x2d/0xb0 [ 733.257969][T27671] kstrtouint_from_user+0xd6/0x180 [ 733.257994][T27671] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 733.258033][T27671] proc_fail_nth_write+0x8e/0x210 [ 733.258055][T27671] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 733.258080][T27671] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 733.258102][T27671] vfs_write+0x29a/0xb90 [ 733.258131][T27671] ? __pfx_vfs_write+0x10/0x10 [ 733.258151][T27671] ? __fget_files+0x2a/0x420 [ 733.258173][T27671] ? __fget_files+0x3a0/0x420 [ 733.258188][T27671] ? __fget_files+0x2a/0x420 [ 733.258212][T27671] ksys_write+0x150/0x270 [ 733.258234][T27671] ? __pfx_ksys_write+0x10/0x10 [ 733.258265][T27671] do_syscall_64+0x14d/0xf80 [ 733.258286][T27671] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.258303][T27671] ? trace_irq_disable+0x37/0x100 [ 733.258322][T27671] ? clear_bhb_loop+0x40/0x90 [ 733.258343][T27671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 733.258359][T27671] RIP: 0033:0x7ffbc0f5c84e [ 733.258376][T27671] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 733.258391][T27671] RSP: 002b:00007ffbbf1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 733.258410][T27671] RAX: ffffffffffffffda RBX: 00007ffbbf1f66c0 RCX: 00007ffbc0f5c84e [ 733.258422][T27671] RDX: 0000000000000001 RSI: 00007ffbbf1f60a0 RDI: 0000000000000004 [ 733.258434][T27671] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 733.258444][T27671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 733.258455][T27671] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 733.258484][T27671] [ 733.815464][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 733.823569][ C1] lec:lec_tx_timeout: lec0 [ 733.829112][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 734.847184][T27638] ip6_vti0 speed is unknown, defaulting to 1000 [ 734.925646][T27716] x_tables: duplicate underflow at hook 2 [ 735.085145][T27725] FAULT_INJECTION: forcing a failure. [ 735.085145][T27725] name failslab, interval 1, probability 0, space 0, times 0 [ 735.099288][T27725] CPU: 1 UID: 0 PID: 27725 Comm: syz.3.6265 Not tainted syzkaller #0 PREEMPT(full) [ 735.099314][T27725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 735.099326][T27725] Call Trace: [ 735.099334][T27725] [ 735.099342][T27725] dump_stack_lvl+0xe8/0x150 [ 735.099371][T27725] should_fail_ex+0x412/0x560 [ 735.099407][T27725] should_failslab+0xa8/0x100 [ 735.099431][T27725] ? skb_clone+0x212/0x3a0 [ 735.099452][T27725] kmem_cache_alloc_noprof+0x87/0x650 [ 735.099473][T27725] ? __netlink_lookup+0xc6/0x8b0 [ 735.099499][T27725] skb_clone+0x212/0x3a0 [ 735.099522][T27725] __netlink_deliver_tap+0x404/0x850 [ 735.099550][T27725] ? netlink_deliver_tap+0x2e/0x1b0 [ 735.099569][T27725] netlink_deliver_tap+0x19c/0x1b0 [ 735.099587][T27725] netlink_unicast+0x7e3/0x9b0 [ 735.099619][T27725] ? __pfx_netlink_unicast+0x10/0x10 [ 735.099642][T27725] ? netlink_sendmsg+0x650/0xb40 [ 735.099657][T27725] ? skb_put+0x11b/0x210 [ 735.099678][T27725] netlink_sendmsg+0x813/0xb40 [ 735.099704][T27725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 735.099724][T27725] ? aa_sock_msg_perm+0xf1/0x1b0 [ 735.099748][T27725] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 735.099772][T27725] ? __pfx_netlink_sendmsg+0x10/0x10 [ 735.099789][T27725] ____sys_sendmsg+0xa68/0xad0 [ 735.099810][T27725] ? __might_fault+0xaf/0x130 [ 735.099835][T27725] ? __pfx_____sys_sendmsg+0x10/0x10 [ 735.099864][T27725] ? import_iovec+0x73/0xa0 [ 735.099886][T27725] ___sys_sendmsg+0x2a5/0x360 [ 735.099904][T27725] ? __lock_acquire+0x6b5/0x2cf0 [ 735.099928][T27725] ? __pfx____sys_sendmsg+0x10/0x10 [ 735.099981][T27725] ? __fget_files+0x2a/0x420 [ 735.099997][T27725] ? __fget_files+0x3a0/0x420 [ 735.100023][T27725] __x64_sys_sendmsg+0x1bd/0x2a0 [ 735.100045][T27725] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 735.100074][T27725] ? __pfx_ksys_write+0x10/0x10 [ 735.100105][T27725] do_syscall_64+0x14d/0xf80 [ 735.100127][T27725] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.100143][T27725] ? trace_irq_disable+0x37/0x100 [ 735.100162][T27725] ? clear_bhb_loop+0x40/0x90 [ 735.100182][T27725] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 735.100199][T27725] RIP: 0033:0x7f0c1659bf79 [ 735.100216][T27725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 735.100230][T27725] RSP: 002b:00007f0c1745d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 735.100250][T27725] RAX: ffffffffffffffda RBX: 00007f0c16816090 RCX: 00007f0c1659bf79 [ 735.100262][T27725] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000008 [ 735.100274][T27725] RBP: 00007f0c1745d090 R08: 0000000000000000 R09: 0000000000000000 [ 735.100285][T27725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 735.100294][T27725] R13: 00007f0c16816128 R14: 00007f0c16816090 R15: 00007ffe6fbc2238 [ 735.100324][T27725] [ 736.441663][T27764] xt_bpf: check failed: parse error [ 736.569672][T27768] xt_l2tp: missing protocol rule (udp|l2tpip) [ 736.744879][T27771] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6272'. [ 736.830065][T27772] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6272'. [ 736.937565][T27778] netlink: 60 bytes leftover after parsing attributes in process `syz.3.6274'. [ 736.958970][T27778] xt_hashlimit: size too large, truncated to 1048576 [ 736.962796][T27758] ip6_vti0 speed is unknown, defaulting to 1000 [ 736.967679][T27778] xt_hashlimit: max too large, truncated to 1048576 [ 737.062267][T27778] netlink: 88 bytes leftover after parsing attributes in process `syz.3.6274'. [ 737.249194][T27784] FAULT_INJECTION: forcing a failure. [ 737.249194][T27784] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.308235][T27784] CPU: 0 UID: 0 PID: 27784 Comm: syz.3.6277 Not tainted syzkaller #0 PREEMPT(full) [ 737.308260][T27784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 737.308272][T27784] Call Trace: [ 737.308279][T27784] [ 737.308287][T27784] dump_stack_lvl+0xe8/0x150 [ 737.308316][T27784] should_fail_ex+0x412/0x560 [ 737.308346][T27784] _copy_to_user+0x31/0xb0 [ 737.308367][T27784] simple_read_from_buffer+0xe1/0x170 [ 737.308398][T27784] proc_fail_nth_read+0x1bb/0x230 [ 737.308424][T27784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.308448][T27784] ? rw_verify_area+0x2a6/0x4d0 [ 737.308468][T27784] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.308490][T27784] vfs_read+0x20c/0xa70 [ 737.308507][T27784] ? fdget_pos+0x246/0x320 [ 737.308537][T27784] ? __pfx___mutex_lock+0x10/0x10 [ 737.308561][T27784] ? __pfx_vfs_read+0x10/0x10 [ 737.308582][T27784] ? __fget_files+0x2a/0x420 [ 737.308602][T27784] ? __fget_files+0x3a0/0x420 [ 737.308617][T27784] ? __fget_files+0x2a/0x420 [ 737.308642][T27784] ksys_read+0x150/0x270 [ 737.308663][T27784] ? __pfx_ksys_read+0x10/0x10 [ 737.308694][T27784] do_syscall_64+0x14d/0xf80 [ 737.308714][T27784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.308730][T27784] ? trace_irq_disable+0x37/0x100 [ 737.308750][T27784] ? clear_bhb_loop+0x40/0x90 [ 737.308769][T27784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.308783][T27784] RIP: 0033:0x7f0c1655c84e [ 737.308799][T27784] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 737.308813][T27784] RSP: 002b:00007f0c1747dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 737.308831][T27784] RAX: ffffffffffffffda RBX: 00007f0c1747e6c0 RCX: 00007f0c1655c84e [ 737.308844][T27784] RDX: 000000000000000f RSI: 00007f0c1747e0a0 RDI: 0000000000000004 [ 737.308855][T27784] RBP: 00007f0c1747e090 R08: 0000000000000000 R09: 0000000000000000 [ 737.308866][T27784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.308876][T27784] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 737.308906][T27784] [ 737.576503][T27790] netlink: 'syz.3.6279': attribute type 6 has an invalid length. [ 737.584358][T27790] netlink: 'syz.3.6279': attribute type 7 has an invalid length. [ 737.592238][T27790] netlink: 'syz.3.6279': attribute type 8 has an invalid length. [ 737.600869][T27790] netlink: 'syz.3.6279': attribute type 13 has an invalid length. [ 737.690776][T27793] netlink: 27 bytes leftover after parsing attributes in process `syz.4.6280'. [ 737.835967][T27800] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6282'. [ 737.850980][T27800] xt_hashlimit: size too large, truncated to 1048576 [ 737.865585][T27800] xt_hashlimit: max too large, truncated to 1048576 [ 737.880337][T27800] netlink: 'syz.0.6282': attribute type 1 has an invalid length. [ 737.888106][T27800] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6282'. [ 737.897273][T27800] FAULT_INJECTION: forcing a failure. [ 737.897273][T27800] name failslab, interval 1, probability 0, space 0, times 0 [ 737.915611][T27800] CPU: 0 UID: 0 PID: 27800 Comm: syz.0.6282 Not tainted syzkaller #0 PREEMPT(full) [ 737.915634][T27800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 737.915645][T27800] Call Trace: [ 737.915659][T27800] [ 737.915667][T27800] dump_stack_lvl+0xe8/0x150 [ 737.915692][T27800] should_fail_ex+0x412/0x560 [ 737.915719][T27800] should_failslab+0xa8/0x100 [ 737.915746][T27800] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 737.915771][T27800] ? __alloc_skb+0x1d0/0x7d0 [ 737.915789][T27800] ? __local_bh_enable_ip+0xd0/0x130 [ 737.915811][T27800] __alloc_skb+0x1d0/0x7d0 [ 737.915829][T27800] ? netlink_ack_tlv_len+0x6c/0x210 [ 737.915848][T27800] netlink_ack+0x146/0xa50 [ 737.915863][T27800] ? __pfx_genl_rcv_msg+0x10/0x10 [ 737.915898][T27800] netlink_rcv_skb+0x2b6/0x4b0 [ 737.915916][T27800] ? __pfx_genl_rcv_msg+0x10/0x10 [ 737.915937][T27800] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 737.915952][T27800] ? genl_rcv+0x19/0x40 [ 737.915985][T27800] ? down_read+0x272/0x2e0 [ 737.916006][T27800] ? genl_rcv+0xd/0x40 [ 737.916027][T27800] genl_rcv+0x28/0x40 [ 737.916044][T27800] netlink_unicast+0x80f/0x9b0 [ 737.916076][T27800] ? __pfx_netlink_unicast+0x10/0x10 [ 737.916099][T27800] ? netlink_sendmsg+0x650/0xb40 [ 737.916115][T27800] ? skb_put+0x11b/0x210 [ 737.916136][T27800] netlink_sendmsg+0x813/0xb40 [ 737.916162][T27800] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.916181][T27800] ? aa_sock_msg_perm+0xf1/0x1b0 [ 737.916206][T27800] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 737.916230][T27800] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.916246][T27800] ____sys_sendmsg+0xa68/0xad0 [ 737.916267][T27800] ? __might_fault+0xaf/0x130 [ 737.916293][T27800] ? __pfx_____sys_sendmsg+0x10/0x10 [ 737.916321][T27800] ? import_iovec+0x73/0xa0 [ 737.916342][T27800] ___sys_sendmsg+0x2a5/0x360 [ 737.916361][T27800] ? __lock_acquire+0x6b5/0x2cf0 [ 737.916384][T27800] ? __pfx____sys_sendmsg+0x10/0x10 [ 737.916436][T27800] ? __fget_files+0x2a/0x420 [ 737.916452][T27800] ? __fget_files+0x3a0/0x420 [ 737.916479][T27800] __x64_sys_sendmsg+0x1bd/0x2a0 [ 737.916501][T27800] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 737.916531][T27800] ? __pfx_ksys_write+0x10/0x10 [ 737.916562][T27800] do_syscall_64+0x14d/0xf80 [ 737.916581][T27800] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.916597][T27800] ? trace_irq_disable+0x37/0x100 [ 737.916615][T27800] ? clear_bhb_loop+0x40/0x90 [ 737.916635][T27800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.916658][T27800] RIP: 0033:0x7ffbc0f9bf79 [ 737.916674][T27800] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 737.916688][T27800] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 737.916707][T27800] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 737.916719][T27800] RDX: 0000000004000010 RSI: 00002000000001c0 RDI: 000000000000000b [ 737.916730][T27800] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 737.916741][T27800] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.916751][T27800] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 737.916780][T27800] [ 737.938566][T27804] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.038803][T27808] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 738.093795][T27809] netlink: 10 bytes leftover after parsing attributes in process `syz.3.6284'. [ 738.504632][T27800] bridge0: port 2(bridge_slave_1) entered disabled state [ 738.512290][T27800] bridge0: port 1(bridge_slave_0) entered disabled state [ 738.835462][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 738.843482][ C1] lec:lec_tx_timeout: lec0 [ 738.848535][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 738.956815][T27800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 738.985855][T27800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 739.290093][T27814] netlink: 'syz.0.6286': attribute type 1 has an invalid length. [ 739.304733][T27814] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6286'. [ 739.315684][T15439] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.337180][T15439] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.365739][T15439] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.374125][T15439] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.699886][T27817] ip6_vti0 speed is unknown, defaulting to 1000 [ 739.979133][T27827] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 740.003368][T27827] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 740.060919][T27828] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6291'. [ 740.094849][T27827] FAULT_INJECTION: forcing a failure. [ 740.094849][T27827] name failslab, interval 1, probability 0, space 0, times 0 [ 740.115773][T27827] CPU: 0 UID: 0 PID: 27827 Comm: syz.0.6291 Not tainted syzkaller #0 PREEMPT(full) [ 740.115796][T27827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 740.115806][T27827] Call Trace: [ 740.115814][T27827] [ 740.115821][T27827] dump_stack_lvl+0xe8/0x150 [ 740.115847][T27827] should_fail_ex+0x412/0x560 [ 740.115873][T27827] should_failslab+0xa8/0x100 [ 740.115895][T27827] ? skb_clone+0x212/0x3a0 [ 740.115916][T27827] kmem_cache_alloc_noprof+0x87/0x650 [ 740.115934][T27827] ? apparmor_capable+0x137/0x1a0 [ 740.115958][T27827] skb_clone+0x212/0x3a0 [ 740.115976][T27827] ? nfnetlink_rcv+0x4b0/0x27b0 [ 740.116002][T27827] nfnetlink_rcv+0x4e2/0x27b0 [ 740.116032][T27827] ? is_bpf_text_address+0x26/0x2b0 [ 740.116058][T27827] ? kernel_text_address+0xa5/0xe0 [ 740.116081][T27827] ? __kernel_text_address+0xd/0x30 [ 740.116101][T27827] ? unwind_get_return_address+0x4d/0x90 [ 740.116128][T27827] ? __lock_acquire+0x6b5/0x2cf0 [ 740.116149][T27827] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 740.116187][T27827] ? __lock_acquire+0x6b5/0x2cf0 [ 740.116213][T27827] ? __netlink_lookup+0xc6/0x8b0 [ 740.116242][T27827] ? netlink_deliver_tap+0x2e/0x1b0 [ 740.116260][T27827] ? netlink_deliver_tap+0x2e/0x1b0 [ 740.116292][T27827] netlink_unicast+0x80f/0x9b0 [ 740.116322][T27827] ? __pfx_netlink_unicast+0x10/0x10 [ 740.116353][T27827] ? netlink_sendmsg+0x650/0xb40 [ 740.116368][T27827] ? skb_put+0x11b/0x210 [ 740.116389][T27827] netlink_sendmsg+0x813/0xb40 [ 740.116415][T27827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.116435][T27827] ? aa_sock_msg_perm+0xf1/0x1b0 [ 740.116458][T27827] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 740.116480][T27827] ? __pfx_netlink_sendmsg+0x10/0x10 [ 740.116496][T27827] ____sys_sendmsg+0xa68/0xad0 [ 740.116515][T27827] ? __might_fault+0xaf/0x130 [ 740.116540][T27827] ? __pfx_____sys_sendmsg+0x10/0x10 [ 740.116568][T27827] ? import_iovec+0x73/0xa0 [ 740.116589][T27827] ___sys_sendmsg+0x2a5/0x360 [ 740.116607][T27827] ? __lock_acquire+0x6b5/0x2cf0 [ 740.116628][T27827] ? __pfx____sys_sendmsg+0x10/0x10 [ 740.116679][T27827] ? __fget_files+0x2a/0x420 [ 740.116694][T27827] ? __fget_files+0x3a0/0x420 [ 740.116720][T27827] __x64_sys_sendmsg+0x1bd/0x2a0 [ 740.116743][T27827] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 740.116771][T27827] ? __pfx_ksys_write+0x10/0x10 [ 740.116801][T27827] do_syscall_64+0x14d/0xf80 [ 740.116822][T27827] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.116838][T27827] ? trace_irq_disable+0x37/0x100 [ 740.116856][T27827] ? clear_bhb_loop+0x40/0x90 [ 740.116875][T27827] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 740.116891][T27827] RIP: 0033:0x7ffbc0f9bf79 [ 740.116907][T27827] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 740.116921][T27827] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 740.116939][T27827] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 740.116952][T27827] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000007 [ 740.116963][T27827] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 740.116974][T27827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.116984][T27827] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 740.117012][T27827] [ 741.559948][T27865] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 741.598355][T27865] bond1 (unregistering): Released all slaves [ 742.049016][T27869] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 742.127799][T27874] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 742.307161][T27882] __nla_validate_parse: 5 callbacks suppressed [ 742.307179][T27882] netlink: 27 bytes leftover after parsing attributes in process `syz.2.6304'. [ 742.357611][T27888] netlink: 'syz.0.6306': attribute type 10 has an invalid length. [ 742.428994][T27890] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6308'. [ 742.644488][T27902] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6309'. [ 742.841223][ T30] audit: type=1804 audit(1770922258.977:6): pid=27908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.6310" name="/newroot/555/cgroup.controllers" dev="tmpfs" ino=2826 res=1 errno=0 [ 742.923370][ T30] audit: type=1800 audit(1770922258.987:7): pid=27908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.6310" name="cgroup.controllers" dev="tmpfs" ino=2826 res=0 errno=0 [ 743.331849][T27938] netlink: 27 bytes leftover after parsing attributes in process `syz.0.6319'. [ 743.437485][T27945] netlink: 'syz.3.6322': attribute type 8 has an invalid length. [ 743.467979][T27945] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6322'. [ 743.579200][T27954] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6326'. [ 743.596683][T27954] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6326'. [ 743.621562][T27954] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6326'. [ 743.752734][T27963] Bluetooth: MGMT ver 1.23 [ 743.855501][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 743.863634][ C1] lec:lec_tx_timeout: lec0 [ 743.868334][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 743.936554][T27969] netlink: 104 bytes leftover after parsing attributes in process `syz.0.6332'. [ 744.034032][T27971] netlink: 27 bytes leftover after parsing attributes in process `syz.2.6333'. [ 744.096908][T27973] FAULT_INJECTION: forcing a failure. [ 744.096908][T27973] name failslab, interval 1, probability 0, space 0, times 0 [ 744.112982][T27973] CPU: 0 UID: 0 PID: 27973 Comm: syz.2.6334 Not tainted syzkaller #0 PREEMPT(full) [ 744.113008][T27973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 744.113020][T27973] Call Trace: [ 744.113027][T27973] [ 744.113035][T27973] dump_stack_lvl+0xe8/0x150 [ 744.113063][T27973] should_fail_ex+0x412/0x560 [ 744.113092][T27973] should_failslab+0xa8/0x100 [ 744.113116][T27973] __kmalloc_cache_noprof+0x88/0x660 [ 744.113138][T27973] ? __pfx___mutex_lock+0x10/0x10 [ 744.113166][T27973] ? __inet_diag_dump_start+0x8b/0xbf0 [ 744.113188][T27973] ? netlink_lookup+0x30/0x200 [ 744.113209][T27973] __inet_diag_dump_start+0x8b/0xbf0 [ 744.113231][T27973] ? netlink_lookup+0x30/0x200 [ 744.113247][T27973] ? netlink_lookup+0x30/0x200 [ 744.113261][T27973] ? netlink_lookup+0x30/0x200 [ 744.113283][T27973] __netlink_dump_start+0x469/0x7e0 [ 744.113307][T27973] inet_diag_handler_cmd+0x1e0/0x2c0 [ 744.113330][T27973] ? __pfx_inet_diag_handler_cmd+0x10/0x10 [ 744.113350][T27973] ? __pfx_inet_diag_dump_start+0x10/0x10 [ 744.113369][T27973] ? __pfx_inet_diag_dump+0x10/0x10 [ 744.113387][T27973] ? __pfx_inet_diag_dump_done+0x10/0x10 [ 744.113408][T27973] ? sock_diag_lock_handler+0x19/0x290 [ 744.113427][T27973] ? sock_diag_lock_handler+0x19/0x290 [ 744.113449][T27973] sock_diag_rcv_msg+0x4cc/0x600 [ 744.113471][T27973] netlink_rcv_skb+0x232/0x4b0 [ 744.113489][T27973] ? __pfx_sock_diag_rcv_msg+0x10/0x10 [ 744.113509][T27973] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 744.113536][T27973] ? netlink_deliver_tap+0x2e/0x1b0 [ 744.113559][T27973] netlink_unicast+0x80f/0x9b0 [ 744.113588][T27973] ? __pfx_netlink_unicast+0x10/0x10 [ 744.113612][T27973] ? netlink_sendmsg+0x650/0xb40 [ 744.113627][T27973] ? skb_put+0x11b/0x210 [ 744.113648][T27973] netlink_sendmsg+0x813/0xb40 [ 744.113673][T27973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 744.113693][T27973] ? aa_sock_msg_perm+0xf1/0x1b0 [ 744.113715][T27973] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 744.113737][T27973] ? __pfx_netlink_sendmsg+0x10/0x10 [ 744.113754][T27973] ____sys_sendmsg+0xa68/0xad0 [ 744.113773][T27973] ? __might_fault+0xaf/0x130 [ 744.113798][T27973] ? __pfx_____sys_sendmsg+0x10/0x10 [ 744.113827][T27973] ? import_iovec+0x73/0xa0 [ 744.113848][T27973] ___sys_sendmsg+0x2a5/0x360 [ 744.113867][T27973] ? __lock_acquire+0x6b5/0x2cf0 [ 744.113889][T27973] ? __pfx____sys_sendmsg+0x10/0x10 [ 744.113943][T27973] ? __fget_files+0x2a/0x420 [ 744.113960][T27973] ? __fget_files+0x3a0/0x420 [ 744.113986][T27973] __x64_sys_sendmsg+0x1bd/0x2a0 [ 744.114008][T27973] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 744.114036][T27973] ? __pfx_ksys_write+0x10/0x10 [ 744.114067][T27973] do_syscall_64+0x14d/0xf80 [ 744.114089][T27973] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.114105][T27973] ? trace_irq_disable+0x37/0x100 [ 744.114123][T27973] ? clear_bhb_loop+0x40/0x90 [ 744.114143][T27973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 744.114212][T27973] RIP: 0033:0x7fcea0b9bf79 [ 744.114228][T27973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 744.114242][T27973] RSP: 002b:00007fcea1a32028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 744.114261][T27973] RAX: ffffffffffffffda RBX: 00007fcea0e15fa0 RCX: 00007fcea0b9bf79 [ 744.114274][T27973] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 744.114284][T27973] RBP: 00007fcea1a32090 R08: 0000000000000000 R09: 0000000000000000 [ 744.114295][T27973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 744.114305][T27973] R13: 00007fcea0e16038 R14: 00007fcea0e15fa0 R15: 00007ffc1f794188 [ 744.114333][T27973] [ 744.936194][T28000] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 744.943527][T28000] IPv6: NLM_F_CREATE should be set when creating new route [ 744.950804][T28000] IPv6: NLM_F_CREATE should be set when creating new route [ 744.967479][T28000] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 745.072168][T28005] netlink: 'syz.3.6345': attribute type 5 has an invalid length. [ 745.158722][T28008] FAULT_INJECTION: forcing a failure. [ 745.158722][T28008] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 745.172515][T28008] CPU: 0 UID: 0 PID: 28008 Comm: syz.0.6346 Not tainted syzkaller #0 PREEMPT(full) [ 745.172538][T28008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 745.172549][T28008] Call Trace: [ 745.172557][T28008] [ 745.172564][T28008] dump_stack_lvl+0xe8/0x150 [ 745.172593][T28008] should_fail_ex+0x412/0x560 [ 745.172624][T28008] _copy_to_user+0x31/0xb0 [ 745.172645][T28008] simple_read_from_buffer+0xe1/0x170 [ 745.172674][T28008] proc_fail_nth_read+0x1bb/0x230 [ 745.172699][T28008] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 745.172723][T28008] ? rw_verify_area+0x2a6/0x4d0 [ 745.172742][T28008] ? tun_chr_write_iter+0x18a/0x200 [ 745.172762][T28008] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 745.172784][T28008] vfs_read+0x20c/0xa70 [ 745.172800][T28008] ? fdget_pos+0x246/0x320 [ 745.172822][T28008] ? __pfx___mutex_lock+0x10/0x10 [ 745.172845][T28008] ? __pfx_vfs_read+0x10/0x10 [ 745.172864][T28008] ? __fget_files+0x2a/0x420 [ 745.172883][T28008] ? __fget_files+0x3a0/0x420 [ 745.172897][T28008] ? __fget_files+0x2a/0x420 [ 745.172921][T28008] ksys_read+0x150/0x270 [ 745.172942][T28008] ? __pfx_ksys_read+0x10/0x10 [ 745.172970][T28008] do_syscall_64+0x14d/0xf80 [ 745.172991][T28008] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.173008][T28008] ? trace_irq_disable+0x37/0x100 [ 745.173026][T28008] ? clear_bhb_loop+0x40/0x90 [ 745.173045][T28008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 745.173060][T28008] RIP: 0033:0x7ffbc0f5c84e [ 745.173076][T28008] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 745.173090][T28008] RSP: 002b:00007ffbbf1f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 745.173108][T28008] RAX: ffffffffffffffda RBX: 00007ffbbf1f66c0 RCX: 00007ffbc0f5c84e [ 745.173120][T28008] RDX: 000000000000000f RSI: 00007ffbbf1f60a0 RDI: 0000000000000006 [ 745.173129][T28008] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 745.173137][T28008] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 745.173146][T28008] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 745.173173][T28008] [ 746.726455][T28037] hsr0: entered promiscuous mode [ 746.737725][T28037] macvlan2: entered allmulticast mode [ 746.765148][T28037] hsr0: entered allmulticast mode [ 746.775307][T28037] hsr_slave_0: entered allmulticast mode [ 746.806735][T28037] hsr_slave_1: entered allmulticast mode [ 746.872762][T28045] syzkaller0: entered promiscuous mode [ 746.880201][T28045] syzkaller0: entered allmulticast mode [ 747.130687][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.466849][T28077] __nla_validate_parse: 10 callbacks suppressed [ 747.466870][T28077] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6367'. [ 747.573323][T28077] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6367'. [ 747.618261][T28086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 747.667565][T28081] netlink: 10 bytes leftover after parsing attributes in process `syz.0.6368'. [ 747.942968][T28061] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6362'. [ 748.577834][T28125] netlink: 'syz.1.6376': attribute type 1 has an invalid length. [ 748.585994][T28125] netlink: 244 bytes leftover after parsing attributes in process `syz.1.6376'. [ 748.602513][T28103] FAULT_INJECTION: forcing a failure. [ 748.602513][T28103] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 748.652119][T28103] CPU: 0 UID: 0 PID: 28103 Comm: syz.3.6372 Not tainted syzkaller #0 PREEMPT(full) [ 748.652144][T28103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 748.652155][T28103] Call Trace: [ 748.652162][T28103] [ 748.652177][T28103] dump_stack_lvl+0xe8/0x150 [ 748.652204][T28103] should_fail_ex+0x412/0x560 [ 748.652232][T28103] _copy_from_user+0x2d/0xb0 [ 748.652251][T28103] do_sock_getsockopt+0x165/0x3f0 [ 748.652276][T28103] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 748.652297][T28103] ? __fget_files+0x3a0/0x420 [ 748.652314][T28103] ? __fget_files+0x2a/0x420 [ 748.652336][T28103] __x64_sys_getsockopt+0x1a4/0x240 [ 748.652365][T28103] do_syscall_64+0x14d/0xf80 [ 748.652386][T28103] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.652402][T28103] ? trace_irq_disable+0x37/0x100 [ 748.652419][T28103] ? clear_bhb_loop+0x40/0x90 [ 748.652440][T28103] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.652456][T28103] RIP: 0033:0x7f0c1659bf79 [ 748.652472][T28103] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 748.652486][T28103] RSP: 002b:00007f0c1747e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 748.652505][T28103] RAX: ffffffffffffffda RBX: 00007f0c16815fa0 RCX: 00007f0c1659bf79 [ 748.652518][T28103] RDX: 0000000000000021 RSI: 0000000000000006 RDI: 0000000000000003 [ 748.652528][T28103] RBP: 00007f0c1747e090 R08: 0000200000000100 R09: 0000000000000000 [ 748.652540][T28103] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 748.652550][T28103] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 748.652579][T28103] [ 748.885758][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 748.893870][ C1] lec:lec_tx_timeout: lec0 [ 748.903358][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 749.053001][T28118] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 749.193124][T28118] bond1 (unregistering): Released all slaves [ 749.210399][T28122] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6376'. [ 749.220989][T28122] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6376'. [ 749.230496][T28122] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6376'. [ 749.239553][T28086] ip6_vti0 speed is unknown, defaulting to 1000 [ 749.245150][T28140] netlink: 104 bytes leftover after parsing attributes in process `syz.3.6377'. [ 749.255897][T28140] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6377'. [ 749.424426][T28145] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 749.436620][T28145] team0 (unregistering): Port device team_slave_0 removed [ 749.449175][T28145] team0 (unregistering): Failed to send options change via netlink (err -105) [ 749.459146][T28145] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 749.474729][T28145] team0 (unregistering): Port device team_slave_1 removed [ 749.544745][T28155] FAULT_INJECTION: forcing a failure. [ 749.544745][T28155] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 749.560207][T28155] CPU: 1 UID: 0 PID: 28155 Comm: syz.3.6382 Not tainted syzkaller #0 PREEMPT(full) [ 749.560231][T28155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 749.560242][T28155] Call Trace: [ 749.560250][T28155] [ 749.560258][T28155] dump_stack_lvl+0xe8/0x150 [ 749.560284][T28155] should_fail_ex+0x412/0x560 [ 749.560310][T28155] _copy_from_iter+0x3b0/0x1670 [ 749.560343][T28155] ? __pfx__copy_from_iter+0x10/0x10 [ 749.560372][T28155] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 749.560396][T28155] skb_copy_datagram_from_iter+0xf5/0x710 [ 749.560420][T28155] ? dev_get_by_index+0x22/0x2e0 [ 749.560440][T28155] ? skb_put+0x11b/0x210 [ 749.560462][T28155] packet_sendmsg+0x37e4/0x50f0 [ 749.560489][T28155] ? __lock_acquire+0x6b5/0x2cf0 [ 749.560516][T28155] ? unwind_next_frame+0xa5/0x23c0 [ 749.560548][T28155] ? aa_sk_perm+0x15a/0x960 [ 749.560570][T28155] ? aa_sk_perm+0x82d/0x960 [ 749.560587][T28155] ? __pfx_packet_sendmsg+0x10/0x10 [ 749.560614][T28155] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 749.560640][T28155] ? aa_sock_msg_perm+0xf1/0x1b0 [ 749.560662][T28155] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 749.560684][T28155] ? __pfx_packet_sendmsg+0x10/0x10 [ 749.560699][T28155] ____sys_sendmsg+0xa68/0xad0 [ 749.560730][T28155] ? __pfx_____sys_sendmsg+0x10/0x10 [ 749.560755][T28155] ? import_iovec+0x73/0xa0 [ 749.560775][T28155] ___sys_sendmsg+0x2a5/0x360 [ 749.560793][T28155] ? __lock_acquire+0x6b5/0x2cf0 [ 749.560813][T28155] ? __pfx____sys_sendmsg+0x10/0x10 [ 749.560860][T28155] ? __fget_files+0x2a/0x420 [ 749.560877][T28155] ? __fget_files+0x3a0/0x420 [ 749.560900][T28155] __x64_sys_sendmsg+0x1bd/0x2a0 [ 749.560922][T28155] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 749.560949][T28155] ? __pfx_ksys_write+0x10/0x10 [ 749.560979][T28155] do_syscall_64+0x14d/0xf80 [ 749.560999][T28155] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.561015][T28155] ? trace_irq_disable+0x37/0x100 [ 749.561033][T28155] ? clear_bhb_loop+0x40/0x90 [ 749.561052][T28155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 749.561068][T28155] RIP: 0033:0x7f0c1659bf79 [ 749.561085][T28155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 749.561099][T28155] RSP: 002b:00007f0c1747e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 749.561117][T28155] RAX: ffffffffffffffda RBX: 00007f0c16815fa0 RCX: 00007f0c1659bf79 [ 749.561130][T28155] RDX: 0000000024000008 RSI: 00002000000000c0 RDI: 0000000000000003 [ 749.561142][T28155] RBP: 00007f0c1747e090 R08: 0000000000000000 R09: 0000000000000000 [ 749.561152][T28155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 749.561170][T28155] R13: 00007f0c16816038 R14: 00007f0c16815fa0 R15: 00007ffe6fbc2238 [ 749.561197][T28155] [ 749.874128][T28147] vlan0: entered allmulticast mode [ 749.879637][T28147] bridge0: port 3(vlan0) entered blocking state [ 749.888580][T28147] bridge0: port 3(vlan0) entered disabled state [ 749.896370][T28147] vlan0: entered promiscuous mode [ 749.940408][T28153] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.986166][T28160] bridge1: entered promiscuous mode [ 749.991417][T28160] bridge1: entered allmulticast mode [ 750.097324][T28153] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.098937][T28167] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 750.203792][T28169] hsr0: entered promiscuous mode [ 750.208954][T28169] macvlan2: entered allmulticast mode [ 750.214322][T28169] hsr0: entered allmulticast mode [ 750.220502][T28169] hsr_slave_0: entered allmulticast mode [ 750.226666][T28169] hsr_slave_1: entered allmulticast mode [ 750.237392][T28171] netlink: 'syz.2.6387': attribute type 12 has an invalid length. [ 750.256720][T28171] netlink: 'syz.2.6387': attribute type 29 has an invalid length. [ 750.265031][T28171] netlink: 'syz.2.6387': attribute type 2 has an invalid length. [ 750.289118][T28153] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.333719][T28169] tipc: Enabled bearer , priority 0 [ 750.497874][T28179] netlink: 'syz.3.6389': attribute type 3 has an invalid length. [ 750.510158][T28153] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.520750][T16185] IPVS: starting estimator thread 0... [ 750.625740][T28181] IPVS: using max 37 ests per chain, 88800 per kthread [ 750.932120][T15440] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 750.984356][T15440] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.019039][T15440] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.049615][T15440] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.325780][ T5879] tipc: Node number set to 1763189125 [ 751.344495][T28217] netlink: 'syz.0.6398': attribute type 10 has an invalid length. [ 751.510415][T28225] macvlan3: entered allmulticast mode [ 751.550257][T28225] tipc: Enabling of bearer rejected, already enabled [ 751.600589][T28230] netlink: 'syz.1.6402': attribute type 1 has an invalid length. [ 751.899491][T28248] xt_hashlimit: size too large, truncated to 1048576 [ 751.990030][T28250] syzkaller0: entered promiscuous mode [ 752.035495][T28250] syzkaller0: entered allmulticast mode [ 752.061159][T28261] netlink: 'syz.0.6411': attribute type 10 has an invalid length. [ 752.067169][T28252] ¾x9ÿ: renamed from bridge_slave_0 [ 752.300071][T28274] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 752.320465][T28274] bond1 (unregistering): Released all slaves [ 752.443528][T28277] tipc: Enabling of bearer rejected, already enabled [ 752.586484][T28292] netlink: 'syz.0.6416': attribute type 1 has an invalid length. [ 752.644826][T28300] __nla_validate_parse: 13 callbacks suppressed [ 752.644844][T28300] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6416'. [ 752.704385][T28292] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6416'. [ 752.832787][T28310] sctp: [Deprecated]: syz.3.6424 (pid 28310) Use of int in max_burst socket option deprecated. [ 752.832787][T28310] Use struct sctp_assoc_value instead [ 752.864712][T28315] bridge0: port 1(1¾x9ÿ) entered blocking state [ 752.871892][T28315] bridge0: port 1(1¾x9ÿ) entered disabled state [ 752.882682][T28315] ¾x9ÿ: entered allmulticast mode [ 752.891627][T28315] ¾x9ÿ: entered promiscuous mode [ 752.974014][T28324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6429'. [ 752.986222][T28323] netlink: 51 bytes leftover after parsing attributes in process `syz.0.6430'. [ 752.991682][T28324] hsr0: entered promiscuous mode [ 753.000804][T28324] macvlan0: entered allmulticast mode [ 753.006335][T28324] hsr0: entered allmulticast mode [ 753.018741][T28324] hsr_slave_0: entered allmulticast mode [ 753.025032][T28324] hsr_slave_1: entered allmulticast mode [ 753.034434][T28327] bridge0: entered allmulticast mode [ 753.080548][T28320] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 753.103114][T28320] bond1 (unregistering): Released all slaves [ 753.145751][T28328] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6429'. [ 753.159449][T28328] tipc: Enabled bearer , priority 0 [ 753.190700][T28331] netlink: 152 bytes leftover after parsing attributes in process `syz.0.6432'. [ 753.545918][T28358] FAULT_INJECTION: forcing a failure. [ 753.545918][T28358] name failslab, interval 1, probability 0, space 0, times 0 [ 753.556816][T28360] netlink: 51 bytes leftover after parsing attributes in process `syz.2.6442'. [ 753.568863][T28359] netlink: 'syz.0.6441': attribute type 10 has an invalid length. [ 753.575755][T28358] CPU: 1 UID: 0 PID: 28358 Comm: syz.1.6443 Not tainted syzkaller #0 PREEMPT(full) [ 753.575778][T28358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 753.575788][T28358] Call Trace: [ 753.575795][T28358] [ 753.575803][T28358] dump_stack_lvl+0xe8/0x150 [ 753.575830][T28358] should_fail_ex+0x412/0x560 [ 753.575857][T28358] should_failslab+0xa8/0x100 [ 753.575883][T28358] __kmalloc_cache_noprof+0x88/0x660 [ 753.575906][T28358] ? rtnl_newlink+0x136/0x1be0 [ 753.575930][T28358] rtnl_newlink+0x136/0x1be0 [ 753.575959][T28358] ? __pfx_rtnl_newlink+0x10/0x10 [ 753.575981][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576013][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576032][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576058][T28358] ? unwind_next_frame+0xa5/0x23c0 [ 753.576085][T28358] ? unwind_next_frame+0xa5/0x23c0 [ 753.576107][T28358] ? is_bpf_text_address+0x26/0x2b0 [ 753.576137][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576159][T28358] ? is_bpf_text_address+0x292/0x2b0 [ 753.576179][T28358] ? is_bpf_text_address+0x26/0x2b0 [ 753.576201][T28358] ? kernel_text_address+0xa5/0xe0 [ 753.576232][T28358] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 753.576261][T28358] ? __pfx_rtnl_newlink+0x10/0x10 [ 753.576279][T28358] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 753.576299][T28358] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 753.576316][T28358] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 753.576334][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576363][T28358] netlink_rcv_skb+0x232/0x4b0 [ 753.576382][T28358] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 753.576401][T28358] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 753.576428][T28358] ? netlink_deliver_tap+0x2e/0x1b0 [ 753.576453][T28358] netlink_unicast+0x80f/0x9b0 [ 753.576482][T28358] ? __pfx_netlink_unicast+0x10/0x10 [ 753.576505][T28358] ? netlink_sendmsg+0x650/0xb40 [ 753.576521][T28358] ? skb_put+0x11b/0x210 [ 753.576543][T28358] netlink_sendmsg+0x813/0xb40 [ 753.576568][T28358] ? __pfx_netlink_sendmsg+0x10/0x10 [ 753.576588][T28358] ? aa_sock_msg_perm+0xf1/0x1b0 [ 753.576612][T28358] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 753.576635][T28358] ? __pfx_netlink_sendmsg+0x10/0x10 [ 753.576651][T28358] ____sys_sendmsg+0xa68/0xad0 [ 753.576670][T28358] ? __might_fault+0xaf/0x130 [ 753.576695][T28358] ? __pfx_____sys_sendmsg+0x10/0x10 [ 753.576721][T28358] ? import_iovec+0x73/0xa0 [ 753.576740][T28358] ___sys_sendmsg+0x2a5/0x360 [ 753.576759][T28358] ? __lock_acquire+0x6b5/0x2cf0 [ 753.576779][T28358] ? __pfx____sys_sendmsg+0x10/0x10 [ 753.576831][T28358] ? __fget_files+0x2a/0x420 [ 753.576847][T28358] ? __fget_files+0x3a0/0x420 [ 753.576874][T28358] __x64_sys_sendmsg+0x1bd/0x2a0 [ 753.576896][T28358] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 753.576925][T28358] ? __pfx_ksys_write+0x10/0x10 [ 753.576955][T28358] do_syscall_64+0x14d/0xf80 [ 753.576975][T28358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 753.576991][T28358] ? trace_irq_disable+0x37/0x100 [ 753.577016][T28358] ? clear_bhb_loop+0x40/0x90 [ 753.577036][T28358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 753.577053][T28358] RIP: 0033:0x7f394d39bf79 [ 753.577069][T28358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 753.577083][T28358] RSP: 002b:00007f394e28d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 753.577101][T28358] RAX: ffffffffffffffda RBX: 00007f394d615fa0 RCX: 00007f394d39bf79 [ 753.577113][T28358] RDX: 0000000024000000 RSI: 0000200000000980 RDI: 0000000000000003 [ 753.577126][T28358] RBP: 00007f394e28d090 R08: 0000000000000000 R09: 0000000000000000 [ 753.577137][T28358] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 753.577148][T28358] R13: 00007f394d616038 R14: 00007f394d615fa0 R15: 00007fff260c7698 [ 753.577176][T28358] [ 753.715167][T28363] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6444'. [ 753.718298][T28364] netlink: 'syz.0.6441': attribute type 10 has an invalid length. [ 753.915454][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 753.926848][T28364] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 753.930269][ C1] lec:lec_tx_timeout: lec0 [ 753.988016][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 754.004198][T28366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6445'. [ 754.031746][T28366] macvlan1: entered allmulticast mode [ 754.096143][T28366] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6445'. [ 754.124313][T28371] FAULT_INJECTION: forcing a failure. [ 754.124313][T28371] name failslab, interval 1, probability 0, space 0, times 0 [ 754.130165][T28366] tipc: Enabling of bearer rejected, already enabled [ 754.138151][T28371] CPU: 1 UID: 0 PID: 28371 Comm: syz.0.6447 Not tainted syzkaller #0 PREEMPT(full) [ 754.138175][T28371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 754.138186][T28371] Call Trace: [ 754.138193][T28371] [ 754.138200][T28371] dump_stack_lvl+0xe8/0x150 [ 754.138237][T28371] should_fail_ex+0x412/0x560 [ 754.138264][T28371] should_failslab+0xa8/0x100 [ 754.138288][T28371] __kmalloc_cache_noprof+0x88/0x660 [ 754.138310][T28371] ? bcm_tx_setup+0x3ab/0x1bc0 [ 754.138336][T28371] bcm_tx_setup+0x3ab/0x1bc0 [ 754.138363][T28371] ? __local_bh_enable_ip+0xd0/0x130 [ 754.138386][T28371] bcm_sendmsg+0x46e/0x6c0 [ 754.138410][T28371] ? __pfx_bcm_sendmsg+0x10/0x10 [ 754.138435][T28371] ? aa_sock_msg_perm+0xf1/0x1b0 [ 754.138457][T28371] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 754.138480][T28371] ? __pfx_bcm_sendmsg+0x10/0x10 [ 754.138498][T28371] ____sys_sendmsg+0xa68/0xad0 [ 754.138519][T28371] ? __might_fault+0xaf/0x130 [ 754.138543][T28371] ? __pfx_____sys_sendmsg+0x10/0x10 [ 754.138571][T28371] ? import_iovec+0x73/0xa0 [ 754.138592][T28371] ___sys_sendmsg+0x2a5/0x360 [ 754.138610][T28371] ? __lock_acquire+0x6b5/0x2cf0 [ 754.138632][T28371] ? __pfx____sys_sendmsg+0x10/0x10 [ 754.138683][T28371] ? __fget_files+0x2a/0x420 [ 754.138698][T28371] ? __fget_files+0x3a0/0x420 [ 754.138723][T28371] __x64_sys_sendmsg+0x1bd/0x2a0 [ 754.138745][T28371] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 754.138781][T28371] ? __pfx_ksys_write+0x10/0x10 [ 754.138811][T28371] do_syscall_64+0x14d/0xf80 [ 754.138831][T28371] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.138846][T28371] ? trace_irq_disable+0x37/0x100 [ 754.138863][T28371] ? clear_bhb_loop+0x40/0x90 [ 754.138883][T28371] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 754.138898][T28371] RIP: 0033:0x7ffbc0f9bf79 [ 754.138913][T28371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 754.138927][T28371] RSP: 002b:00007ffbbf1f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 754.138944][T28371] RAX: ffffffffffffffda RBX: 00007ffbc1215fa0 RCX: 00007ffbc0f9bf79 [ 754.138956][T28371] RDX: 0000000000000000 RSI: 0000200000000440 RDI: 0000000000000003 [ 754.138967][T28371] RBP: 00007ffbbf1f6090 R08: 0000000000000000 R09: 0000000000000000 [ 754.138977][T28371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 754.138987][T28371] R13: 00007ffbc1216038 R14: 00007ffbc1215fa0 R15: 00007fffc33a3938 [ 754.139015][T28371] [ 754.396650][T16185] tipc: Node number set to 4195357308 [ 754.552300][T28383] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 754.626796][T28383] bond2 (unregistering): Released all slaves [ 754.736802][T28398] macvlan4: entered allmulticast mode [ 754.784462][T28398] tipc: Enabling of bearer rejected, already enabled [ 754.984220][T28414] macvlan5: entered allmulticast mode [ 754.999895][T28414] tipc: Enabling of bearer rejected, already enabled [ 755.249338][T28436] macvlan3: entered allmulticast mode [ 756.258271][T28468] macvlan4: entered allmulticast mode [ 758.114252][T28424] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 758.247809][T28476] __nla_validate_parse: 9 callbacks suppressed [ 758.247828][T28476] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6479'. [ 758.266274][T28475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6481'. [ 758.282691][T28475] macvlan2: entered allmulticast mode [ 758.501112][T28492] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6487'. [ 758.769532][T28510] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6496'. [ 758.852212][T28518] netlink: 'syz.2.6499': attribute type 1 has an invalid length. [ 758.884801][T28510] 8021q: adding VLAN 0 to HW filter on device bond1 [ 758.940486][T28519] bond1: (slave macvlan0): Enslaving as an active interface with an up link [ 758.963077][T28516] pim6reg: entered allmulticast mode [ 759.216525][T28538] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6508'. [ 759.292545][T28538] netlink: 'syz.4.6508': attribute type 1 has an invalid length. [ 759.321717][T28538] netlink: 'syz.4.6508': attribute type 2 has an invalid length. [ 759.501165][T28545] syzkaller1: entered promiscuous mode [ 759.507289][T28545] syzkaller1: entered allmulticast mode [ 759.547270][T28553] netlink: 'syz.4.6514': attribute type 1 has an invalid length. [ 759.547693][T28556] netlink: 276 bytes leftover after parsing attributes in process `syz.2.6516'. [ 759.570964][T28556] netlink: 276 bytes leftover after parsing attributes in process `syz.2.6516'. [ 759.635239][T28553] 8021q: adding VLAN 0 to HW filter on device bond1 [ 759.662677][T28560] bond1: (slave macvlan0): making interface the new active one [ 759.692785][T28560] bond1: (slave macvlan0): Enslaving as an active interface with an up link [ 759.765419][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5780 ms [ 759.773532][ C1] lec:lec_tx_timeout: lec0 [ 759.780061][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 759.882918][T28575] syzkaller1: entered promiscuous mode [ 759.899916][T28575] syzkaller1: entered allmulticast mode [ 760.106742][T28591] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6531'. [ 760.437138][T28614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6543'. [ 760.579765][T28622] netlink: 'syz.3.6547': attribute type 11 has an invalid length. [ 760.590047][T28614] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6543'. [ 760.697777][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 760.707687][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 760.716400][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 760.733356][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 760.742406][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 761.143700][T28644] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 761.151096][T28644] IPv6: NLM_F_CREATE should be set when creating new route [ 761.158422][T28644] IPv6: NLM_F_CREATE should be set when creating new route [ 761.204011][T28625] ip6_vti0 speed is unknown, defaulting to 1000 [ 761.281148][T28649] tipc: Started in network mode [ 761.312813][T28649] tipc: Node identity ea1bf1abf038, cluster identity 4711 [ 761.332427][T28649] tipc: Enabled bearer , priority 0 [ 761.362887][T28654] syzkaller0: entered promiscuous mode [ 761.388156][T28654] syzkaller0: entered allmulticast mode [ 761.482605][T28649] tipc: Resetting bearer [ 761.510215][T28648] tipc: Resetting bearer [ 761.575208][T28648] tipc: Disabling bearer [ 761.671267][T28668] macvlan0: entered promiscuous mode [ 761.684809][T28668] batadv0: entered promiscuous mode [ 761.805802][ C1] [ 761.808165][ C1] ============================================ [ 761.814296][ C1] WARNING: possible recursive locking detected [ 761.820440][ C1] syzkaller #0 Not tainted [ 761.824845][ C1] -------------------------------------------- [ 761.830975][ C1] syz-executor/28625 is trying to acquire lock: [ 761.837198][ C1] ffff8880a3b6cf70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 761.846235][ C1] [ 761.846235][ C1] but task is already holding lock: [ 761.853578][ C1] ffff888059410f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 761.863922][ C1] [ 761.863922][ C1] other info that might help us debug this: [ 761.871968][ C1] Possible unsafe locking scenario: [ 761.871968][ C1] [ 761.879406][ C1] CPU0 [ 761.882678][ C1] ---- [ 761.885939][ C1] lock(&hsr->seqnr_lock); [ 761.890426][ C1] lock(&hsr->seqnr_lock); [ 761.894914][ C1] [ 761.894914][ C1] *** DEADLOCK *** [ 761.894914][ C1] [ 761.903035][ C1] May be due to missing lock nesting notation [ 761.903035][ C1] [ 761.911341][ C1] 9 locks held by syz-executor/28625: [ 761.916692][ C1] #0: ffffffff90127cd0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 761.926183][ C1] #1: ffffffff8fbbe808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 [ 761.935282][ C1] #2: ffffc90000a08d00 ((&hsr->announce_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5a0 [ 761.945270][ C1] #3: ffffffff8e75e0a0 (rcu_read_lock){....}-{1:3}, at: hsr_announce+0x89/0x370 [ 761.954482][ C1] #4: ffff888059410f70 (&hsr->seqnr_lock){+.-.}-{3:3}, at: send_hsr_supervision_frame+0x380/0xcb0 [ 761.965256][ C1] #5: ffffffff8e75e0a0 (rcu_read_lock){....}-{1:3}, at: hsr_forward_skb+0xb3/0x2860 [ 761.974723][ C1] #6: ffffffff8e75e100 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 761.984634][ C1] #7: ffffffff8e75e100 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x274/0x3850 [ 761.994551][ C1] #8: ffffffff8e75e0a0 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 762.003684][ C1] [ 762.003684][ C1] stack backtrace: [ 762.009654][ C1] CPU: 1 UID: 0 PID: 28625 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 762.009679][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 762.009688][ C1] Call Trace: [ 762.009697][ C1] [ 762.009704][ C1] dump_stack_lvl+0xe8/0x150 [ 762.009726][ C1] print_deadlock_bug+0x279/0x290 [ 762.009745][ C1] __lock_acquire+0x253f/0x2cf0 [ 762.009762][ C1] ? __siphash_unaligned+0x25f/0x3b0 [ 762.009782][ C1] ? __flow_hash_from_keys+0x45b/0x6e0 [ 762.009801][ C1] ? hsr_dev_xmit+0x237/0x360 [ 762.009814][ C1] lock_acquire+0x106/0x330 [ 762.009827][ C1] ? hsr_dev_xmit+0x237/0x360 [ 762.009842][ C1] ? hsr_dev_xmit+0x237/0x360 [ 762.009853][ C1] _raw_spin_lock_bh+0x36/0x50 [ 762.009869][ C1] ? hsr_dev_xmit+0x237/0x360 [ 762.009881][ C1] hsr_dev_xmit+0x237/0x360 [ 762.009892][ C1] ? hsr_dev_xmit+0x2d/0x360 [ 762.009905][ C1] dev_hard_start_xmit+0x2cd/0x7f0 [ 762.009927][ C1] __dev_queue_xmit+0x168f/0x3850 [ 762.009946][ C1] ? lock_acquire+0x106/0x330 [ 762.009966][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 762.009985][ C1] ? __dev_queue_xmit+0x274/0x3850 [ 762.010008][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 762.010025][ C1] ? lock_acquire+0x106/0x330 [ 762.010040][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 762.010060][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 762.010077][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 762.010095][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 762.010111][ C1] ? qdisc_pkt_len_segs_init+0x2c4/0x970 [ 762.010131][ C1] macvlan_start_xmit+0x3ba/0x600 [ 762.010152][ C1] dev_hard_start_xmit+0x2cd/0x7f0 [ 762.010174][ C1] __dev_queue_xmit+0x168f/0x3850 [ 762.010191][ C1] ? handle_softirqs+0x22a/0x7c0 [ 762.010206][ C1] ? register_netdevice+0x173a/0x1cf0 [ 762.010224][ C1] ? br_dev_newlink+0x6a/0x140 [ 762.010242][ C1] ? netlink_sendmsg+0x813/0xb40 [ 762.010256][ C1] ? __x64_sys_sendto+0xde/0x100 [ 762.010271][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.010284][ C1] ? __dev_queue_xmit+0x274/0x3850 [ 762.010305][ C1] ? __pfx___dev_queue_xmit+0x10/0x10 [ 762.010324][ C1] ? __copy_skb_header+0xa3/0x4a0 [ 762.010341][ C1] ? __asan_memcpy+0x40/0x70 [ 762.010356][ C1] ? __skb_clone+0x63/0x7a0 [ 762.010373][ C1] ? __skb_clone+0x483/0x7a0 [ 762.010389][ C1] ? hsr_addr_subst_dest+0x30d/0xa90 [ 762.010410][ C1] ? skb_clone+0x246/0x3a0 [ 762.010427][ C1] hsr_forward_skb+0x157b/0x2860 [ 762.010446][ C1] ? hsr_forward_skb+0xb3/0x2860 [ 762.010461][ C1] ? __pfx_hsr_forward_skb+0x10/0x10 [ 762.010475][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 762.010495][ C1] ? __asan_memset+0x22/0x50 [ 762.010509][ C1] ? __skb_pad+0x405/0x610 [ 762.010527][ C1] send_hsr_supervision_frame+0x731/0xcb0 [ 762.010544][ C1] ? __pfx_send_hsr_supervision_frame+0x10/0x10 [ 762.010559][ C1] hsr_announce+0x1db/0x370 [ 762.010572][ C1] ? hsr_announce+0x89/0x370 [ 762.010584][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 762.010595][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 762.010616][ C1] call_timer_fn+0x192/0x5a0 [ 762.010630][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 762.010642][ C1] ? call_timer_fn+0xd4/0x5a0 [ 762.010655][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 762.010671][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 762.010686][ C1] ? __pfx_hsr_announce+0x10/0x10 [ 762.010698][ C1] __run_timer_base+0x652/0x8b0 [ 762.010715][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 762.010732][ C1] run_timer_softirq+0xb7/0x170 [ 762.010745][ C1] handle_softirqs+0x22a/0x7c0 [ 762.010761][ C1] ? do_softirq+0x76/0xd0 [ 762.010777][ C1] ? br_device_event+0x17b/0x970 [ 762.010792][ C1] do_softirq+0x76/0xd0 [ 762.010806][ C1] [ 762.010811][ C1] [ 762.010816][ C1] __local_bh_enable_ip+0xf8/0x130 [ 762.010831][ C1] br_device_event+0x17b/0x970 [ 762.010847][ C1] ? __pfx_br_device_event+0x10/0x10 [ 762.010864][ C1] notifier_call_chain+0x19d/0x3a0 [ 762.010885][ C1] register_netdevice+0x173a/0x1cf0 [ 762.010907][ C1] ? __pfx_register_netdevice+0x10/0x10 [ 762.010930][ C1] br_dev_newlink+0x6a/0x140 [ 762.010947][ C1] ? rtnl_newlink_create+0x311/0xb70 [ 762.010964][ C1] ? __pfx_br_dev_newlink+0x10/0x10 [ 762.010981][ C1] rtnl_newlink_create+0x329/0xb70 [ 762.011002][ C1] ? __pfx___nla_validate_parse+0x10/0x10 [ 762.011019][ C1] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 762.011036][ C1] ? __pfx___mutex_lock+0x10/0x10 [ 762.011056][ C1] ? full_name_hash+0x92/0xe0 [ 762.011070][ C1] rtnl_newlink+0x1666/0x1be0 [ 762.011090][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 762.011109][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 762.011123][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 762.011139][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 762.011158][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 762.011175][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 762.011195][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 762.011210][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 762.011227][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 762.011244][ C1] ? kernel_text_address+0xa5/0xe0 [ 762.011263][ C1] ? __kernel_text_address+0xd/0x30 [ 762.011282][ C1] ? unwind_get_return_address+0x4d/0x90 [ 762.011300][ C1] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 762.011318][ C1] ? __pfx_rtnl_newlink+0x10/0x10 [ 762.011331][ C1] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 762.011347][ C1] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 762.011360][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 762.011374][ C1] ? __lock_acquire+0x6b5/0x2cf0 [ 762.011391][ C1] netlink_rcv_skb+0x232/0x4b0 [ 762.011404][ C1] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 762.011419][ C1] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 762.011434][ C1] ? netlink_deliver_tap+0x2e/0x1b0 [ 762.011450][ C1] netlink_unicast+0x80f/0x9b0 [ 762.011471][ C1] ? __pfx_netlink_unicast+0x10/0x10 [ 762.011490][ C1] ? netlink_sendmsg+0x650/0xb40 [ 762.011503][ C1] ? skb_put+0x11b/0x210 [ 762.011518][ C1] netlink_sendmsg+0x813/0xb40 [ 762.011534][ C1] ? __pfx_netlink_sendmsg+0x10/0x10 [ 762.011548][ C1] ? aa_sock_msg_perm+0xf1/0x1b0 [ 762.011567][ C1] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 762.011586][ C1] __sys_sendto+0x709/0x7a0 [ 762.011602][ C1] ? __pfx___sys_sendto+0x10/0x10 [ 762.011626][ C1] ? rcu_is_watching+0x15/0xb0 [ 762.011644][ C1] __x64_sys_sendto+0xde/0x100 [ 762.011660][ C1] do_syscall_64+0x14d/0xf80 [ 762.011677][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.011691][ C1] ? trace_irq_disable+0x37/0x100 [ 762.011706][ C1] ? clear_bhb_loop+0x40/0x90 [ 762.011721][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 762.011734][ C1] RIP: 0033:0x7fee7c95c84e [ 762.011748][ C1] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 762.011761][ C1] RSP: 002b:00007ffe004c72c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 762.011776][ C1] RAX: ffffffffffffffda RBX: 000055558b4f1500 RCX: 00007fee7c95c84e [ 762.011787][ C1] RDX: 000000000000004c RSI: 00007fee7d744670 RDI: 0000000000000003 [ 762.011796][ C1] RBP: 0000000000000001 R08: 00007ffe004c7344 R09: 000000000000000c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 762.011805][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 762.011813][ C1] R13: 0000000000000000 R14: 00007fee7d744670 R15: 0000000000000000 [ 762.011828][ C1] [ 762.805692][ T5822] Bluetooth: hci2: command tx timeout [ 763.724558][T15247] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.734647][T15247] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.790815][T15247] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.800700][T15247] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.834931][T15247] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.849210][T15247] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.889630][T15247] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 763.899720][T15247] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 763.990653][T15247] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.037897][T15247] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.074338][T15247] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.161833][T15247] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.242410][T15247] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.299553][T15247] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.328722][T15247] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.382098][T15247] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 764.494121][T15247] vlan0: left promiscuous mode [ 764.501494][T15247] bridge0: port 3(vlan0) entered disabled state [ 764.509482][T15247] bridge_slave_1: left allmulticast mode [ 764.515128][T15247] bridge_slave_1: left promiscuous mode [ 764.522015][T15247] bridge0: port 2(bridge_slave_1) entered disabled state [ 764.530998][T15247] bridge_slave_0: left promiscuous mode [ 764.537039][T15247] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.548348][T15247] bridge_slave_1: left allmulticast mode [ 764.554039][T15247] bridge_slave_1: left promiscuous mode [ 764.561086][T15247] bridge0: port 2(bridge_slave_1) entered disabled state [ 764.570040][T15247] bridge_slave_0: left allmulticast mode [ 764.576069][T15247] bridge_slave_0: left promiscuous mode [ 764.581763][T15247] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.592218][T15247] bridge_slave_1: left allmulticast mode [ 764.597987][T15247] bridge_slave_1: left promiscuous mode [ 764.604367][T15247] bridge0: port 2(bridge_slave_1) entered disabled state [ 764.615156][T15247] bridge_slave_0: left allmulticast mode [ 764.621197][T15247] bridge_slave_0: left promiscuous mode [ 764.627616][T15247] bridge0: port 1(bridge_slave_0) entered disabled state [ 764.788193][T15247] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 764.795430][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 764.804697][ C1] lec:lec_tx_timeout: lec0 [ 764.809864][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 764.816414][T15247] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 764.828236][T15247] bond0 (unregistering): Released all slaves [ 764.930199][T15247] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 764.940600][T15247] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 764.950664][T15247] bond0 (unregistering): Released all slaves [ 764.959959][T15247] bond1 (unregistering): (slave macvlan0): Releasing active interface [ 764.970813][T15247] bond1 (unregistering): Released all slaves [ 765.149961][T15247] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 765.160918][T15247] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 765.170665][T15247] bond0 (unregistering): Released all slaves [ 765.178785][T15247] bond1 (unregistering): (slave macvlan0): Releasing backup interface [ 765.188028][T15247] bond1 (unregistering): Released all slaves [ 765.295591][T15247] tipc: Disabling bearer [ 765.313994][T15247] tipc: Left network mode [ 765.333031][T15247] tipc: Disabling bearer [ 765.338921][T15247] tipc: Left network mode [ 766.034171][T15247] macvlan0: left promiscuous mode [ 766.072135][T15247] batadv0: left promiscuous mode [ 766.091131][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 766.098706][T15247] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 766.106537][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 766.114005][T15247] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 766.124454][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 766.132013][T15247] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 766.141798][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 766.149459][T15247] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 766.160742][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 766.168279][T15247] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 766.175977][T15247] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 766.183353][T15247] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 766.198272][T15247] hsr0: left allmulticast mode [ 766.203848][T15247] hsr0: left allmulticast mode [ 766.209714][T15247] veth1_vlan: left promiscuous mode [ 766.215004][T15247] veth0_vlan: left promiscuous mode [ 766.220981][T15247] hsr0: left allmulticast mode [ 766.225892][T15247] veth1_vlan: left promiscuous mode [ 766.231111][T15247] veth0_vlan: left promiscuous mode [ 766.364536][T15247] pim6reg (unregistering): left allmulticast mode [ 767.106541][T15247] IPVS: stop unused estimator thread 0... [ 767.118279][T15247] IPVS: stop unused estimator thread 0... [ 769.825489][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 769.833515][ C1] lec:lec_tx_timeout: lec0 [ 769.838216][ C1] lec:lec_start_xmit: lec0:No lecd attached